Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question is for the security Gurus.

Where i come from, we have a free online space, however some neighboring countries and friends and bloggers are getting arrested frequently for blogging .

I am trying to help some activists and friends in different ways to either bypass censorship and to protect their identities online

I am doing research on how to make an untracable ssh connection - we are thinking an ssh tunnel/proxy

I would appreciate any advice, tutorial, links you can share.

I am also writing some more general articles for bloggers - you suggestions and ideas are welcomed here was my first entry couple of days ago http://migh.info/2010/09/outsmarting-censorship-1/

I really appreciate the help

edit: the plan so far is to have the following set up :

  • establish three ssh bridging reverse tunnels: a->b (normal) b->c(tor enabled) c ->d (normal)
  • all hosts a,b,c,d need to be publicly crowded hosts and some banana countries
  • on host e run a perl script that interacts with ssh connecting to d, the perl script input/output would be directed to http
  • on f run an app that interacts with the perl script, so by now, your connection a->b (normal) b->c(tor enabled) c ->d (normal) d->e (perl connection) e->f (https connection, tor and proxy enabled)

so now, between a and f, there is different protocols, different connectivity and traversing thru so many points, that the forensics guys will be searching for a needle in the haystack. to be really silly, we could continue to use other protocols and ip package mangling in between. that would put the forensics experience to the testing.

share|improve this question
    
Sounds like China... –  Bart Silverstrim Sep 9 '10 at 11:35
    
or North Korea or Iran. I'm guessing Iran from the name. –  gWaldo Sep 9 '10 at 11:53
    
There is also the issue of whether you should be meddling in another countries' politics at all whether you agree with them or not. In most free countries we elect and entrust people to make decisions based on the full facts and consequences rather than uninformed individuals going off on one based on some moral crusade. –  JamesRyan Sep 9 '10 at 12:26
3  
@James: Warning Hypocrisy detected!! You're telling someone in another country what to do?! Is that not meddling with meddling with another counties politics? –  Chris S Sep 9 '10 at 14:05
1  
I am from Lebanon - we have 0 censorship - like really zero - but friends/bloggers in arab countries get arrested and beaten for stuff as simple as posting an image of the king house or making a comment.- i don't consider it as mingling in other countries business, more like trying to help non-techies get protected either via simple easy tips or by setting up more advanced stuff for them to use –  mireille raad Sep 9 '10 at 15:43

4 Answers 4

A thing to throw out there as well is keep in mind how secure something needs to be.

My teacher once explained with a example:

Imagine your transporting critical data, and that data can't fall into the right hands.

then you need to keep in mind, how long will this data need to be secure ?

first of all, there's no such thing as indefinite, it doesn't exist. Sooner or later someone will find out a loophole or alike and the data will be compromised.

So as such, keep in mind how long it needs to stay a secret for. If your data is only valuable for a week then there is no point in the fact that it takes the opposition 2 weeks to access the data, your mission'll be achieved and afterwards it won't / shouldn't matter.

On the flipside of the coin, if your data needs to stay sensitive and safe for 5 years, then you need to make sure it won't be compromised in 1 month time.

Why do I say this ? Not to give you bright ideas, not to aid you, or stop you in your endeavour, but to give warning that you for one shouldn't over do it, but also, don't underestimate it.

If your data needs to be vital for a few months then make sure its safe enough to stand the test of time ....

share|improve this answer
    
If it can't fall into the right hands, whose hands does it? :-) –  Bart Silverstrim Sep 9 '10 at 14:41
    
yhea I messed up with that one I see now :) –  Entity_Razer May 8 '11 at 9:16

The only solution that seems to obfuscate connections that I've heard of is TOR. Even then I remember reading grumblings that there were ways to trace certain kinds of data.

All connections, given enough persistence, can be traced. They have to be if you expect to make a connection that expects return of data.

If you don't own the medium transmitting the data, you have no idea who is tapping what data in between you and the destination. The "land of the free" in the good ol' USA has projects that tap data for certain agencies. Books have been published discussing it.

Anyway, TOR basically bounces your data among all the different TOR nodes, obfuscating where the packets are originating from and heading to then bounces the return data through the TOR peer to peer network back again for a response. Slow as molasses but hides information that you send through it (as a proxy). You might want to invest some time in spreading word about TOR and encouraging others to create TOR nodes on their systems to help advance the cause.

It's also possible, depending on the situation, that if this is an advocacy/human rights thing that packages of data could be encrypted and sent to drop-boxes or special websites outside the country if allowed. But that just protects direct snooping. If you're talking about protecting messages it's possible to use steganography to hide text and data in graphics that are uploaded to places like flickr, for example, to share information.

No matter where you go there's going to be risk that you'll be traced, depending on records being kept by the network providers, law enforcement, and the servers on which the data comes to rest on.

Encrypting via SSH just encrypts data in transit. It does nothing to hide origin point and destination, and might not even hide how much data was being sent. There was an old joke (anecdote? True story? Don't know) where reporters knew when the US was about to launch a war in the mid-east because of the spike in pizza deliveries in the middle of the night to the Pentagon. The network owner/law enforcement may not know WHAT you're saying, but they know when you made the connection, and can approximate how much data you're transmitting, and that alone can raise red flags.

In conclusion there's no single answer to your question. It's a mix of techniques to obfuscate, but never completely hide, what is being done. If someone is getting specifically targeted they will be traceable; it's just a matter of dedicating enough resources to find them and sift through logs and get cooperation of the companies involved. And it's always going to be risky.

share|improve this answer
1  
+1 "All connections, given enough persistence, can be traced" –  Chris S Sep 9 '10 at 14:08

Besides the moral part mentioned above (I totally agree), just a creation of an ssh tunnel is not a solution. You cannot see the content, but you can still be aware of a lot of other things (such as destination, traffic etc).

A solution could be something like TOR system (http://www.torproject.org/) ...

But don't forget that it's "You VS Government" ... so be careful :>

share|improve this answer
    
People should not fear their government, their government should fear the people. –  Michael Feng Sep 9 '10 at 10:45
1  
@Michael: The reality is that in nearly every country it is otherwise. In some countries more, in others less, but governments are always more powerful and usually more dangerous than the citizens. –  SvW Sep 9 '10 at 11:03
    
Sven is right. "Government should fear the People", where "People" is capitalized, and the People are united as one against the Government. –  gWaldo Sep 9 '10 at 11:56
    
"of the people, by the people, for the people".... i thought that was government ;-/ –  Sirex Sep 9 '10 at 14:21
1  
@Sirex: You're such an optimist! Reminds me of the people that say the USA is a democracy, and stare blankly when I say "representative republic". But as we say in ServerFault, this is an HR issue, not a technology problem :-) –  Bart Silverstrim Sep 9 '10 at 14:39

You are starting from several false assumptions - that risk can be eliminated (it can only be mitigated), that censorship can be 'outsmarted' (it can merely be evaded) and that you are better informed than the people implementing the censorship.

You are requesting information on how to implement functionality to protect anonymity but you expect to get all the answers you need here? And once you have an answer you like, you're going to start telling people that you can protect their identities when they are doing something which would be considered illegal in their home countries?

I'd hate to have it on my conscience that I made some suggestion to protect people and it either encouraged them to put themselves at greater risk or was not applicable to their circumstances. Particularly given the potential consequences.

While your efforts seem to be well motivated, you need to be more realistic about your objectives, stop underestimating the opposition and accept that there is no quick route to knowledge.

share|improve this answer
2  
+1, not to mention that since it's posted on the net, the people doing the censorship can read-up on how you're getting around it just as easily as you can. –  Chris S Sep 9 '10 at 14:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.