Why Do Security Sites Penalize Tor Users?

If you are a regular user of Tor, you are already on an NSA watch list. That came out back in July. OTOH, being on an NSA watch list is not a very exclusive club: all you have to do to qualify is read Linux Journal. That came out in July as well.

Tor development, IIRC, was originally funded by the US Navy, and received additional funding from the State Department. It was useful for dissidents living under repressive governments. You can probably fact-check me at on About Tor, with no additional penalty, because NSA are likely to be targeting most likely readers of this blog.. Systems or network admin? Check. Encrypted mail user? Check. Ad nauseum.

Is startpage.com on the side of light?

Startpage.com bills themselves as  "the world's most private search engine", and are the default search engine of Tor. But if you use Tor, you will be periodically presented with a CAPTCHA. On the page, you will see the following text.

As part of StartPage's ongoing mission to provide the best experience for our users, we occasionally need to confirm that you are a legitimate user. Completing the CAPTCHA below helps us reduce abuse and improve the quality of our services.
Thank you,
The StartPage Team

But I have never seen this using Firefox, upon which Tor is based.

What about that symbol of rebellion and hackerdom, BlackHat?

I am not a fan, for reasons that seem good to me. But no security worker can ignore the storied history of this conference. For those with short memories, BlackHat 2009 was when Moxie Marlinspike, Dan Kaminski and Mike Zusman, in separate presentations managed to collectively beat SSL/TLS to death.

Yet Tor users will see something that is probably a bit familiar.

One more step
Please complete the security check to access www.blackhat.com

aaaaand... Another CAPTCHA.

The Worst Thing is Teh Stoopid.

CAPTCHA is far past any sort of relevance. Mechanical Turk CAPTCHA-solving was available years ago. Neither faster timeouts nor more obfuscated puzzles have fixed the problem. At this point, I can only characterize them as both increasingly annoying, and increasingly useless.

Google, whatever you may think of them from a privacy standpoint, recognizes this, and has introduced RECAPTCHA.Though this entire approach is fundamentally flawed, this is at least temporary and partial fix. Now, if only sites that choose to market themselves as either secure Internet tools, or security-focused, would just suck a bit less, I am sure we all appreciate it very much.

Just Buy Spam Nation

I am still getting traffic to http://fubarnorthwest.blogspot.com/2014/07/you-can-order-pre-order-krebs-spam.html. I'm not sure why that is. The book is out, to good reviews. For those that prefer audio/video discussion, see http://krebsonsecurity.com/2014/11/spam-nation-book-tour-highlights/ where there are numerous links to media that does not specialize in security matters.

Or just generally follow his blog, dammit. He's already back on ATM skimmers, which can be considered as a separate consumer safety area where he has carved out yet another niche as the go-to information source.

Here at casa de FUBAR, things are a bit busy at the moment, with things that will completely fail to interest most of the public, who just want to know how their confidential information became a $1 item in a foreign black-hat market, and what they can do to fix it.

A couple of those issues I will actually get to write about. That is not a common thing, so I am happy when it does manage to happen. But I have to repeat that this is stuff that, unless you operate in the security field, is technical, of little use to you, and will bore you to tears. In short, a waste of your time.

I'll be writing up my opinion of Spam Nation in the near future, but it will have my own twisted twist, in that it will not be a generic consumer review. Those are everywhere, so that shouldn't matter to you, if you are a consumer trying to understand this FUBAR new world. The book completely wins on that score. Really. Just buy it.

What I want to write is a post that discusses why security professionals should regard Spam Nation as important. The book succeeds on both consumer and professional levels. That is more difficult, and as I mentioned, things are a bit busy right now.

A Brief Foray Into the Horrible

I try to stay out of the consumer side of security, for several reasons. Leading that parade is that consumer security is so truly FUBAR that it is difficult to know where to begin.  One possible starting point was when a friend talked me into trying to help her friend, who was having continual problems with having a business PC hacked. It turned out that the source of this person's problems was running Kazaa peer-to-peer file sharing software (itself laden with adware) on a Windows machine, pirating every virus-ridden thing in sight, and not being interesting in Not Doing Silly Things.

At a certain point, you have to think in terms of triage.

1. some are in no immediate danger
2. some can be saved if you act immediately
3. some are doomed no matter what you do

This person was an obvious three.

I know of other people who simply buy a new PC when their current machine grinds to a halt as various bits of botnet malware fight for supremacy. In the meantime they are of course a menace to everyone else on the Internet. These people are also, collectively, threes.

Unfortunately, There is Some Bleed-Over

I once heard a guy (with PCI-DSS in his job title) mention to another person (also working the PCI-DSS the issue) who now had an Internet Explorer start screen inexplicably pointing to some outlandish search site. Apparently neither of these people were able to recognize that browser start page hijacking was a classic indication that your machine wasn't yours any more.

That was a casual conversation taking place by a couple of people walking past my cube. But it sort of jerked my head out of whatever I was doing, and I found the guy they were talking about connected to a client network, as he chatted with them about some problem they were having. Nor would he disconnect, despite my desperate hand-waving and other futile attempts to silently communicate that his machine was infested, and he should not be connected to a client LAN. Though it was likely that any damage was likely done, at that point.

