building an untraceable SSH connection

mir · 2010-09-09T09:07:28+00:00

Hello guys, As many of you have heard, there were many arrests lately for bloggers in arab region. We are trying to help by either contributing articles,...

xterm

You do know that those that were arrested weren't traced right? They just used their real names everywhere.

Oh, and they have bad lawyers.

eurybaric

@BashLogic correct me if im wrong, but i think a connection could be practically untraceable if let's say it is bounced around and a certain hop is found in a country which does not provide information for the country which is trying to trace. the trace ends there then. right?

mir

xterm: not everyone using a blog/social media in politics and getting arrested sar an activist immediaatly and deserves protecting - ano cursing, saying illegal stuff and putting ur name on it - u can't whine afterward (not talking about the latest particular case only )

Bash : thanks for your input - i still haven't got to the point of setting up 2 interconnected sessions yet :P

eurybaric : are you in leb ? would you be interested in meeting up to discuss and work on this together ?

Padre

TOR :D
still ... there are nifty ways to track tor users.
a practically untraceable connection for the common users can be built. just how far are u willing to go ? :P

Joe

mir, could you give us examples of the arrests and tell us if they happened in Lebanon? And plus I agree with xterm saying that the "cyber" police won't spend energy tracing bloggers. If anyone wants to say something "sensitive", just don't write your name on it. Oh and use TOR, it should be enough.

rolf

You can't really have an untraceable connection. A connection has 2 IPs, and will be logged at the ISPs and may be logged on any router on the way. Normally IPs are registered, so from IP you can have the ISP, and then the ISP can look at it's logs to find the real name address, etc of whoever was using that IP.

But since it's for blogging, you can use a proxy server. All you need is a server (VPS or whatever) with a trusted company in a safe country (USA, Germany...). And then you can have a secure SSH with that server, and that server will then connect to whatever blog you want to update. The local ISP will have the IPs of you and that server, but that's all they will have, since SSH is encrypted, they cant see the contents, and since they don't have jurisdiction on the outside server - and normally the server provider should refuse requests for information unless they have a police mandate - which they can't normally get, they normally cant get any information about what happened there.

That's all theory, so I'd appreciate feedback. Personally I think this is an acceptable solution.

BashLogic

here is a scenario on how to hop thru over different protocols making tracing forensics a nightmare unless they know what they are looking for (warning, this will have a latency toll)
- establish three ssh bridging reverse tunnels: a->b (normal) b->c(tor enabled) c ->d (normal)
- all hosts a,b,c,d need to be publicly crowded hosts and some banana countries
- on host e run a perl script that interacts with ssh connecting to d, the perl script input/output would be directed to http
- on f run an app that interacts with the perl script, so by now, your connection
a->b (normal) b->c(tor enabled) c ->d (normal) d->e (perl connection) e->f (https connection, tor and proxy enabled)

so now, between a and f, you have different protocols, different connectivity and traversing thru so many points, that the forensics guys will be searching for a needle in the haystack. if you want to be really silly, then you would continue to use other protocols and ip package mangling in between. all this is at paranoid level but as I said, it does not require a lot to implement and that would put the forensics experience to the testing.

BashLogic

eurybaric wrote@BashLogic correct me if im wrong, but i think a connection could be practically untraceable if let's say it is bounced around and a certain hop is found in a country which does not provide information for the country which is trying to trace. the trace ends there then. right?

bouncing is a generic term, you can bounce thru 10 points and yet tunnel from a to z, hence revealing your source and destination. when bridging, you would be hoping where each two points would become an independent connection. the retrieving of of logs or monitoring is hindered by local administration and regulations.

there once was an article where an NSA expert claimed that he can brake into any system in less than 30min.
he did not reveal his means, but this i know, it takes only 1 open port to bore yourself thru.
in such cases, you need to be carefull with ip flagings not to leave traces.

mir

really thanks for all the feedback :)
akid, for sure, there is always the risk of not 100% security - the aim is to make the job of someone tracing you super hard , that is all

So far for me from this convo :

Step 1 would be to learn/use/ do the setup by using TOR

Step 2 : do the setup suggested by BashLogic (damn man, this is evil )

Step 3 : produce the documentation (docs/videos) and share them

As for the general topic of bloggers / censorship/ politics / arrests and such - i think we should have a total different post for this topic where we can discuss a preventive plan for censorship in lebanon and see how we can help protect bloggers (many ppl in arab countries are arrested very often, here we have less security relatively and hope we can be the hub for arab activists in some way )
But this is a talk for later on that we can probably discuss in a live meeting

again, thanks guys for the feedback and help

edit: it turned out i know someone who knows the guy who wrote TOR - so maybe the advanced users can set up some online meeting with him or if they have questions, they can be personally forward or well - it doesn't hurt to just get connected :)

Padre

Step 2 : do the setup suggested by BashLogic (damn man, this is evil )

Step 3 : produce the documentation (docs/videos) and share them

haha, well you have to make sure it's doable by non-tech savvy ppl ... and good luck.

What we used to do before, is random scan the net for vulnerable servers and install our own kits in there.
Then whenever i want to connect to destination A, i would select in between the list (usually quite big) and automatically randomize in between ports and protocols. We are still alive today, so i think it was a pretty good move :P

BashLogic

Padre wrote
Step 2 : do the setup suggested by BashLogic (damn man, this is evil )

Step 3 : produce the documentation (docs/videos) and share them
haha, well you have to make sure it's doable by non-tech savvy ppl ... and good luck.

What we used to do before, is random scan the net for vulnerable servers and install our own kits in there.
Then whenever i want to connect to destination A, i would select in between the list (usually quite big) and automatically randomize in between ports and protocols. We are still alive today, so i think it was a pretty good move :P

that is what is commonly done,
some real old hackers, should go back to the origins, phrackers, what they do is instead of just relying on the internet, they would hack old PBX in banana countries and use free dialup services arround the world.
that is one way of traversing thru different mediums and protocols, making the back tracing a living hell.

ten years ago or so, there was legal a limit to which forensics could investigate. it was max 3 hops from which they could demand logs etc. should it have gone beyond that, they 95% of the time had to give up.. dunno what it is like today..