How to encrypt your VoIP calls

Voice over IP calls are not secure

VoIP calls are transmitted over the Internet unencrypted, the data packets can easily be intercepted by a malicious hacker to record the calls and listening in, a simple packet sniffer like WireShark is all that it is needed to eavesdrop on a VoIP call, no high skills are involved.

How to encrypt VoIP calls

1. Use Zfone to add encryption to your VoIP client: Zfone works on top of your unencrypted VoiP software watching for VoiP data packets going in and out of your computer, when it finds them it ciphers the packets encrypting the VoIP call, there is also a man-in-the-middle (MiTM) attack countermeasure by displaying a short authentication string for the user to verbally compare over the phone witht the other end, Zfone is open source software using the ZRTP protocol, there are no backdoors of any kind included.

   Before considering Zfone to secure your VoIP calls have into account that the software must be installed by both callers and Zfone does not work with Skype because Skype uses a closed source protocol not compliant with the standard VoIP protocol.

   

   Zfone VoIP encryption software

2. Use a Virtual Private Network (VPN): A VPN like ibVPN can encrypt all of your internet traffic routing it through it’s encrypted OpeVPN tunnel, this will include all of your VoIP calls. Routing your VoIP calls through a VPN will slightly increase the bandwidth requirement and produce some CPU overhead.

   One benefit of using a VPN is that if your ISP or a corporate firewall is blocking VoIP calls using a VPN for VoIP will get around Internet filters, they won’t even know you are making a call, it will also get around state sponsored surveillance which is normally carried out at ISP level.

   

   Wiretapping VoIP password

3. Use VoiP software with built in encryption: Some VoIP clients like Skype have built-in encryption used to cipher VoIP data packets, if you adopt this solution to secure your phone calls, try to choose voice over IP software compatible with as many other VoIP clients as possible using open source encryption (not Skype) this will make it much harder to introduce a backdoor and it might not require the other end to have the same VoIP client installed for encryption to work.

   VoIP software using encryption: PhonerLite ; TiviPhone ; OctroTalk

Tq http://www.hacker10.com

Quick and easy E-mail encryption using Safester

Review email encryption software Safester

Safester is a free email encryption program using public and private key encryption DSA/Elgamal 2048 bits andAES 256 bits to secure your messages, the program is written using Java, it works in Windows, MAC OS and Linux.

In order to use Safester to send encrypted emails the receiver and the sender both will need to have the software installed, if the receiver doesn’t have an account when he receives an encrypted message a notification from Safester will be sent with an invitation to download the program.

After downloading and installing Safester you will need to create an account, this will create your public and private key encryption keys, the passphrase you use it is not stored in the servers and only known to you, there is no way for Safester to recover your passphrase they do not have access to it and there is no backdoor, you can set up a password recovery email system from inside your account if you want, this is optional.

E-mail encryption software Safester

All of the encrytion is carried out locally in your computer, communications with Safester servers are encrypted, in the unlikely event that someone manages to intercept the transmission you would still be protected because no data ever leaves the computer unencrypted, the messages you send and receive are archived encrypted in Safester servers in Switzerland. The free version of this email encryption service allows for a 20MB of email storage Inbox and email attachments have 512Kb maximum size, there are paid for plans for those who need personalized support, a bigger storage inbox and sending larger attachments.

I found the email client very lean in features, you can compose messages in HTML, there is a built-in spell checker for English and French, vacation auto-responder, proxy settings, address book and message folders, it is enough to get the job done but without bells and whistles.

One of Safester’s best features it is the ability of setting up double authentication using your smart phone and your passphrase to log into your email account, the One Time Authentication system works with the iPhone and Android.

Email encryption Safester advantages

• Easy maintenance free email encryption for newbies (no learning required)

• You can use any email address you like (Hotmail, Yahoo, etc)

• Email client can restrict printing and forwarding of emails

• Email client can be configured to send messages using a proxy

Email encryption Safester disadvantages

• Both, sender and receiver need to have Safester installed

• You are forced to use Safester’s own email client (which is very simple)

• Your need to trust a third party with your security

Safester review conclusion

I you are a geeky person who knows how to use GPG/PGP to encrypt emails, you will be better off using your own software for email encryption (e.g. Enigmail), this way you will not have to rely on a third party to take care of your security and you will be able to use any email client you like for encryption without forcing others to download the same software you have installed.

