CPPA: CypherPunk, Privacidad y Anonimato

#Overview

This started simply out of curiosity and ISIS security guides were distributed publicly and easy to find. The original sources are not linked, because they contain product keys, serial numbers and direct links to pirated software that could itself be malware. Most documents included some type of prayer and affirmation of the ISIS movement which is redacted because it's not the point of this document and simply not of interest. It can be said though that these are taught only to further their goals, many of which are violent in nature.

The security manual states there are roughly 50,000 active social accounts that are supporters of ISIS, but only 1% of actual users utilize security. It appears higher level individuals have access to resources, and as of late in the wake of the realizations of scope of surveillance an effort has been made to reach a broader audience by such groups with beginner tutorials. The leaks which have shocked the Western World, have inspired improvements in targeted entities. For instance, The Guardian newspaper is sourced as stating Twitter and GPS in mobile apps are being used in surveillance and Edward Snowden is mentioned as releasing PRISM information defining the scope of U.S. intelligence. Surprisingly, it is stated that the electronic war is no less important than Nuclear war. It is stated that it is the responsibility of every member to be aware of security and to teach the message to their kin. The primary operational concerns with information disclosure appears to be locations of offensive strikes, safe houses and banking.

This opens the debate on the nature of privacy based on this because the security capabilities that are available to all and protect many in completely legal circumstances also protect the non-savory type operations. For those that are purists about computer-security it's not a question of restriction, because encryption and code is open to all. However, we've seen a push towards censorship, restriction of encrypted communications and backdoored or reverse engineering capabilities employed. Some may regard these types of groups as savages but this is a look at the scope of their knowledge of information security for individuals, and in retrospect if these are the steps required by them to avoid surveillance, how vulnerable is the average person. One thing is sure, most of the code and services are based on open-source technology and there's virtually no way to stop them.

While more traditional means like PGP encryption for email correspondences have been around for a very long time, email primarily remains unencrypted and even in these tutorials PGP is glossed over likely for being too complex. Instead hand to hand exchange of encryption passwords and simple cyphers appear to be preferred. Easy to use applications and techniques are preferred which even with proper methods, any packaged software can contain exploits or backdoors, especially mobile. The fact that product keys and direct downloads are encouraged in the documents, opens them up to tracking and it's possible that even their security czar has mal-intent and is purposely pushing software for monitoring purposes.

#ISIS Security Manual Overview:

##Desktop

###Email security

ISIS directives state it's time to say goodbye to Google, Yahoo and hotmail, and say hello to encrypted email services.

Here are the recommended services for enhanced email protection

Protonmail
encrypted storage
preferred site

Tutanota
encrypted storage
encryption by exchange of passphrase

Hushmail

Although considered secure by ISIS but known to be monitored by government. In 2007 an American's information was disclosed: http://www.wired.com/2007/11/encrypted-e-mai/

###Encrypting USB Data

It has been found that ISIS passes USB drives around in order to communicate data internally. http://news.nationalgeographic.com/news/2014/06/140626-isis-insurgents-syria-iraq-looting-antiquities-archaeology/

Many of these are un-encrypted and easily read for now.

Vera Encryption
With Vera encryption you can encrypt a folder or external USB drive using a simple passphrase, the longer the better.

Since tradtitional deltion of files only removes pointers the ISIS manual recommends using http://eraser.heidi.ie/download.php to fully zero out erased files.

###Linux Encryption

Veracrypt is once again recommended for encrypting sensitive information on Linux systems

A step by step guide is included for Linux users for installation.

