Please enable JavaScript.

Coggle requires JavaScript to display documents.

Cybercrime Investigation (S2: Similarity-preserving hash functions (SPEC),…

- - - - Many hash functions, probability higher for collision with neighbors
    - - Set of weak binary classifiers, to generate hash functions. Classifiers selected which fit the following criteria: close objects are more likely to have same class label.
    - - Used to learn the hashing function
      - Preserve semantic similarity in Hamming space(semantic hashing)
      - Retraining is costly
    - - Outperform RBM and PSH
      - But assumption: Objects are spread in euclidean space with uniform/gaussian distribution
  - - - A similarity matrix S is made out of X
        
        𝑆 is quadratic and symmetric regarding the main diagonal
        
        𝑆𝑖𝑗 ≥ 0
        
        𝑆𝑖𝑗 = 0 means the entities 𝑖 and 𝑗 are dissimilar
    - - Diagonal matrix made
      - Normalized matrix obtained
    - - We define another distribution 𝑊 𝑇 using the Hamming distance 𝐻𝑇
      - By making the distribution 𝑊 𝑇 close to the target distribution, objects with large similarity will have relatively small Hamming distance between the corresponding hash codes
      - Make target distribution (S) and hamming distance distrubution( W) close by minimizing the Kullback-Leibler divergence (KL-distance)
      - Incremental learning
        
        The expression to be minimized can be factorized into a recursive equation and then it is possible to devise a suboptimal algorithm that learns the hash function one bit at a time
        
        This learning algorithm requires computing and constantly updating 𝐻 𝑖, 𝑗 for every 𝑖, 𝑗 as 𝑡 increases
        
        Quadratic time complexity: O(n^2)
        
        Fast linear approximations
        
        SPEC-Spread algorithm
        
        SPEC-Entropy algorithm
  - - - Which metric suits blacklisting/whitelisting/malware detection
- - - - criminal activity
      - searching for (personal) health information
      - informants giving anonymous tips to the police
      - journalists protecting their sources
      - police investigations
    - - Scenario: Client wants to request information anonymously
      - Solution: Use an anonymizing proxy
        
        Examples: HideMyAss, ExpressVPN...
      - Challenges
        
        Complete trust in entity
        
        Single point of failure
        
        Traffic correlation is easy
        
        Better solution: Use multiple levels and/or trust entities
        
        Tor: The Onion Service
        
        How does it work?
        
        Uses an anonymizing network
        
        Independent nodes
        
        Encrypted tunnels: using (perfect) forward secrecy changing appearance of data
        
        Any user of the network, can be the originator
        
        It distributes trust
        
        Practical information
        
        Exchanges an encryption key with the first node. Result: encrypted tunnel created
        
        Extend tunnel, with pre-existing tunnel. Next node does not know if tunnel originate from previous node, or any other node in the network. Result: New and longer tunnel, built from previous tunnel. Imagine a onion.
        
        Scenario: Request data from network service
        
        5 more items...
        
        Select three random nodes
        
        The circuit built changes roughly around 10 minutes
        
        Atlus lists all the servers in the network
        
        Location Hidden Services
        
        Design goals
        
        be accessible from anywhere
        
        resist Distributed DenialofService (DDoS) attacks
        
        resist attacks from authorized users
        
        resist against physical attacks
        
        enable censorshipresistant publishing
        
        Protocol
        
        The hidden service assembles a hidden service descriptor, containing its public key and a summary of each introduction point, and signs this descriptor with its private key. It uploads that descriptor to a distributed hash table. The descriptor will be found by clients requesting XYZ.onion where XYZ is a 16 character name derived from the service's public key. After this step, the hidden service is set up.
        
        Advertise service's existence to introduction points(IPs): Circuits to several introduction points(IPs) are made. The IPs receive the hidden service's public key.
        
        A client that wants to contact a hidden service needs to learn about its onion address first. After that, the client can initiate connection establishment by downloading the descriptor from the distributed hash table. If there is a descriptor for XYZ.onion (the hidden service could also be offline or have left long ago, or there could be a typo in the onion address), the client now knows the set of introduction points and the right public key to use. Around this time, the client also creates a circuit to another randomly picked relay and asks it to act as rendezvous point by telling it a one-time secret.
        
        When the descriptor is present and the rendezvous point is ready, the client assembles an introduce message (encrypted to the hidden service's public key) including the address of the rendezvous point and the one-time secret. The client sends this message to one of the introduction points, requesting it be delivered to the hidden service. Again, communication takes place via a Tor circuit: nobody can relate sending the introduce message to the client's IP address, so the client remains anonymous.
        
        The hidden service decrypts the client's introduce message and finds the address of the rendezvous point and the one-time secret in it. The service creates a circuit to the rendezvous point and sends the one-time secret to it in a rendezvous message.
        
        In the last step, the rendezvous point notifies the client about successful connection establishment. After that, both client and hidden service can use their circuits to the rendezvous point for communicating with each other. The rendezvous point simply relays (end-to-end encrypted) messages from client to service and vice versa. Note that there are 6 relays between the client and service. (3 from the client circuit, 3 from the server circuit)
        
        Attacks and Vulnerabilities
        
        Location
        
        1 more item...
        
        Availability
        
        1 more item...
        
        Trust in Directory Server
        
        2 more items...
        
        Timing Analysis (Øverlier) - Avoid Traffic Flow Confidentiality
        
        6 more items...
        
        Options
        
        Can specify whether your tor client, should act as exit point for other relays.
        
        Specify which country exit node reside in
        
        Jondonym
- - - - Requires international cooperation. Some countries do not communicate well
      - Realtime coordination even worse? Planned action vs attack reaction
    - - Examine computer without physical access
      - Easy to add anonymizing nodes / proxies
        
        Easy to create multiple levels in different jurisdictions
    - - Anonymous access to online storage
      - Encrypted online storage
      - Anonymous access to encrypted online storage
  - - - Being caught might lead to personal or company problems
      - It is easy to hide: fake user names, generic email adresses
      - Not easy to hide: location, language, activity on the system
  - - - Introduction point analysis
  - - - Tor Browser
        
        Firefox ESR(Extended Support Release)
        
        TorButton: disable active content
        
        NoScript: script/java/flash/plugin access controller
        
        HTTPS-Everywhere: enforce https when available
        
        TorLauncher: tor process manager and control
        
        Runs as the local user(!)
        
        Vulnerabilities exploited may grant access to computer, with user privileges
        
        May reveal actual IP, if Firefox ESR security is breached
      - Tails
        
        Live OS
        
        Everything can reside in memory
        
        Can have encrypted partition on USB disk
        
        Network communication forced through Tor
        
        RAM by default overwritten when rebooting/shutdown
        
        Nothing written to disk, unless requested
        
        (Might need adjustment of UEFI/Secure Boot options to boot)
    - - VMWare
      - virtualbox
      - Xen
      - kvm
    - - Stem: Stem is a Python controller library for Tor. With it you can use Tor's control protocol to script against the Tor process.
        
        Can use torsocks, SocksiPy, pycurl,... but need to
        control Tor as well
        
        Example scripts:
        
        Access to (own) storage over Tor, from a target computer(!?!?!?!?!)
        
        Access to hidden services from own or target computer(??!?!?!?!?)
        
        TCP port testing over Tor
        
        stem.control: Can grant control to tor process, to list circuits, streams(actual packet transfers) and tor version.. and much more. Uncomment control port to let it connect to the local port.
    - - Collecting data securely
        
        e.g SilkRoad investigation
        
        short lived services