Name: The Art of Invisibility
ISBN: 9780316554541

Kevin D. Mitnick

Robert Vamosi

The World's Most Famous Hacker Teaches You How to Be Safe in the Age of Big Brother and Big Data

The Art of Invisibility

Kevin Mitnick

Kevin Mitnick, the world's most famous hacker, teaches you easy cloaking and counter-measures for citizens and consumers in the age of Big Brother and Big Data. Like it or not, your every move is being watched and analyzed. Consumer's identities are being stolen, and a person's every step is being tracked and stored. What once might have been dismissed as paranoia is now a hard truth, and privacy is a luxury few can afford or understand. In this explosive yet practical book, Kevin Mitnick illustrates what is happening without your knowledge--and he teaches you "the art of invisibility." Mitnick is the world's most famous--and formerly the Most Wanted--computer hacker. He has hacked into some of the country's most powerful and seemingly impenetrable agencies and companies, and at one point he was on a three-year run from the FBI. Now, though, Mitnick is reformed and is widely regarded as the expert on the subject of computer security. He knows exactly how vulnerabilities can be exploited and just what to do to prevent that from happening. In THE ART OF INVISIBILITY Mitnick provides both online and real life tactics and inexpensive methods to protect you and your family, in easy step-by-step instructions. He even talks about more advanced "elite" techniques, which, if used properly, can maximize your privacy. Invisibility isn't just for superheroes--privacy is a power you deserve and need in this modern age.

Timeo Williams

"One of the tools openly discussed on the forum, Elcomsoft Phone Password Breaker, or EPPB, is intended to enable law enforcement and government agencies to access iCloud accounts and is sold publicly. It is just one of many tools out there, but it appears to be the most popular on the forum. EPPB requires that users have the target’s iCloud username and password information first."

"You can always check the site www.haveibeenpwned.com to see if your account has been compromised in the past."

"First, strong passphrases, not passwords, should be long—at least twenty to twenty-five characters. Random characters—ek5iogh#skf&skd—work best. Unfortunately the human mind has trouble remembering random sequences. So use a password manager. Using a password manager is far better than choosing your own. I prefer open-source password managers like Password Safe and KeePass that only store data locally on your computer. "

"In general, the more characters in your password, the longer it will take password-guessing programs such as John the Ripper to run through all the possible variations. As computer processors get faster, the length of time it takes to calculate all the possible six-character and even eight-character passwords is becoming a lot shorter, too. That’s why I recommend using passwords of twenty-five characters or more. "

" Or all the e-mails sitting in your inbox. Or worse, unless you have a password-protected screen saver that kicks in after a few seconds of inactivity, whenever you’re away from your desk for an extended period—out to lunch or at a long meeting—someone could sit down and write an e-mail and send it as you. Or even alter the next quarter’s budget. 
There are creative new methods to preventing this, like screen-locking software that uses Bluetooth to verify if you are near your computer. In other words, if you go to the bathroom and your mobile phone goes out of Bluetooth range of the computer, the screen is immediately locked. There are also versions that use a Bluetooth device like a wristband or smartwatch and 
will do the same thing. "

"There are three common ways to lock your phone—whether it’s an Android or iOS or something else. The most familiar is a passcode—a sequence of numbers that you enter in a specific order to unlock your phone. Don’t settle for the number of digits the phone recommends. Go into your settings and manually configure the passcode to be stronger—seven digits if you want (like an old phone number from your childhood.) Certainly use more than just four. "

"SMS codes are not encrypted and can be obtained in the way I just described, an even more secure 2FA method is to download the Google Authenticator app from Google Play or the iTunes app store for use with an iPhone."

