Slashdot Log In
Just How Paranoid Are You?
Posted by
timothy
on Mon Jan 24, 2005 03:00 PM
from the will-the-guards-find-your-watch dept.
from the will-the-guards-find-your-watch dept.
An anonymous reader writes "We all understand the need for security in a corporate environment. Personal computers, however, typically don't have nearly the amount of sensitive information (or it's at least less damaging if found). How far do you go to protect your computer? I recently went overboard on securing my information (at least as secure as Windows XP can be). I have a hardware firewall (GTA GB500), 30 character password, and all remotely personal information stored on a 256bit AES encrypted volume. How far do you go to protect your information against 'Big Brother' or even your family/friends?"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Physical access! (Score:5, Informative)
You should not be carrying any sensitive work related items or data home, but if you have personal stuff (or a home business with IT critical information) you wish to secure, short of establishing a computer "vault" with limited access in your home (actually had one once for a project I was working on), you need to start with a secure OS. This does not mean Windows, unless you can afford a "hardened" version and are skilled at management. In fact, I would say from your question that all of the things you are already doing are the absolute minimum if you are using Windows. If you are truly this paranoid and keep sensitive info on your personal computer, and you obviously have a connection to the Internet, it should also mean, physically removing the Internet connection from your computer at times when you do not need it. Multi-casting OS capable machines like certain flavors *NIX are helpful here, so you dont have to deal with Windows network wizard every time you connect back up (if you use certain settings for your network). Wireless should be a no-no as well. IF you are really (read pathologically or are doing something quite illegal) paranoid, you could also build a Faraday cage around your room and charge it to reduce risk of TEMPEST related probes, but again if this is a concern, someone simply breaking in (again access) is often easier and cheaper.
When you are actually connected to the Internet, a hardware firewall is an absolute necessity. Network address translation will help limit some attacks. And aside from all the other things you are doing (strong passwords, encryption etc....), I would strongly urge you to constantly pay attention to your logs. Your most important data will be gleaned from the logs in terms of who is attacking, their strategies for attacking, when and where.
Re:Physical access! (Score:5, Informative)
A firewall that's not on a trusted host, that's a necessity. It doesn't really matter if it's a Nokia box or monowall, what matters is that you configure it correctly and keep it updated. I'm thinking about setting up a transparent bridging firewall so my wall doesn't even have to have IP addresses.
Parent
Firey death to the intruders! (Score:5, Funny)
Parent
Re:Firey death to the intruders! (Score:5, Insightful)
Parent
Re:Physical access! (Score:5, Interesting)
I run both a hardware and a software firewall. If one is compromised the potential intruder finds yet another. My sensitive data is also all encrypted, so even if the intruder breaks the second one he/she isn't likely to get much of value.
Parent
Re:Physical access! (Score:5, Funny)
Parent
Re:Physical access! (Score:5, Funny)
Parent
Re:Physical access! (Score:4, Funny)
Parent
Re:Physical access! (Score:4, Funny)
Shhhh... don't tell people that!!! I like the all-consuming power I have as a computer geek.
Parent
Re:Physical access! (Score:4, Insightful)
Seriously, some people are very impressed by CLIs. Especially green ones. Try "cat
Parent
Re:Physical access! (Score:5, Funny)
Finally, someone explains what .NET is supposed to do.
Parent
Lock grandma in the closet! (Score:5, Insightful)
Parent
My security system (Score:5, Informative)
The first question is how you identify what threats you are protecting yourself from. My list includes viruses, script kiddiez, and the occasional person who has moderate resources and wants to break into my network. I am not too worried about tempest probes because the it would take a lot of time to get enough information off my systes this way to be of use, but I am more concerned about vandalism and damage.
So here are my mechanisms:
1) Keep door locked when not at home.
2) Hardware firewall on old Acer Advantage. Kernel does not support loadable kernel modules (which makes it a pain to change a network card, as the kernel must be recompiled). Firewall runs IPTables and logs most denied traffic.
