The European Court of Human Rights yesterday banned a general weakening of secure end-to-end encryption. The judgement argues that encryption helps citizens and companies to protect themselves against hacking, theft of identity and personal data, fraud and the unauthorised disclosure of confidential information. Backdoors could also be exploited by criminal networks and would seriously jeopardise the security of all users' electronic communications. There are other solutions for monitoring encrypted communications without generally weakening the protection of all users, the Court held.[1] The judgement cites using vulnerabilities in the targets software or sending an implant to targeted devices as examples.

Member of the European Parliament and digital freedom fighter Patrick Breyer (Pirate Party) comments:

"With this outstanding landmark judgement, the 'client-side scanning' surveillance on all smartphones proposed by the EU Commission in its chat control bill is clearly illegal. It would destroy the protection of everyone instead of investigating suspects. EU governments will now have no choice but to remove the destruction of secure encryption from their position on this proposal - as well as the indiscriminate surveillance of private communications of the entire population!

Secure encryption saves lives. Without encryption, we can never be sure whether our messages or photos are being disclosed to people we don't know and can't trust. So-called 'client-side scanning' would either make our communications fundamentally insecure, or European citizens would no longer be able to use Whatsapp or Signal at all, because the providers have already contemplated that they would discontinue their services in Europe. It is a scandal that the EU Council's latest draft position still envisages the destruction of secure encryption. We Pirates will now fight even harder for our digital privacy of correspondence!"

Background: The EU Commission and an industrial network of surveillance authorities are calling for generally searching private communications using error-prone technology, including on end-to-end encrypted messengers, for indications of illegal content. This could only be implemented by undermining secure end-to-end encryption. The majority of EU governments support the initiative, but a blocking minority is preventing a decision. The EU interior ministers want to discuss the bill again at the beginning of March. Under massive pressure from Pirates and civil society, the EU Parliament has rejected the destruction of secure encryption and indiscriminate chat control. However, this is only the starting position for possible negotiations with the EU Council, once it agrees on a position. Meta has announced that it will start encrypting direct messages via Facebook and Instagram in the course of this year and discontinue its current voluntary chat control surveillance on these messages. Nevertheless, the EU is in the process of extending the authorisation for voluntary chat control.

Breyer's information page on chat control:chatcontrol.eu

[1]https://hudoc.echr.coe.int/eng/?i=001-230854 (para. 76 ff.)

Share this article:

The rest is here:
European Court of Human Rights bans weakening of secure end-to-endencryption - the end of EUs chat control CSAR ... - EU Reporter

Secure Shell (SSH) has several really cool tricks up its sleeve, each of which offers a handy feature (wrapped in a comforting blanket of security) to help make your life a bit easier.

Last week, we discussed key authentication with SSH; this week we will talk about port forwarding, which can be used to:

There are three different types of SSH port forwarding. They are local (connections from a client are forwarded, via SSH, to a remote host), remote (connections from a remote server are forwarded, via SSH, to another machine), and dynamic (connections from different applications are forwarded, via SSH, to several servers).

There are many examples of port forwarding, some of which can get rather complicated. Because of this, were only going to deal with the first two types of port forwarding here (local and remote). These are also the types of SSH port forwarding that youll use the most.

SSH port forwarding is built into SSH by default, so as long as you have SSH installed, you should have everything you need to work with this feature.

With that said, let me show you how SSH port forwarding works.

Your Linux distribution probably already has SSH installed. However, for port forwarding, youll want the SSH server added as well. For that, you can log into your Linux machine and install it on an Ubuntu-based distribution like so:

sudo apt-get install openssh-server -y

sudo apt-get install openssh-server -y

On a RHEL-based distribution, that command would be:

sudo dnf install openssh-server -y

sudo dnf install openssh-server -y

Once the server is installed, start and enable it on an Ubuntu-based distribution with the command:

sudo systemctl enable --now ssh

sudo systemctl enable --now ssh

On a RHEL-based distribution, the start/enable command is:

sudo systemctl enable --now sshd

sudo systemctl enable --now sshd

The first type of port forwarding well deal with is local. Lets say youre developing a new site and you want to be able to access it via an encrypted connection. This new site may be on your local network or on a remote server. Either way, you can connect to it using the remote SSH server from a local port to a remote port.

Lets say you want to use local port 8080 and forward a connection IP address 192.168.1.11 port 80, via SSH. To do that, the command would be:

ssh -L 8080:192.168.1.11:80 localhost

ssh -L 8080:192.168.1.11:80 localhost

You will be prompted for your local SSH user password and then will be returned to the command prompt. To verify the tunnel worked, open a web browser and point it to:

The remote site (at 192.168.1.11) should appear in the web browser and is being tunneled via SSH encryption.