". I like iPads, but they’re expensive. The Chromebook is as close to an easy-to- use tablet as an iPad is, and it costs much less. 
My point is that you need to have a secondary device that you use exclusively for financial stuff—perhaps even medical stuff as well. No apps can be installed unless you first register with a Gmail account—this will limit you to opening the browser to surf the Internet. 
Then, if you haven’t already done so, activate 2FA on the site so that it recognizes the Chromebook. Once you’ve completed your banking or health- care business, put the Chromebook away until the next time you have to balance your checkbook or arrange a doctor’s appointment. 
This seems like a hassle. It is. It replaces the convenience of anytime banking with almost anytime banking. But the result is that you are far less likely to have someone messing around with your banking and credit information. If you use the Chromebook only for the two or three apps you install, and if you bookmark the banking or health-care websites and visit no others, it is very unlikely that you will have a Trojan or some other form of malware residing on your machine."

"For example: Bob wants to send Alice a secure e-mail. He finds Alice’s public key on the Internet or obtains it directly from Alice, and when sending a message to her encrypts the message with her key. This message will stay encrypted until Alice—and only Alice—uses a passphrase to unlock her private key and unlock the encrypted message. 
So how would encrypting the contents of your e-mail work? The most popular method of e-mail encryption is PGP, which stands for “Pretty Good Privacy.” It is not free. It is a product of the Symantec Corporation. But its creator, Phil Zimmermann, also authored an open-source version, OpenPGP, which is free. And a third option, GPG (GNU Privacy Guard), created by Werner Koch, is also free."

" Not the telecommunications carrier, website owner, or app developer—the parties that law enforcement or government will ask to turn over information about you. How do you know whether the encryption service you are using is end-to-end encryption? Do a Google search for “end-to-end encryption voice call.” If the app or service doesn’t use end-to-end encryption, then choose another. 
If all this sounds complicated, that’s because it is. But there are PGP plug- ins for the Chrome and Firefox Internet browsers that make encryption easier. One is Mailvelope, which neatly handles the public and private encryption keys of PGP. Simply type in a passphrase, which will be used to generate the public and private keys."

"After the FISA Court grants a request, law enforcement can compel private corporations to turn over all their data on you—that is, if they haven’t already done so. 
To become truly invisible in the digital world you will need to do more than encrypt your messages. You will need to: 
Remove your true IP address: This is your point of connection to the Internet, your fingerprint. It can show where you are (down to your physical address) and what provider you use. Obscure your hardware and software: When you connect to a website online, a snapshot of the hardware and software you’re using may be collected by the site. There are tricks that can be used to find out if you have particular software installed, such as Adobe Flash. The browser software tells a website what operating system you’re using, what 
version of that operating system you have, and sometimes what other software you have running on your desktop at the time. Defend your anonymity: Attribution online is hard. Proving that you were at the keyboard when an event occurred is difficult. However, if you walk in front of a camera before going online at Starbucks, or if you just bought a latte at Starbucks with your credit card, these actions can be linked to your online presence a few moments later. "

"Instead of hosting your own proxy, you can use a service known as an anonymous remailer, which will mask your e-mail’s IP address for you. An anonymous remailer simply changes the e-mail address of the sender before sending the message to its intended recipient. The recipient can respond via the remailer. That’s the simplest version."

"One way to mask your IP address is to use the onion router (Tor), which is what Snowden and Poitras did. 
Developed by the US Naval Research Laboratory in 2004 as a way for military personnel to conduct searches without exposing their physical locations, the Tor open-source program has since been expanded. Tor is designed to be used by people living in harsh regimes as a way to avoid censorship of popular media and services and to prevent anyone from tracking what search terms they use. Tor remains free and can be used by anyone, anywhere—even you."

"Tor is very slow 
That being said, if you still decide to use Tor you should not run it in the same physical device that you use for browsing. In other words, have a laptop for browsing the Web and a separate device for Tor (for instance, a Raspberry Pi minicomputer running Tor software). The idea here is that if somebody is able to compromise your laptop they still won’t be able to peel off your Tor transport layer as it is running on a separate physical box."