3) Daily and monthly reports of firewall activity are sent to my inbox via cron and FWReport. FWReport leans towards false-positives, bit it gives you an idea of what "may" be happening.
4) Remote access requires SSH and public key authentication. Remote access is not possible via password.
5) Email servers run Qmail.
6) Most servers are jailed.
7) Most logs are set to "append only"
8) Servers run minimal configurations with a minimum of extensions. For example, Apache does not run any modules not currently required.
9) Windows is not generally allowed on the network.
Parent
Re:My security system (Score:5, Insightful)
Who says any of the rest of this information is not easy to determine?
lets see:
Apache is kept reasonably up to date.
FWReport is a report generator. Not directly exploitable. All it does is send me reports, and I wrote it and released it open source (as advertised on the web site), so you would expect me to be running it, right? I am sure you would expect Theo to be running OpenBSD too, right?
Qmail.... When was the last time there was an exploit in Qmail?
Look.... If you use Netcraft, you can see I am using Apache. Not saying so does not mean people can't find out. If you use Netcraft, you can even see I am running Linux.
Hmmm.... and if you check port 110, it is open and you can look up the welcome message to see I am in fact running Qmail. So I have saved you, what? 10 minutes online with Google and Netcraft by telling you this information? How hard is it to determine this information? How hard is it to obscure this information?
In essence, nothing I said is anything I could keep secret anyway from an attacker who would even do light recon.
Now.... Beyond the basics (here is where I won't tell you details but can tell you principles and design ideas):
1) If a program fails and is compromised, that should provide as little access to anything else as possible.
2) If I have to require passwords on one remotely accessible resource, these passwords should not be reusable on another group of such resources.
It is all about defence in depth and providing as many obstacles as possible to cause damage to me and my business, and containing the damage so that we can gracefully recover with a minimum of downtime. I won't share details. But I think we can all agree on the goals (these goals have been discussed in other whitepapers I have written, so again, this is public information).
Parent
Re:Physical access! (Score:5, Insightful)
This may be modded as funny, but is actually quite interesting. I know of a number (at least I know they used to) of sysadmins whose offsite backup was at home. This included some organizations with fairly substantial interests in limiting the access to their information. It should be company policy to properly pay for and establish a secure off site location for backups that are not in insecure locations like peoples homes. This should include any company that backs up information related to personnel information like SS#'s and such. For lots of companies or research institutions with just research info that is not sensitive, backups at home can be wholy appropriate.
Parent
BBC's "Micro Live" TV series (Score:5, Insightful)
Of course, that's not the only blunder. A cracker under the name "The Cheshire Catalyst" broke into a network service they were demonstrating, and started piping songs onto the computer screen in the TV studio.
These security breaches got the kind of publicity few crackers could ever hope to achieve today. A live television audience of maybe 7-8 million, and next to zero chance that the camera is going to pull away?
One important lesson I learned, over these incidents, is that security is rarely accidental. Nor is it something you can consider seperately from the rest of the design. Designing something to be consistant and uniform means that errors will stick out like a sore thumb. In terms of security, or reliability, elegence is everything.
Parent
Re:Physical security is the only important securit (Score:5, Funny)
Parent
Re:Physical access! (Score:5, Insightful)
Right-click on the network icon in the system tray then select "Disable". Seems easier to me than having to bring up a console, enter 25 characters, and hit return.
I'm no Microsoft fan but come on, ya gotta pick your battles a little better than this.
Parent
Re:Physical access! (Score:4, Insightful)
You right click on the connection's system tray icon and click disable.
OK, now perform that action in a shell script.
/smartass
Parent
Yeah, right (Score:5, Funny)
Exactly why I don't post AC (Score:4, Insightful)
There is no saftey in anonymity, only mediocrity. People are always looking to see who hides behind the mask even as they step over the unwashed masses.