OpenPGP email encryption program Safester

If you have a company and do not have the time and resources to train your workers in email security and encryption, Safester is for you, anyone who knows how to send an email can use Safester, encryption could not get any easier, the great advantage Safester has over any other email encryption software it is simplicity and easy to use, Safester will save businesses money by not having to spend time on training staff.

Visit Safester homepage

Tq http://www.hacker10.com

Freeware programs for full disk encryption

Why use full disk encryption

If you encrypt your whole hard drive including your operating system you will not have to worry about wiping data, clearing the Internet browser cache, deleting temporary files and encrypting individual files, all you will have to worry about is choosing a strong passphrase that can not be broken using a brute force attack (trying dictionary words).

The only way to access a fully encrypted operating system is by getting access to the computer while it is switched on (decrytped), you will save lots of time if you decide to encrypt your full operating system, it is not difficult and there is free software for that. Windows Vista and 7 come with BitLocker Drive Encryption for full disk encryption but only the more expensive business high end editions do and it has been designed for businesses with few home user features.

Full disk encryption software without backdoor

Truecrypt (Free): It’s wizard driven menu will guide you through the whole encryption process, there are many algorithm choices, if you do not understand what they mean leave all of the default choices on, they are secure enough for everyone. Truecrypt can encrypt external devices, create virtual encrypted drives and create a hidden encrypted operating system, to be used if you are forced to give up the password.

You will find it easy to find support for Truecrypt at computer security forums and Usenet groups as it is one of the most used full disk encryption programs.

Truecrypt encryption algorithm

DiskCryptor (Free): Open source encryption software, it can encrypt partitions that have already data on them, it supports AES, Twofish and Serpent encryption algorithms, allows you to encrypt USB flash drives and external hard disks with automatic mounting, support for key files, option to place the boot loader on an external device.

DiskCryptor full disk encryption

Steganography for dummies

What is steganography?

The word steganography has Greek origins, it means concealed writing, in the digital world steganography (aka steg or stego) consists in hiding data inside data, it is mostly used to hide text inside pictures or sound files butany kind of data can be hidden and any kind of file can be used as a carrier file.

Steganographic software takes advantage of the way binary works where the bits towards the right of a file are the ones with less significance, changing them results in little distortion for the file, an example of this would be changing the red colour of a few pixels on a digital photography for a different tone of red that it is not noticeable to the human eye, since a photography can have millions of pixels slightly changing a thousand of them would be very hard to notice without the the original picture to compare with.

Another use for steganography is digital watermarking, the film industry is known to embed an invisible watermark in their preview films, before release, if one of these copies is leaked and found in a file sharing site they can track down who the person responsible for that copy was. Steganographic software is commonly used in conjunction with encryption, the data is encrypted before hiding it to add an extra layer of security, if the hidden data is ever found it would still be protected by a password.

Steganography advantages over encryption

It does not attract attention: Encrypting a message gives away that there is something of value and this will attract unwanted attention.

Packet sniffing barrier: Encrypted PGP email messages start with a line identifying them as an encrypted PGP message, making it easy for a packet sniffer on an ISP to flag encrypted PGP emails by just scanning for the word PGP or GnuPG, this can not be used against steganography.

Makes Internet surveillance difficult: If someone’s Internet activities are being monitored visiting Flickr and uploading personal family photos with hidden messages will not trigger any alarm but sending encrypted messages and visiting a political discussion forum will.

Difficult to prove it exists: In some countries like the United Kingdom you can be required by the police to provide the password to your encrypted files, refusing to do so carries a prison sentence, if the data has been hidden inside a photograph the police would first have to show beyond reasonable doubt that there is definitely something hidden inside the file.

Methods to detect steganography

Steganalysis is the art of discovering hidden steganographic messages, this science is not perfect, it is possible for steganalysis not to detect steganographic files if the data has been very well concealed and the original file, before data has been hidden within it, is not available for analysis.

Image steganalysis

Steganographic software embeds information in front of the hidden message, this information contains details about the length of the message, compression method, and anything else the developer chooses, after all the data has to be readable at some point, if the software used to hide the information (aka payload) inserts some unique characteristic in the header then it can be proved the file has been tampered with.