You can keep using the encrypted tunnel as long as you remain logged in from the terminal window. To close the encrypted tunnel, go back to the terminal window and type:

You will probably find this type of port forwarding to be more useful because it can allow you to give others access to a remote machine, via an encrypted tunnel. Say, for instance, you have someone on your LAN who needs VNC access to a server with a GUI and you want to ensure that connection is encrypted for security purposes. This, of course, would require you have VNC set up properly on the server and a VNC viewer on a client machine.

For this example, well stick with the 192.168.1.11 IP address for the remote machine and the client machine is at 192.168.1.21. You must have SSH access to the client machine as well.

Before you do this, however, you must take care of a simple SSH configuration. Open the SSH server configuration file with the command:

sudo nano /etc/ssh/sshd_config

sudo nano /etc/ssh/sshd_config

Add the following line to the bottom of the file:

Save and close the file. Restart SSH with either:

sudo systemctl restart ssh

sudo systemctl restart ssh

or

sudo systemctl restart sshd

sudo systemctl restart sshd

Now, lets create the remote tunnel. To create the tunnel for VNC (which runs on port 5900), run the following command on the remote server (which, for our example, is at 192.168.1.11):

ssh -R 5900:localhost:5900 USERNAME@192.168.1.21

ssh -R 5900:localhost:5900 USERNAME@192.168.1.21

Where USERNAME is a username on the client machine to which you have access. Once you authenticate that user, the SSH remote tunnel is up and running. The other user could then connect to the server, using a VNC client, with localhost and port 5900.

Remember, even when the remote user disconnects their VNC connection, the tunnel is still up and running. To close the tunnel, go back to the remote servers terminal and type exit.

If youre looking to create encrypted tunnels for various use cases, look no further than SSH. Once you get the hang of creating these tunnels, youll find they can be very useful in several different types of scenarios.

YOUTUBE.COM/THENEWSTACK

Tech moves fast, don't miss an episode. Subscribe to our YouTubechannel to stream all our podcasts, interviews, demos, and more.

SUBSCRIBE

See the original post:
Linux: Create Encrypted Tunnels with SSH Port Forwarding - The New Stack

Confidentiality: Encryption Technologies

This principle is dedicated to ensuring that information is accessible only to those authorized to view it. Confidentiality mechanisms include data encryption, robust authentication processes, and access control measures that safeguard against unauthorized access and disclosures.

Example:

Picture a lockbox where townsfolk store their valuables. Only those with the right key (authorized users) can peek inside. This lockbox is linked to encryption technologies and access controls that keep prying eyes away from sensitive information.

The invisible guardians of our digital universe, shielding our most sacred data from prying eyes and nefarious minds. In the vast cosmos of computing and cybersecurity, encryption is the spellbinding force that turns readable data into a cryptic puzzle only solvable by those who hold the magical key. So buckle up, my fellow digital explorers, as we embark on an electrifying journey through the deep-ends of encryption technologies, both celebrated and obscure, that weave

View original post here:
Cybersecurity Encryption Technologies: Confidentiality | by Coded Conversations | Coded Tech Talk | Jan, 2024 - Medium

Security researchers have recently uncovered a new variant of the notorious Phobos ransomware family named FAUST.

Phobos, which first emerged in 2019, encrypts files on victimscomputers and demands a ransom in cryptocurrency for the decryption key.

According to an advisory published by FortiGuard Labs last Thursday, the FAUST variant was found in an Office document utilizing a VBA script to propagate the ransomware.

As part of the campaign, the attackers employed the Gitea service to store malicious files encoded in Base64. When injected into a systems memory, these files initiate a file encryption attack.

The FortiGuard Labs analysis revealed a multi-stage attack flow, from VBA script execution to the deployment of the FAUST payload.

Macros remain a dangerous part of malware delivery because VBA provides functionality that many companies use for day-to-day applications,explained John Bambenek, president at BambenekConsulting.

The safest way to deal with this threat is to disable VBA in Office entirely. However, if thats not an option, organizations can at least disable high-riskfunctionality in VBAs using Windows Defense Attack Surface Reduction, such as preventing office applications from creating child processes or from creating executable content.

From a technical standpoint, FAUST ransomware exhibits persistence mechanisms, adding a registry entry and copying itself to specific startup folders.