Parent
Paranoid? Not much... (Score:5, Funny)
I have OpenBSD on my firewall and main work machine. Encrypted partitions too. GPG everything. My Windows 2000 game machine is locked tight and on a DMZ without IE being used. My monitor is wrapped in tinfoil, naturally, with a small cutout just large enough to have a 640x480 window viewable. I wrapped my mouse in tinfoil but that made it hard to use so I cut a hole in the bottom which allowed the light to hit the desk surface. Problem there was the desk was wrapped in tinfoil, too. So I made my own mousepad because I don't trust the ones made by The Man. It's made from a dead rabbit I found on the street. I flattened it out and dehydrated it. When I need a random number I pinch some fur and pull. however many strands of fur I get in that pull is the random number I use. Of course I need a new mousepad every few weeks as I never reuse the same tuft of fur twice. Never trust the PRNG in any OS, even OpenBSD. Theo is watching. Speaking of that, the other day I was installing OpenBSD 3.6 on a new machine and then I realized... CDs are a form of RFID tag. The unique bit patterns on them can be detected from space. So I wrap my CDs in tinfoil when not in use. Speaking of tinfoil, I find it best to buy the cheapest stuff from dollar stores. They don't usually use the UPC barcoding at those places. Just "$1.. $1.. $1..". Barcode readers don't use OpenBSD but I think Theo is trying to get in there. Speaking of barcodes, the other day I pulled a package of gum from my pocket and the person I was with said "Ohh... Spearmint!" I ran away. He obviously has a remote UPC scanner and knew that I had spearmint gum. He says the wrapper was in plain site but I think that's just an excuse.
Re:Paranoid? Not much... (Score:5, Funny)
Parent
Why should I be paranoid? (Score:5, Funny)
Hellooooo, Mr. Government Man!
My computer (Score:4, Funny)
This far (Score:5, Interesting)
Big Brother... (Score:5, Interesting)
Another idea is to make sure any sensitive infomation doesn't have any means of escape, hell build a machine with no network, and no floppy drive or cd writer. Take out the usb slots too, then maybe a passer by wont be able to access it.
30char password? Whats the point? I mean you can still brute force it, and even without doing this, theres still methods such as removing the hdd drive, mounting it under anther computer and 99% time, you got instant access to everything.
People need to learn, senstive data is only protected in ONE place, inside our minds.
Keep it there and no one can snoop it.
Re:Big Brother... (Score:4, Insightful)
Note that this does not mean make your data as humanly secure as possible. If it takes six months of brute force time to break my encryption, I don't mind. I don't have anything that is worth the trouble. So I'm not going to create hurdles for myself by securing it further.
If you have more valuable data, then make it as much harder to get to it. Going overboard will not gain you anything, other than a hassle.
Yes, big brother can storm my house, and torture the information out of me. But it's not worth their trouble. It perhaps would be worth it if I had no security measures and conducted all my Internet transactions in plain text. So I just use a few simple measures to make sure it's not that easy.
Parent
I am so worried.... (Score:5, Funny)
I run only knoppix Live CD, and I incinerate my RAM after I am done just to be sure there's nothing left on that RamDisk. Kingston loves me now!
Thanks for the info (Score:5, Funny)
password... (Score:5, Funny)
My dog's name is currently 4$ter*Zf1, but I change it every 90 days.
Parent
Security against 'Big Brother' is a myth (Score:5, Insightful)
S
Nerd guards (Score:5, Funny)
"Just How Paranoid Are You?" (Score:5, Funny)
How much truely private stuff do you have? (Score:5, Interesting)
If someone actually compromised and trashed my PC on the other hand, I'd lose time in rebuilding it. HoweverI do back up my information regularly, so that's no issue either except being annoyed at the loss of time. (If someone made subtle changes to the information I'd still have older backups, so it would be painful but not unrecoverable).