Open Terminal
$ Mkdir veracrypt
$ Cd veracrypt
$ Wget "sourceforge.net/projects/veracrypt/files/VeraCrypt 1.0e / veracrypt-1.0e-setup.tar.bz2"
$ Tar -xjvf "VeraCrypt 1.0e / veracrypt-1.0e-setup.tar.bz2"
$ Rm veracrypt-1.0e-setup.tar.bz2
$ ./veracrypt-1.0e-setup-console-x86

After the completion of writing orders Press 1 to install the software
Agree to installation certificate
Press Enter to accept policy

64bit

Open Terminal
$ Mkdir veracrypt
$ Cd veracrypt
$ Wget "sourceforge.net/projects/veracrypt/files/VeraCrypt 1.0e / veracrypt-1.0e-setup.tar.bz2"
$ Tar -xjvf "veracrypt-1.0e-setup.tar.bz2"
$ Rm veracrypt-1.0e-setup.tar.bz2
$ ./veracrypt-1.0e-setup-console-x64

After the completion of writing orders Press 1 to install the software
Agree to installation certificate
Press Enter to accept policy

###TOR

Tor is touted as a safe way to browse the internet that hides your identity and location.

Tor Browser bundle is listed as the easiest way to access the network which packages Tor with Firefox

###Anti-keylogger

In order to avoid keylogging technologies, operatives are recommended to use zemana anti-logger: https://www.zemana.com/Download.aspx for Windows.

###TAILS Live Linux

Tails is recommended as a single use operating system, that incorporates Tor and doesn't store user data.

Apps of interest:

Tor Browser
Simple interface to Tor via browser

I2P
Alternative to Tor which offers different privacy benefits

PGP Privacy Guard
Methodology for encrypting emails

PWGEN
Generate secure passwords

Florence
Virtual keyboard which allows users to enter sensitive information like banking information without the threat of keyloggers.

MAT
Protects data by editing the descriptive information like date and usernames keeping information anonymous.

###Anti-Virus

The Arabic version of Kaspersky security is recommended to protect against local threats.

###Cloud Storage

MEGA
The MEGA service is touted as the most secure and safest way of transmitting and storing data.

###Anti-Google

Google knows who you are based on your search history, location and social information like google plus, it is not to be trusted. Google utilizes wifi-location services to more accurately pinpoint loation.

A backup of your Google history can be obtained:
https://accounts.google.com/ServiceLogin?passive=1209600&osid=1&continue=
https://www.google.com/settings/general-light?ref%3D/settings/takeout&followup=
https://www.google.com/settings/general-light?ref%3D/settings/takeout

##Phones

###Android Basics

Android is obviously the preferred device as multiple times Apple is stated as linked to CIA, probably a mis-attribution, and has less privacy capabilities and modding capabilities.

Google play store applications are often full of backdoors and issues that leak user data. It is recommended to use alternative sources to download applications. Quick release of applications and poor oversight has been known to be exploited by agencies such as the National Security Agency in aims of spying on users.

Yandex Store
http://m.store.yandex.com/
Yandex store is touted as a more secure alternative backed by Kasperky, a Russian Security Firm.

Tutanota
Alternative email application to Gmail allowing encryption of data

pixlegrade
This applications strips EXIF data from photos removing information like location and device information that may be encoded.

adblock plus
Convenience app, removes advertising and other nuisances from browsing which may contain tracking.

Softworks EDS Lite
Encryption is recommended for securing folders and select data.

###Android Roms

First users are instructed to use RASHR

Then download Open-Recorvery TWRP to flash the Android device and utilize Clockwork Mod

Clockword Mod is recommended to install Cyanegonmod

Cyanogenmod is recommended for installation, as original roms are considered to have backdoors or other issues.

###Anonymous Numbers

These are applications to create temporary numbers or send free texts to avoid monitoring.

Both applications work for iOS and Android

Text Plus

Hey Wire

###Android Advanced Anonymity

ORBOT
Requires Root

Comes with Tor, Chat Secure and Duck Duck Go secure search

Tor Bridges should be enabled, recommending IP 107.170.8.52:36437

Fake GPS
Spoof location to confuse surveilance
Enable start on boot and simulate moving

D-VASIVE PRO
Block snooping of Webcam
A cracked version is supplied [link redacted]

By enabling a sound alert for camera, and disabling launch of application, users can avoid being remotely monitored.