It checks for a Mutex object to ensure only one process is running, and it contains an exclusion list to avoid double-encrypting specific files or encrypting its ransom information. The encrypted files carry the .faustextension, and victims are instructed to contact the attackers via email or TOX message for ransom negotiations.

Read more on Phobos variants: 8Base Ransomware Group Emerges as Major Threat

The research underscores the threat of fileless attacks and the need for user caution when opening document files from untrusted sources.

While user awareness and caution are crucial aspects of cybersecurity, a layered approach to defense is necessary. Individuals should be cautious with attachments and links. Only opening attachments or clicking on links from trusted sources and be wary of unexpected emails,warned Sarah Jones, cyber threat intelligence research analyst at Critical Start.

Additionally, regularly updating your operating system, applications, and firmware to patch vulnerabilities attackers can exploit is critical. Furthermore, individuals need to ensure their passwords are strong and unique and enable two-factor authentication whenever possible to add an extra layer of security.

View original post here:
Phobos Ransomware Family Expands With New FAUST Variant - Infosecurity Magazine

Information is wealth, and an important way to protect it is encryption. End-to-end (E2E) encryption in particular protects information in a way that has transformed human rights organisations, law-enforcement agencies, and technology companies outlook on their ability to access and use information about individuals to protect, prosecute or profit from them, as the case may be.

Fundamentally, encryption is the act of changing some consumable information into an unconsumable form based on some rules. There are different kinds of such rules.

For example, (with particular settings) the Data Encryption Standard (DES) encrypts the words ice cream to AdNgzrrtxcpeUzzAdN7dwA== with the key kite. If the key is, say, motorcycle, the encrypted text becomes 8nR+8aZxL89fAwru/+VyXw==.

The key is some data using which a computer can unlock (decrypt) some locked (encrypted) text, knowing the set of rules used to lock it.

Say I write down AdNgzrrtxcpeUzzAdN7dwA== on one piece of paper and kite on another piece of paper, crumple them both, and throw them at my friend across the room. Suddenly a man I didnt notice in the middle of the room leaps up to snatch the piece of paper saying AdNgzrrtxcpeUzzAdN7dwA== and runs away with it. Because this fellow doesnt know the key (kite), he wont know what the piece of paper says.

This is how encryption protects information, digitally.

E2E is encryption that refers to particular locations between which information moves.

Say you are chatting with your friend on a messaging app. When you send a message, it first goes to a server maintained by the company that built the app; based on its instructions, the server routes the message to your friend.

In this setup, two important forms of encryption are encryption-in-transit and E2E encryption.

Encryption-in-transit means before a message is relayed from the server to you (or vice versa), it is encrypted. This scheme is used to prevent an actor from being able to read the contents of the message by intercepting the relay. In E2E encryption, the message is encrypted both in transit and at rest i.e. when being relayed from your phone to the server (or vice versa) and when it is sitting inside the server. It is only decrypted when your friend receives the message.

There are several ways to encrypt information depending on the level of secrecy and protection required. If some information is to remain encrypted for 100 years, a computer must require more than 100 years to decrypt it without the key.

One broad distinction is between symmetric and asymmetric encryption.

In symmetric encryption, the key used to encrypt some information is also the key required to decrypt it. DES is a famous example of a symmetric encryption protocol.

In a stronger version of DES, called Triple DES, the key a user provides is split into three parts. Lets say they are mot, orcy, and cle. Then, the message ice cream is encrypted by the first part (mot); the result is decrypted by the second part (orcy); and its result is again encrypted by the third part (cle). The garbled text thus produced is then transmitted to the recipient along with the key.

Symmetric encryption is useful when the sender and the recipient are the same person, for example when you encrypt the hard drive of your computer. The Advanced Encryption Standard (AES), which you might have noticed when setting your WiFi password, is also a symmetric encryption algorithm.

In asymmetric encryption, if the message ice cream is encrypted using the key motorcycle, it can be decrypted using a different key that corresponds to motorcycle in a predetermined way.

For example, say you and your friend agree that if you use the key motorcycle to encrypt the message, your friend will use the key helmet to decrypt it, and if you use banana to encrypt, your friend will use pineapple to decrypt. You and your friend go to a party and find yourself standing far from each other, and you wish to send them a message. So you encrypt ice cream with banana as the key, and you shout out the encrypted text to your friend along with the word banana. Your friend now knows that they should decrypt the text using the key pineapple to reveal the underlying message.

In this situation, using asymmetric encryption, you have been able to reveal the encryption key without compromising your or your friends privacy.

The key you shouted out is called the public key; the corresponding key you agreed your friend would use is called the private key.