If you truely need a private information store, it may be worth buying a PC that isn't net connected and that is physically secured. For the average person unless you're doing something illegal or have sensitive work material at home (arguably not a good idea anyway), why would you need a super-unbreakable encrypted PC?
Careful with swap and temp files (Score:4, Informative)
Windows will leave temp files all over the place and your pagefile could have any data that was kept in RAM. The superparanoid run Linux w/ an encrypted root partition and Windows inside a VM from an encrypted disk image.
Erased my brain (Score:4, Funny)
Just try your evil identity theft tricks now!
I'm not paranoid enough.... (Score:5, Funny)
Turns out bad sex is better than no sex. I'll have to be more grateful for what I get with the next girlfriend.
Paranoia quotes (Score:5, Interesting)
I was walking home one night and a guy hammering on a roof called me a paranoid little weirdo. In morse code. -Emo Phillips
No matter how paranoid I get, it's never enough to keep up.
The question is not whether I'm paranoid, it's whether I'm paranoid enough.
The truly paraniod are rarely conned.
Doesn't matter if I'm paranoid - they're still after me.
I sincerely believe people talk about me. Mine would be a pretty meaningless existance if they didn't.
Why are some people terrified of "black helicopters" and don't even notice that they are being monitored almost constantly by the whole network of obvious surveilance cameras, credit cards, ATMs, EZpass, company ID/access cards, magazine subscriptions, SSNs, taxes, fees, video rentals, Internet firewall recording, 'cookies',
Paranoia: the belief that someone cares.
Paranoia is the belief in a hidden order behind the visible.
When everyone is out to get you, paranoia is only good thinking.
"Paranoia is knowing all the facts." - Woody Allen
"Paranoia is just another word for longevity." - Laurell K. Hamilton, The Laughing Corpse
"Perfect paranoia is perfect awareness."
"Paranoia is reality seen on a finer scale." - Philo Gant, Strange Days
"The issue is not whether you are paranoid, the issue is whether you are paranoid enough." - Max, Strange Days
"Why are you so paranoid, Mulder?"
"Oh, I don't know. Maybe it's because I find it hard to trust anybody." - Scully & Mulder, The X-Files, "Ascension"
Paranoia strikes deep / Into your life it will creep / It starts when you're / always afraid. You step out / of line, the man come and / take you away.
"I don't agonize over decisions as much these days. The criteria of what's important to me is clear. The insecurity that you feel, and the paranoia that you feel, have been around for a long time -- you know it's a liar because it's been lying to you all along -- every time you start something new. You get used to it, and you sort of go, 'Oh, you're showing up again, well f*** you.'" - John Cusack
Freedom is just a hallucination created by a pathological lack of paranoia.
Paranoia doesn't mean the whole world really isn't out to get you.
If you ever wanted to know what a person with acute paranoia looks like, just keep watching.
I have the power to channel my imagination into ever-soaring levels of suspicion and paranoia.
Paranoia is heightened awareness.
Paranoia is a social disease--you get it from screwing other people.
"Paranoia is the delusion that your enemies are organized." - Arthur D. Hlavaty.
"This is the Nineties, Bubba, and there is no such thing as Paranoia. It's all true." - Hunter S Thompson
"There are two kinds of paranoia: Total, and insufficient. I am both, because if you think you are sufficiently paranoid, you're not." - Guildenstern, Rosencrantz and Guildenstern are Dead
"The truly paranoid are clever enough to not *act* paranoid." - Q, Star Trek: The Next Generation
"When everyone _is_ out to get to you, being paranoid isn't going to help." - Q, Star Trek: The Next Generation
"When did you get so paranoid?"
"When they started plotting against me." - The Paper
"Paranoia is only the leading edge of the discovery that everything in the world is connected." - `The Illuminatus Trilogy'
When you've been through everything I have, paranoia is merely a precaution!
Paranoia is not the belief that everybody's out to get you -- they are. Paranoia is the belief that everybody's conspiring to get you.