A good method to find hidden messages inside pictures is by using an hexadecimal editor and read the image header first bytes, for example a GIF image seen by an hexadecimal editor will always read “47 49 46 38″, it means “GIF” in ASCII code, if a GIF image has been used to hide a message within it when viewed with an hex editor the first identifying bytes will be different from the standard ones.

There are automated tools to detect steganography, one such tool is Stegdetect, capable of detecting messages in jpeg images, after a hidden message has been found a brute force attack can be launched, with dictionary words attempting to guess the password and expose the data.

Highly compressed data like .rar, .mp3 or .jpeg files make it more difficult to hide data inside because they have less “spare” bits available, if you want to make it tough for someone to find your hidden data use an uncompressed carrier file, like .bmp for images and .wav for sound.

How to hide text in pictures and other files

There are various steganography programs available to hide text or files inside photographs, sound files and executable files, you can even hide data inside documents and HTML code, any kind of electronic file can be used to hide data within it.

StegHide: Open source project, it can hide data inside images (.jpeg, .bmp) and audio files (.wav, .au)

MSU StegoVideo: It hides any kind of file inside a video and protects it with a password.

Steganos Privacy Suite (Not free): It hides data inside pictures and sound files and encrypts is with AES256.

Mp3Stego: It encrypts and hides data inside .mp3 files, free program with source code available to look at.

Tq http://www.hacker10.com

How to Encrypt any webmail text message with encipher.it

Encrypt Gmail, Hotmail and Yahoo email

Encipher.it will encrypt and password protect your text messages using symmetric encryption implemented with AES256 and PDBKF2 (Password-Based Key Derivation Function) for key generation, the site itself uses a SSL digital certificate to protect against MITM (Man In The Middle) attacks, the best part is that it works with all services, you can encrypt your webmail messages no matter who your provider is, another possible use is posting of encrypted messages on Usenet or your Facebook account, encryption and decryption is performed in your browser using javascript, no data leaves your browser in plain text. To encrypt the messages you use a bookmarklet that takes you to the encipher.it website, there you will find a box where to enter text, the same box is used for encryption and decryption, when the recipient gets a coded message a one line phrase with a link link tells them where to decrypt it, the bad news is that they will need to know the password too, this should have been transmitted previously through a secure channel, attachments can not be encrypted.

Encipher.it webmail encryption

Encipher.it can be used anywhere, i.e. Internet cafes and libraries, but anything you type in the keyboard of a computer that isn’t yours could easily be recorded, when you use a public computer you should not trust anything on it, if the website were to become too popular it might be easily blocked by an authoritarian regime ISP but that isn’t likely because copycats would then sprout around.

I would only be happy to use this browser based symmetric encryption system if the other part is very lazy about security or doesn’t want to learn about it and the security needs are low. Encrypting text, even with something as simple as ROT13 will leave the average computer users scratching their heads and it will fool email services that scan email messages to introduce contextual advertising on them, like Gmail, for serious security it is better using a public key encryption based system, i.e. PGP, what encipher.it has on its favour is convenience and easy of use.

Visit Encipher.it website

Tq http://www.hacker10.com

Encryption for dummies

Introduction to encryption

In the online world encryption disguises data rearranging the data bits so that nobody can read or see the information without the secret key, this key can consist of a password or a digital file, aka keyfile, encryption secures plain text as well as any other digital media like photos, videos or software, you can also encrypt a whole operating system and a partition.

To secure data, encryption uses mathematic functions known as cryptography algorithms, aka ciphers, some example of well known and trusted cryptography algorithms are AES, Blowfish, Twofish and Serpent, these ciphers can be subcategorized with a number indicating its strength in bits.

An encryption algorithm key length indicates its size measured in bits, the length indicating the algorithm strentgh in bits will always be even (bit is binary unit composed of zeros and ones), these keys are used to control the operation of a cipher.

The more mathematical strength the encryption algorithm has the more difficult it will be to crack it without access to the key but a strong cipher normally requires more computational power, a few seconds of wait might not matter much to the home user but for businesses dealing with thousands of calculations each hour to decrypt/encrypt data in their servers it will mean that more money has to be spent in hardware and electricity.