(Have a computer? Open the shell terminal called Command Prompt on Windows and Terminal on OSX and Linux type ssh-keygen, hit enter, and follow the next steps. You will soon have your own public and private keys.)

Asymmetric encryption will work as long as the private key and the correspondence between the public key and the private key are kept secret. In advanced implementations of asymmetric encryption, this correspondence is stored in the solution of a mathematical problem that even a computer would require a long time to solve.

It is useful when the sender and the recipient are different. The level of protection it confers is greater the longer the key is.

There are different symmetric and asymmetric schemes that encrypt messages in different ways, i.e. using different hash functions.

The hash function is responsible for encrypting a message. These functions are expected to have many properties. Here are three for example:

(i) The function should accept an input message and produce an encrypted version called the digest in a way that, given the digest, doesnt reveal what the message could be.

(ii) It should accept a message of any length and produce a digest of a fixed length, irrespective of how long or short the message is. This way, the length of the original message cant be deduced from the length of the digest.

(iii) It should produce unique digests for unique messages.

For example, the hash function the DES algorithm uses has many steps, at the heart of which is a table called an S-box: it converts a six-bit value into a four-bit value. (The combination of the first and last digits is provided in a particular row and the middle four digits are provided in a particular column, and the cell where these two meet specifies a unique four-digit bit.)

DES is a type of symmetric cipher called a block cipher, meaning it operates on fixed-length blocks of information at a time, in this case 64 bits, with 56-bit keys. (The bits refer to the message converted to binary.)

A hash function called the Feistel function begins by splitting a block into two parts. In each part, it selects 16 bits and appends them to the end, extending the 32-bit block to 48 bits. This is fed to a XOR logic gate as one input, the other being a 48-bit subkey thats derived from the key. The XOR gates output is then split into eight parts, each of which is remixed in a different S-box. The outputs of the eight S-boxes are finally arranged in a specified pattern.

The function repeats this process until the whole message has been encrypted.

DES was developed at IBM in the 1970s, and since then researchers have found ways to crack it. Nonetheless, its working provided an early illustration of the processes that could be used to obfuscate a message such that they would be easy to implement on computing hardware but hard enough to not be broken easily.

The messaging app WhatsApp uses the Curve25519 algorithm to create public keys for messages. Curve25519 uses the principles of elliptic-curve cryptography (ECC), which in turn is based on some concepts in algebraic geometry. ECCs advantage is that it can provide the same level of security as another asymmetric encryption algorithm but with a shorter key.

Messaging apps with E2E encryption promise that even their parent companies wont be able to read messages sent and received by its users. However, the informational content of the messages can still be accessed in other ways.

A common example is the man-in-the-middle (MITM) attack. This is related to the example earlier of an unnoticed man in the middle of the room jumping up to intercept your message to your friend. In that instance, the man didnt have the key and couldnt decrypt the message. In an MITM attack, this man is the attacker and he has been able to acquire the key to decrypt the message, either by hacking your device to obtain the encryption key as well as the correspondence between the encryption and decryption keys or by hacking your friends device to acquire the decryption keys.

MITM attacks can be prevented by using and comparing fingerprints. Each fingerprint is some data that uniquely identifies a key. Users can compare the fingerprints of their public keys in a separate channel (i.e. different from the one susceptible to an MITM attack) to make sure an attacker doesnt intercept a message, modify it, re-encrypt it with a different key and send it to the intended recipient.

Another issue with E2E encryption is that it could induce complacency in a user who believes an attacker cant access, say, an image theyre sending over a messaging app in any other way. Since the image may be stored on the senders device, an attacker can hack the device to obtain it.

Some potent malware can also snoop on your messages by infiltrating your device via other means an SMS, say and reading them before they are encrypted.

Finally, the company that installs E2E encryption on its products can install a backdoor or an exception that allows the company to surmount the encryption and access the messages. Such a thing may be required by law, such as companies being expected to retain and, in the event of litigation, share that information with lawyers.

Illegal use also abounds, of course, such as that exposed in the Edward Snowden affair in 2013. The whistleblower revealed, for example, that Skype had installed a backdoor on its application that allowed it to access and make copies of the contents of messages to share with the U.S. National Security Agency even though the messages were E2E-encrypted.

If the goal is to surveil a user, an actor can do so if they can access the messages metadata, i.e. data about the messages, such as when they were sent, to which user, how often at different times, from which location, etc., instead of the messages themselves.

More:
What is end-to-end encryption? How does it secure information? | Explained - The Hindu