The greater the concentration of power, the greater the paranoia it generates about its need to destroy everything outside itself.
I love this job. Nothing like paranoia and neurosis. Who needs a Coke habit? I've got journalism!!
There's something inherently American about paranoia. Given the i
Just how paranoid are you? Translation: (Score:4, Funny)
doctors? lawyers? (Score:5, Insightful)
What about doctors? Lawyers? Accountants? Schools? Bookstores? etc.
If you've been paying attention to the news you'll know that every so often somebody buys a used computer disk and finds the results of STD tests (including AIDS) for tens of thousands of people. Or the name, address and credit card information for thousands of customers.
The loss of this information may not cause the DJIA to drop 10%, but it can be devastating to the people involved. But security is often lax since it's "only" a PC and it never occurs to these people that their computers may be stolen precisely because of the confidential information on the disk.
Even home users can face a difficult situation if they take their work home. They have a duty to protect that information... then they work on those files on virus-ridden systems. Today's viruses seem to focus on spam and stealing credit card numbers, but it's not hard to imagine more sophisticated attackers looking for other information.
Your information can be too secure (Score:5, Interesting)
You have setup a system that will keep people away from the data unless you and only you try to access this. What happens if something happens to you. Your family might need your account numbers if you die, have a stroke, etc.
If you are protecting your child porn stash, then maybe this is the best solution. For things like credit card numbers, on-line banking, etc. you should "escrow" your passwords somewhere so that others can get to them if needed. This could be as simple as a printout of your passwords/accounts in your safe deposit box to having information kept by your lawyer.
Remember that bad things can happen beyond just hackers trying to get data.
And I am not just trolling for karma. My wife just had a friend die suddenly and one of the first questions from the family was "how do we get his laptops password". My anser was, "it depends, if he really secured it well, you are pretty much out of luck".
Knoppix STD (Score:5, Interesting)
We had a couple people leave work recently and they had some data in the computer that we needed to get ahold of. Since my company requires passwords and restrictive permissions on all Windows systems my team was worried that we might never get the docs off the systems.
A co-worker got out the Knoppix security tools distribution ( http://www.knoppix-std.org/ [knoppix-std.org] ) CD and was able to bypass the Windows passwords very easily. And it read the hard drive ignoring windows permissions.
If someone wanted a secure system. The Knoppix STD CD could be a good tool to use. Try and see if you or a trusted friend could get in to your PC.
- Bruzer (trying to be constructive)
Simple Practices (Score:4, Interesting)
1. Unless currently being used, the computer remains at an "off" state.
2. Change your passwords often - how often is up to you, but be reasonable. I suggest 30 to 60 days for medium/low security, and 7 days for higher security. Remember, however, that any password can be breeched - it's just a matter of time.
3. Segregate your network (if you have one) into zones. For Instance - You should not put your wireless access point straight off your network, instead, come off of your firewall in a new "wireless" zone. Terminate all wireless connection into your firewall via ipsec. Do not rely on WEP/WPA.
4. Block all outbound and inbound ports on your firewall, until you need them. I.E, don't just open up port 80 because you
5. Virus scanner.
6. Password protect
Anyway, these are just some basic concepts that are OS independent, and if your average user followed some of these guidelines, we'd all be in a better position.
30 characters, omg (Score:5, Funny)
Now, that;s not paranoid, just plain stupid. Just imagine, early in the morning, quickly checking mail before tumbling out the door going to work, and I mistype 1 character: bamm, type again, mistype 1 character again: bamm, type again,
Why would someone do such a thing to oneself, being sane to a very minimal extent ? Buy a darn iris scanner, or fingerprint authentication stuff, whatever floats your boat. But 30 chars to type just to get into your spyware-house ? Get a life.
Regarding the main question, i.e. being paranoid: one can efficiently and effectively protect even a Windows PC without becoming, well, posessed.
