The internet is growing darker day-by-day


In the deepest corners of the dark web, anything goes. These are sites that cannot be found using typical search browsers like Google and Yahoo and are usually not accessed via a standard operating system like Microsoft or Apple. Instead, individuals access these sites using The Onion Router (TOR) browser and a hidden operating system (e.g. Tails) booted from a USB or CD.

TOR isn’t secret, in fact TOR is widely used by a diverse range of groups including criminals, non-criminals, NGOS, journalists, security researchers and government authorities alike who need to browse anonymously for a number of reasons. It is the security in numbers that can protect a TOR user’s anonymity and freedom from censorship.

For those interested in using TOR though – beware. TOR is not banned, which means that authorities, like the NSA, may be gaining good intelligence on TOR users. For user’s who are not security savvy, the government may even know what they are visiting.

TOR is a free utility that anyone can download and configure. The TOR website offers clear instructions on how to do this. Once set-up, the user connects to a series of encrypted TOR servers (which are also physically located in a secure location) before they connect to the destination site. As the connection is encrypted at each node, it is not possible to detect where the original request came from through traffic packet analysis alone. However, it is possible for Internet Security Provider’s (ISP’s) to distinguish TOR traffic from regular traffic– they just won’t know what you are accessing. Even if authorities took over a hidden dark web server or set-up a dark web honeypot to lure users, it will be difficult for them to identify the users (but not impossible*).

Despite the risks of being caught – the use of TOR in accessing the dark web is increasing. On the dark web, users can purchase personal credentials, illegal drugs and weapons. They can also hire hitmen, order DDos or other attacks and plan criminal/terrorist activities. The dark web is also full of some of the most terrifying web content shared by disturbed minds. Silk Road may have been closed down but it can easily be replaced. It is a continual struggle of power between criminals and authorities.  


UK close to banning the use of WhatsApp, iMessage and SnapChat to protect National Security.


Applications that provide an encrypted messaging platform, like WhatsApp, are under threat by countries that are increasingly reliant on snooping as part of their National Security strategy. The UK is proposing a new law as part of their “Snoopers Charter”, also known as Draft Communication Bill, to enforce a ban on applications like WhatsApp, iMessage and SnapChat that use encrypted messages. Under this new proposed bill, Internet Service Providers must monitor the online activity of customers and keep logs of their activities for 12 months.

This isn’t a surprise though, as the use of mass surveillance to protect national security and counter terrorism is widely used and increasing around the world. The five most controversial ones include:

China – 1998 the Great Firewall of China

ChinaFirewall This is a censorship and surveillance program designed by the Chinese government to filter and control the content that is accessed by the public. This program also prohibits individuals from using the internet to harm national security, spread false rumors or encourage socially undesirable behavior like gambling, violence or murder. This is an extremely controversial program that China has been widely criticized for by human rights and civil liberties groups.
USA – 2001 Patriot Act
USA This was introduced following the September 11 and anthrax attacks. This was an extremely controversial bill which many felt was an over-extension of the US government’s surveillance powers. Some of the most controversial parts allowed government agencies to:
  • Confiscate the property of foreigners who are believed to have aided in a war or an attack on the USA.
  • Authorize the roving surveillance of any individuals under investigation (using any means available to intercept a person’s communications. An extension of wire-tapping)
  • Authorize the use of National Security Letters to demand a release of information about individuals without them knowing.
  • Detain terrorism suspects without providing them with access to lawyers and without hearings or formal charges

This law was controversial as it reversed many of the civil liberties that were guaranteed under the US Constitution e.g. right to privacy and freedom from unreasonable searches and seizures.

Originally introduced by the Bush administration, subsequent US administrations have tried to remove it but the US has grown too reliant on this as an Anti-Terrorism measure. The original bill which expired in 2011, has been renewed two times since (including in 2015) and will be up for renewal again in 2019.

France – 2015 Patriot Act
france Following the Charlie Hebdo attacks, France passed their own version of the Patriot Act in June this year. Despite opposition from civil liberties groups, the bill was passed by the Senate on June 9 2015 with overwhelming support. This gives French government agencies the authorization to conduct mass surveillance over all communications without judicial approval and deploy new infrastructure to sniff all electronic communications. The new law also requires Internet Service providers to be able to crawl through internet traffic to identify terrorist activities.
Australia – 2015 Data Retention laws
fiveeyes Australia has been wire-tapping phones for years and this has increased year-on-year. The government has also requested ISP’s and search engines (like Google) to provide private information on web browsing histories and private user information. And transparency reports have shown that this activity is increasing. As of August 2014, government agencies can obtain this information without a warrant or user disclosure. Recently, the government has passed a data retention bill that mandates ISP’s to store data on user activities for two years. Australia is also part of the Five Eyes alliance.
Russia – SORM (System of Operative Measures)
russia Russia is a surveillance state and their powers are extensive. This has even led to US issuing this travel warning ahead of tourists travelling to Sochi for the 2013 Winter Olympics.











Is cloud ever secure enough?




1. How good is my local storage?


2. How much am I willing to invest?

3. How important is availability?

4. How important is confidentiality and trust?


How hackable are you really?