The site Security Officer (I was a mere consultant) had an office a very few steps away, so bursting into a meeting was enough to get the problem handled. Except that it turned out that there was no local experience with credential-stealing, etc. I don't know how it all worked out in the end. I suspect that nobody wanted to know.

This is Very Bad News

Four people were involved in this. The two having the conversation, the guy with infected machine, and me. Only one had a clue, but all were systems administrators, or specifically had 'security' or 'compliance' in their titles.

It has always been hard to find security people. It's hard to even define the term, given the breadth of the field. Reasonable people can argue either side of the question of whether or not PCI-DSS has been a failure, and that is, after all, a very narrow corner of the field. However, a certain amount of consumer-level security awareness is clearly lacking, even amongst those with security in their job description. So, at some point, I have to go there.

So, Changes

I'm hoping (probably with no prospect of success) to cheat a bit by doing a bit of rearranging of fubarnorthwest. It was always a bit strange for me to link to physics blogs instead of security blogs. There was a reason for doing that, but I never wrote the explanatory post(s), and without those it seems, well, insane. As a blogger, I suck. But my goal is to suck less, so those are going away.

In their place, I'm adding the first consumer-oriented security blog. That would be Krebs on Security. Unlike me, Brian Krebs is a blogger who does not suck. I have mentioned him before in Java Security Revisited--Part 1 and You Can Order Pre-order Kreb's Spam Nation Now.

There will be other changes.

About that Credential-Stealing Thing

Pony, to take a common malware example, is a piece of malware that is still called a downloader--something used to fetch malicious payloads onto a compromised machine. It is also a product, albeit one produced by the Bad Guys. As such, features were added, and by 2012 it was also quite the accomplished credential-stealer for Windows. It has become far more powerful since, adding crypto-currency capabilities, and much else. Looking back into my notes, I would like to present a list of the Windows software that Pony could steal credentials from, as of 2012. There were likely to be others even then, there are certain to be more now, and of course this is only one piece of malware, amongst many.

32bit FTP
3D-FTP
AceFTP
ALFTP
BitKinex
BlazeFTP
Bromium (Yandex Chrome)
BulletProof FTP
ChromePlus
Chromium / SRWare Iron
ClassicFTP
CoffeeCup FTP / Sitemapper
CoffeeCup Visual Site Designer
Comodo Dragon
CoolNovo
CoreFTP
CuteFTP
Cyberduck
DeluxeFTP
Directory Opus
Dreamweaver
Easy FTP
Epic
ExpanDrive
FAR Manager
FastStone Browser
FFFTP
FileZilla
Firefox
FireFTP
FlashFXP
Fling
Flock
FreeFTP / DirectFTP
FreshFTP
Frigate3 FTP
FTP Commander
FTP Control
FTP Explorer
FTPGetter
FTPInfo
FTP Now
FTPRush
FTPShell
FTP Surfer
FTP Voyager
Global Downloader
GoFTP
Google Chrome
Internet Explorer
K-Meleon
LeapFTP
LeechFTP
LinasFTP
Mozilla
NetDrive
NETFile
NexusFile
Nichrome
Notepad + +
Odin Secure FTP Expert
Opera
Putty
Robo-FTP
RockMelt
SeaMonkey
SecureFX
SmartFTP
SoftX
Staff-FTP
System Info
Total Commander
TurboFTP
UltraFXP
WebDrive
WebSitePublisher
WinFTP
WinSCP
WiseFTP
WS_FTP
Xftp

Managing high-surety systems from lower-surety systems is an idea assembled from 100% FAIL. But if you must do this, being able to spot at least the most blindingly obvious indicators of compromise is a skill you need to have.

You Can Order Pre-order Kreb's Spam Nation Now

It won't be out until November. For me, that is just in time for what is probably a good read during the start of one of Oregon's famously dreary winters. The krebsonsecurity blog post has more information, and the Amazon pre-order page has an editorial review with an excerpt from Chapter 1. Back in February, Bruce Schneier wrote a Krebs post, with a link to a NY Times profile. So it isn't just me.

Brian Krebs is perhaps uniquely qualified to write such a book, as he has long been intimately involved with the field, has a history of painstaking research, and has undoubted talents as a writer.

I also have an immediate selfish interest in hoping that this book is book is as good (and successful) as I hope it to be. Several of his posts are go-to answers to important questions. The Scrap Value of a Hacked PC, Revisited is good example. I don't have to write a careful response to questions of this nature, because Krebs has been there and done that--far better than I could. I can just send a link.

Here's the thing. Pre-orders are important in establishing the size of a print run. Writing any sort of book is an immense amount of work, which can be essentially wasted in terms of ROI if the books aren't available. Ebooks may mitigate this to some extent, but from what I've read, sales of physical books still matters a lot. 

So, ROI. If his track record is any guide, the Investment has been very large. I'd like his Return to be large as well. You can think of this as a non-immediate selfish goal if, you like. Brian Krebs is a very effective Good Guy, and keeping him in the fight is a useful thing to do.