Risk
6/12/2013
12:59 PM
50%
50%

7 Tips To Avoid NSA Digital Dragnet

These apps will keep your cell phone calls under wraps -- if the NSA hasn't already found a way to break them.

The Syrian Electronic Army: 9 Things We Know
(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
Is it possible to avoid the National Security Agency's digital dragnet?

Thanks to NSA contractor Edward Snowden, leaked documents published last week revealed that the agency has captured the metadata -- numbers called, call duration, approximate geographical location -- for millions of U.S. phone subscribers. Under U.S. law, the agency is only allowed to spy on foreigners. But the system that's been revealed appears to capture data on everyone, then rely on search algorithms to prevent information being retrieved on anyone who seems to be a U.S. citizen.

But what if you object to the blanket capture of U.S. cell subscribers' metadata information, or simply don't trust the NSA? Is it possible to avoid having information captured as part of the phone-tapping program, or via the surveillance program known as Prism that captures audio, email and video communications made by using such well-known services as Gmail, Facebook, Hotmail, Skype and Yahoo?

Earlier this week, The Washington Post detailed five strategies for preventing communications from being intercepted, including browsing using Tor and using Silent Circle to make phone calls. To what extent will these approaches easily secure your communications, and what other possibilities are available?

[ Cell phone calls are just one way U.S. citizens are monitored. Read What's Next In Video Surveillance. ]

In fact, many of the approaches trade increased information security for decreased usability. Then again, for some people, the tradeoff might be worth it. Here's what's available:

1. Tor, For Anonymous Browsing.

Using the Tor anonymous network helps prevent your traffic from being intercepted, thus foiling anyone who's attempting to identify which websites you're visiting, or people with whom you're communicating. In fact, Snowden, a former CIA employee and NSA contractor, was photographed with a Tor sticker.

Tor, which is free to use, uses an encrypted network to route your browsing. Using it for anonymous browsing is as easy as downloading the Tor Browser Bundle, which is a version of Firefox for Windows, Mac OS X and Linux. But that encrypted, anonymous network comes at a price: slower browsing.

Furthermore, Tor isn't foolproof. The 2011 attacks against Dutch certificate authority DigiNotar, for example, resulted in the creation of fraudulent digital certificates for Facebook, Google, Skype, as well as Tor, apparently for the purpose of spying on Iranian Internet users. Likewise, researchers occasionally identify vulnerabilities in the service that can be exploited to identify users.

2. An OTR App, For Encrypted Chat.

Snowden communicated with Glenn Greenwald, the Guardian journalist who published some of the documents he leaked, using an unnamed OTR -- for "off the record" -- chat messaging program or plug-in.

For many people who want anonymous communications, the ease of using OTR applications, which enable chat sessions to be encrypted between two people using compatible clients or plug-ins for their chat service, makes it a natural choice. Furthermore, numerous free clients exist, including Cryptocat, Adium for Mac OS X and IM+ for Android and iPhone.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Terabyte Net
50%
50%
Terabyte Net,
User Rank: Apprentice
6/13/2013 | 12:35:39 PM
re: 7 Tips To Avoid NSA Digital Dragnet
Taking the battery out is nice but some of the most popular phones do not allow that any more, say iPhone, Razr, etc... Wonder if Apple and Motorola are working with the Feds on phone design? Just sayin'...
HildyJ
50%
50%
HildyJ,
User Rank: Apprentice
6/13/2013 | 3:46:01 PM
re: 7 Tips To Avoid NSA Digital Dragnet
If you are truly concerned, buy a prepaid phone that can be refilled with cards available at a grocery store. Use cash. Then keep the battery out and don't use it from your home or office. Add this to the Information Week tips and you should be reasonably safe.

Broad surveillance like the NSA's is best at catching stupid people. The kind that would email an al-Qaeda website and ask how to join.
Mathew
50%
50%
Mathew,
User Rank: Apprentice
6/14/2013 | 8:46:33 AM
re: 7 Tips To Avoid NSA Digital Dragnet
I don't know, but you'd imagine they'd have taken care of landlines ages ago.
Mathew
50%
50%
Mathew,
User Rank: Apprentice
6/14/2013 | 8:48:02 AM
re: 7 Tips To Avoid NSA Digital Dragnet
More good advice (besides VPN): "Figure out what you are trying to protect (and from whom), separate it from everything else, and then select tools, techniques and procedures that will enable you to protect it."
http://grugq.github.io/blog/20...
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5426
Published: 2014-11-27
MatrikonOPC OPC Server for DNP3 1.2.3 and earlier allows remote attackers to cause a denial of service (unhandled exception and DNP3 process crash) via a crafted message.

CVE-2014-2037
Published: 2014-11-26
Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incomplete fix for CVE 2013-6466.

CVE-2014-6609
Published: 2014-11-26
The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.

CVE-2014-6610
Published: 2014-11-26
Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dia...

CVE-2014-7141
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?