As long as we are online, we are vulnerable to malware, viruses etc. that can steal sensitive information, hijack web sessions/webcams or spy on our keystrokes. This is especially true in cases where individuals are specifically targeted by those who have the persistence, time and skills to profile and craft an attack.

There are some things you can do now to minimize your risk and reduce the impact, should you get hacked. This is by no means a comprehensive list but a good start. Please share any additional tips in the comment section below. This information is applicable for home personal use.

1. Backup personal/sensitive files frequently. Encrypt, store & backup personal/sensitive information in a detachable hardware device (e.g. USB/hard disk). Any sensitive information should at least be encrypted and stored separately from a network-attached device. VeraCrypt and CipherShed are two free open-source encryption software solutions that are readily available for download. Just make sure you store your private keys in a safe location.

2. Optimize your firewall. You can use a free utility like Shields UP to allow you to check if you have any open ports that can be exploited. The utility also provides detailed explanation for the results you see and some advice about how to proceed. While enabling a firewall is certainly better than having none, default firewall configurations are often not restrictive enough (e.g. allowing connections to never-used applications installed during setup). Although you can configure your firewall to disable most outbound traffic, this requires some knowledge of firewall rules to set-up without stuffing up your internet connection. This is why it is important to…

3. Invest in a good Anti-Virus solution and keep your OS patched. Don’t skimp on anti-virus. The paid ones are often better at keeping up-to-date with the newest virus signatures. It is also important to ensure that you keep up-to-date with OS updates too. With Microsoft, you can also turn on automatic updates so you get the latest patches. If your OS is too old to be patched (e.g. Windows XP) – time to upgrade!

4. Switch to using Chrome. Chrome is considered the safest browser while Microsoft Internet Explorer has been plagued by malware and security defects. Another great thing about Chrome is that you can download an extension to use HTTPS everywhere to encrypt non-encrypted http traffic for added security

5. Go Green. Before submitting login/password details or inputting any sensitive information online (e.g. credit card information), make sure you are connecting via an encrypted https session. Furthermore, you can also check the organization that owns the certificate. In Chrome, you can do this by clicking the green lock on the address bar and viewing the Security Certificate.

More tips:

Breaking https:// with POODLE. How does it work?


This is an introduction to some basic concepts around how POODLE (Padding Oracle on downgraded legacy encryption) works. There are plenty of other blogs/videos that go into greater detail about how it works but the basics can help to provide a framework to navigate through the detail. 

Basically POODLE discovered that it was possible to decrypt some parts of encrypted SSL sessions via a man-in-the-middle. A victim can be vulnerable when using public wifi or if they have some nasty malware on their computers. 

1. Basics of Cipher Block Chaining 

During the SSL handshake, symmetric keys are exchanged to encrypt sessions. Sessions encrypted via the Cipher block chaining method are susceptible to what is known as a padding oracle attack. CBC is a method of symmetric block cipher cryptography. In CBC, a message is broken into 3 blocks of equal size blocks (eg 8 bit blocks). Each plaintext block is encrypted sequentially until you end up with 3 blocks of ciphertext. Before each block is encrypted, it is XOR’ed with the previous ciphertext block (the first block is XOR’ed with a block of random bytes known as IV) . To decrypt, this operation is reversed e.g.  Encrypted block is XOR’ed with the previous ciphertext block and then decrypted. This operation results in a very random block of ciphertext being produced every time. It is almost impossible to break however….

2. Padding in CBC

Most messages are not perfect block sizes of x bytes. Actually, messages may be of varying length. As block ciphers require the blocks to be of exact x bytes, extra padding (a string of random bytes) is added to fill up any unused bytes. The length of the padding is also stored as the last byte of the encrypted block. 

3. How padding checks can weaken security

Once the message is decrypted, servers undergo two checks. The first is to validate the padding length. If the padding length doesn’t match the actual padding, this will result in an error. The second check is a MAC on the encrypted block. This check verifies that the encrypted block hasn’t been altered during the transition.

This poses a problem. As the padding is checked before the MAC checks, a man-in-the-middle can intercept the message and try to guess what the padding length is. In only 255 guesses, he/she will be able to decrypt the last byte. 

4. Chosen ciphertext attack

If you recall, encrypted blocks are XOR’ed with the previous ciphertext block before it is decrypted. Therefore, you can substitute the last byte of the previous ciphertext block as many times as needed until the padding length is valid. Once that happens, you know you successfully guessed the padding length and cracked the last byte. You can also continue to decrypt more bytes using similar methods. 

5. What next? 

To stop padding oracle attacks, the server can provide more validation around the padding and also ensure that error messages don’t specify whether a failed session is caused by bad padding or a bad MAC.  Unfortunately, SSLv3 implementations don’t do this, which is why users should disable SSLv3. Whilst TLS does, on certain TLS implementations (e.g. TLSv1.0- TLSv1.1), a padding oracle may still be possible if there is significant time difference between sessions failing due to bad padding vs bad MAC. This can occur in certain server setups (e.g. when load balancing is used)

Want more information?

3 PR disasters caused by innocent mistakes



1. Bank of America




3. Emory Healthcare