###Android APP Permissions and Wiping of Data

Stated Issues with permissions and Android

• Android system can remotely send text messages without the user's knowledge
• App Market lacking oversight and security to prevent backdoored programs.
• Easy to repackage code and pass as legitimate
• Security updates can be delayed depending on the device.

The goal is to limit programs access to specific uses that are outside the scope for instance Skype should be limited to microphone and camera access.

Clean Master
Utilizing Clean Master user can audit each program for granted priviledges and add or remove, for instance Facebook should have location, camera and microphone disabled.

Similar applications in some cases various programs have more effectiveness.

APK Permission Remover

permission manager app ops

###Android Additional Security Apps

ai.type
anti-keylogger keyboard

iShredder3
permanently delete files

DUCKDUCKGO
Anonymous Search

DroidWall
Firewall for Android

F-SECURE FREEDOME
VPN Private Internet Access

###iOS Basics

It is claimed the Apple is directly involved with CIA monitoring efforts. Google and Apple are comparitively the same according to the report, once again the CIA is emphasized as the culprit. Use of Apple devices has been banned in some cases.

Setup
Make sure the device is always updated, and enable automatic updates.
Disallow access to microphone by application.
Do not synchronize any files to any Cloud
Enable Encryption on the device
Complex password for encryption and screenlock
Set DuckDuckGo as the default search engine
Disable automatic login to networks
Disable Geographic location data

Recommended browser: opera mini

##iOS Security Applications

Tor is not supported by iOS

Instead a VPN is recommended

F-SECURE FREEDOME
AVAST Secure Line

Kaspersky Safe Browser
More secure browser than Opera Mini

Tutanota iOS Email
Encrypted Email Aleternative

Do not use iCloud

MEGA
Preferred Cloud Storage

Signal
Anonymous Text Messaging

REDPHONE
Encrypted Text and Voice

##Social Media

###Twitter without phone number

The Basic Technique is Twitter only requests Phone Numbers for suspicious connections, so by trying all possible connections you will eventually be able to sign-up.

iOS
First Kaspersky Safebrowser
If prompted for password try a free VPN
Avast secureline
F-Secure Freedome
express vpn

Android
First Krypton Browser
Attempt to use Orbot for Android Tor
If still prompted try a free VPN
F-Secure Freedome
Avast secureline
Phisphon

Computer
Use the Tor Browser and keep requesting a new identity until you can register.

##NSA Awareness

One can argue their increased security concerns were furthered by the releases about the details of Government operations, which operatives have become aware of, however these increased monitoring capabilities may affect all users whether perceived as threat or not. A general briefing is included in the report. This is last as it's all known information and is merely to show possible motiviations for increased emphasis on security.

Edward Snowden Agency provided information about US National Security and escaped in 2013.

Everywhere you go, every purchase you make, all communications, each article you write, and every site you visit is in the hands of of the unlimited abilities of the NSA.

William Penny, a legend in the field of encryption worked for the US National Security Agency for 37 years, then left the agency in 2001. He was assigned to develop programs to analyze massive amounts of data in a short time, but when he learned that the agency will use this in espionage he left the agency and threatened to divulge the project codenamed "Stellar Wind" which reached capacity of to collect and analyze data at 125/GB per second.

It is stated that after September 2001 attack, the US National Security Agency, began spying on telecommunications companies and collected data and records of all users, including voice calls and text messages with 320 million daily records captured. The companies that allowed this to happen are considered betrayers of their customers.

Advanced analysis allows intelligence to link various pieces of data like spending records, and phone communications to create a picture of the person's activities and understand their movements.

Other Governments have aligned with this operation, and bases have been established in a broad array of locations in order to monitor all communications possible.

###Info on Source:
If anyone is interested...

Telegram: ANTIHACKER5

Abu Saif

RHCE & MCITP & CCNA & C|EH

(not verified information)

V1. Extended Instructions Need to be Added