Why not all websites use encrypted SSL connections

If all of the websites on the Internet used encrypted SSL connections the servers serving content using SSL (Secure Socker Layer) would need more CPU power and more electricity, when you multiply this by millions of pages served each second, costs dramatically add up, page loading would also be slower because the decryption process needs to take place in the computer and those using very low end processors in mobile devices would suffer speed the most.

Symmetric encryption diagram

When choosing an encryption algorithm it is important to look at is many factors, not only key size, when it comes to security how an algorithm has been implemented is much more important than key length, algorithm perfomance also matters, if people had to wait an hour to encrypt and decrypt files encryption would become unusable, a trade off in between security and usability needs to be established, the best is to always choose a standard algorithm that has been widely scrutinised by experts, aka cryptographers.

What encryption key length should I choose?

An AES 128-bit encryption key is considered very strong and suitable to withstand future attaks, the U.S. Government requires 192 or 256-bit AES encryption keys for highly sensitive data, AES is the standard US Government encryption algorithm for data encryption.

A 128-bit key, can have more than 300,000,000,000,000,000,000,000,000,000,000,000 key combinations.

The importance of choosing a strong password for encryption

Encryption software gathers random data before encrypting your files, aka entropy, the password you use will be part of this random data gathered to cipher the files, hence why it is very important that you choose a long passphrase, in addition, you should not use any dictionary words to thwart brute force attacks.

A brute force attack consists of an automatic process where all of the dictionary words are quickly whirled at the password login prompt, as computers have become increasingly faster this can be done in a matter of hours or less using cloud computing.

Encryption security tips

• Always choose an encryption program that uses a standard cipher that has been scrutinised by experts, e.g AES

• Do not use dictionary words as your password, use a long passphrase made up of capital and small letters with punctuation signs and numbers

• Do not use the passphrase you use to encrypt your data for anything else like your webmail password or an online forum which security can be compromised

• Never trust a third party service to store your encryption keys or carry out the encryption implementation, if you store data online encrypt it yourself in your computer

• Watch out for keyloggers and malware in your computer that could capture your keystrokes and your secret passphrase, use an updated antivirus and firewall

• Never reveal to anyone your password, not even to a support department whose staff could be outsourced in a crime ridden country or could be impersonating someone else

Encryption links for beginners

National Cryptologic Museum Foundation

NSA Cryptokids

Intypedia Information Security

Bruce Schneier’s blog (Cryptographer)

Tq http://www.hacker10.com

How to Use an HTTPS-Encrypted Connection When Browsing

When you're browsing the Web, protect yourself by using HTTPS (Hypertext Transfer Protocol Secure) whenever possible. HTTPS encrypts the connection between your PC and the Website you're visiting. Though HTTPS doesn't guarantee that a site is secure, it can help prevent other parties from hacking into the network and gaining access to your account.

Many sites use HTTPS by default: When you purchase an item online or log in to online banking, for instance, your browser will probably connect to the site via HTTPS automatically. But you can go one step further by enabling HTTPS on Facebook, Twitter, and Gmail.

To use Facebook's HTTPS feature, log in to Facebook and click Accountin the upper-right corner. Select Account Settings from the drop-down menu, and look for ‘Account Security' on the resulting page. Under the Account Security heading, clickChange, check the box next to Browse Facebook on a secure connection (https) whenever possible, and click Save.

You can easily enable HTTPS on sites such as Twitter and Facebook and on services such as Gmail to introduce an extra level of security.For Twitter, first log in to your account. If you're using the new Twitter interface, click your account name in the upper-right part of the screen, and select settings. (If you're still using the old Twitter interface, click the Settings link in the upper right of the window.) From there, scroll down to the bottom of the resulting page, check the box next to Always use HTTPS, and click Save.

To enable HTTPS on Gmail, log in to your account, click the gear icon in the upper-right corner, and select Mail Settings from the drop-down menu. Next, under the Browser Connection heading, select the button labeled Always use https. When you're all set, scroll to the bottom of the page and click Save Changes. To learn more about Gmail security, see Google's Gmail Security Checklist.

Tq http://www.pcworld.com