Removable media. (Score:4, Interesting)
The simple solution (for personal computers) is removeable media like a external USB harddrive. Connect it to your PC when you need to access sensitive information. Yes this dosent help if your system is all ready compromised, but if this has all ready happened chances are your fucked either way.
This also works well with portable computers, but using memory sticks. if your in a insecure area (cafe) and need to leave your laptop for a few moments, just take the stick with you.
It sounds like the author focused on securing his data only while hes not accessing it, like the encrypted data and silly long passord, but when hes all ready logged in, and the data is decrypted, your security is lossed. And the fact that most people leave their machines on (while logged in) this dosen't help in anyway.
His computer is only secured while he is logged out, and his computer is turned off, but still not physicaly secure.
Chances are if your in an enviorment that is not secure, this is your first mistake, and really if you have information that is this important, why the hell are you connecting that machine to the internet anyways.
Paranoid?? used to be. (Score:4, Interesting)
All my 'Sploits were on that machine and I never used it or hacked from in the town I lived in.
This was all back when I was a wee one, and is my distant past. but I learned from some of the best (a friend was a 414 member) and one thing that was instilled in me was to be insanely paranoid.
to the point that where I had the laptop stored I had ways of detecting if someone had been there.
if it looked like someone was there abandon it and never EVER return.
His father was Ex-CIA and he was one of the very few that were not nabbed when they took 414 down. no I never knew his real name and no I do not know where he is or have had any contact with him for over 20 years now.
basically his help in telling me to be insanely paranoid kept me out of the law's hands until I finally grew out of it and left the illigitmate stuff for the other newbs. (note social engineering is far more fun and will nab you LEGITIMATE access to things, and it's a key talent that will get you very far in the corperate and business world... the ultimate hack is getting the sysadmin to give you an account.)
things like installing back to back modems in offices you find access to their phone closet, (Man I had to have at least 8 of those around) tapping lines and installing outside line access and YES even making rubber handset couplers to couple a pair of payphones together for some 1200bps goodness that would make tracing you harder than hell. (put the modems in a box make the box cut power to both modems when it is opened so you know when someone discovers your redirect, that is a first warning that they are tracing you, telephone guys are clumsy and will start poking around back then, they never had any FBI agents that were well versed in telephone equipment until recently.. Using a telephone gear box to conceal your modems works best, and makiing it look like 10-11 phone lines enter that box also makes it more tempting to open it first.)
SO basically, acting pretty much like a spy would, expecting danger at every turn and NEVER giving others information, espically not friends that od the same thing, is as paranoid as I was.
it kept me from getting caught and out of Jail. although I never did anything illegal, nothing at all, I was a perfect student that did not even own a computer!
I also have no idea who reprogrammed the Altairs in the computer lab to flash their led's in a cylon eye sweep!
but oh man it looked so fricking cool!
OpenBSD server (Score:4, Interesting)
1. I run OpenBSD and know how to admin it. It runs ONLY SSH and Samba. It's behind a software router, runs pf.
2. Samba will only be accessible on the loopback interface.
3. Connections to the machine are made via SSH, you must have both a password and a PK authentication. The client has to port forward the appropriate ports for Samba to work.
4. Firewall scrubs packets (prevents some potential TCP/IP exploit tricks)and only allows connections to and from my internal network and my machine at work from the outside.
And that's it. I don't think this would work with more than one machine serving files via Samba, because of port forwarding. I haven't gotten the Samba attached to the local interface yet, right now samba is just limited to the single client I access files from via the firewall. I'd be curious if anyone has issues with the security of this setup. Basically, I want Samba, but with the stronger authentication and encryption of SSH.
Re:Esay easy easy (Score:4, Insightful)
How about unpublished exploits? All those take care of too?
Parent
Relocate serve to DMZ (Score:5, Funny)
Never thought of effecting security by relocating my home server to the no-man's-land in the middle of the Korean peninsula. I think you may be on to something. No one would ever think to check there!
Parent