"Speaking at the Chaos Communication Congress, an annual computer hacker conference held in Berlin, Germany, Tobias Engel, founder of Sternraute, and Karsten Nohl, chief scientist for Security Research Labs, explained that they could not only locate cell-phone callers anywhere in the world, they could also listen in on their phone conversations. And if they couldn’t listen in real time, they could record the encrypted calls and texts for later decryption. 
In security, you are only as secure as the weakest link. What Engel and Nohl found was that while developed countries in North America and Europe have invested billions in creating relatively secure and private 3G and 4G networks, they must still use signaling system 7 (SS7) as an underlying protocol. "

"The 1994 CALEA requires telecommunications manufacturers and carriers to modify their equipment for the purposes of allowing law enforcement to wiretap the line. So under CALEA, any landline call in the United States is theoretically subject to interception"

"Let’s say Bob wants to make a call to Alice, who is in China. Bob’s SDES- encrypted VoIP phone generates a new key for that call. Somehow Bob has to get that new key to Alice so her VoIP equipment can decrypt his phone call and they can have a conversation. The solution SDES offers is to send the key to Bob’s carrier, which then passes it to Alice’s carrier, which then shares it with her.Do you see the flaw? Remember what I said about end-to-end encryption in the previous chapter? The conversation stays secure until the recipient opens it at the other end. But SDES shares the key from Bob to Bob’s carrier and, if Alice’s carrier is different, the call is encrypted from Alice’s carrier to Alice. Whether the gap is significant is debatable. Something like this also happens with Skype and Google Voice. New keys are generated whenever a call is initialized, but those keys are then given over to Microsoft and Google. So much for wanting to have a private conversation. 
Fortunately, there are ways to encrypt mobile VoIP from end to end. Signal, an application from Open Whisper Systems, is a free, open-source VoIP system for mobile phones that provides true end-to-end encryption for both iPhone and Android. "

"Instead use a third-party app. But which one? 
To mask our online identities—to enjoy the Internet anonymously—we will need to trust some software and software services. That trust is hard to verify. In general, open-source and nonprofit organizations provide perhaps the most secure software and services because there are literally thousands of eyes poring over the code and flagging anything that looks suspicious or vulnerable. When you use proprietary software, you more or less have to take the vendor’s word."

"Private browsing doesn’t create temporary files, and therefore it keeps your browsing history off your laptop or mobile device. Could a third party still see your interaction with a given website? Yes, unless that interaction is first encrypted. To accomplish this, the Electronic Frontier Foundation has created a browser plug-in called HTTPS Everywhere.4 This is a plug-in for the Firefox and Chrome browsers on your traditional PC and for the Firefox browser on your Android device. There’s no iOS version at the time of this writing. But HTTPS Everywhere can confer a distinct advantage: consider that in the first few seconds of connection, the browser and the site negotiate what kind of security to use. You want perfect forward secrecy, which I talked about in the previous chapter. Not all sites use PFS. And not all negotiations end with PFS— even if it is offered. HTTPS Everywhere can force https usage whenever possible, even if PFS is not in use. "

"Unsure whether you answered that browser question in the past? Then try the test page at http://benwerd.com/lab/geo.php. This is one of many test sites that will tell you whether your browser is reporting your location. If it is and you want to be invisible, then disable the feature. Fortunately, you can turn off browser location tracking. In Firefox, type “about: config” in the URL address bar. Scroll down to “geo” and change the setting to “disable.” Save your changes. In Chrome, go to Options>Under the Hood>Content Settings>Location. There’s a “Do not allow any site to track my physical location” option that will disable geolocation in Chrome. Other browsers have similar configuration options. 
You might also want to fake your location—if only just for fun. If you want to send out false coordinates—say, the White House—in Firefox, you can install a browser plug-in called Geolocator. In Google Chrome, check the plug-in’s built-in setting called “emulate geolocation coordinates.” While in Chrome, press Ctrl+Shift+I on Windows or Cmd+Option+I on Mac to open the Chrome Developer Tools. The Console window will open, and you can click the three vertical dots at the top right of the Console, then select more "

The Art of Invisibility The World's Most Famous Hacker Teaches You How to Be Safe in the Age of Big Brother and Big Data