The Digital Speakeasy: Secure and Anonymous Access to Your Website

The Digital Speakeasy: Secure and Anonymous Access to Your Website
DrupalCamp Montréal 6/16/17

Howdy! Dustin Younse @milsyobtaf https://github.com/milsyobtaf/prez I’m an engineer at Acquia

What Is The Digital Speakeasy?

• Plain Text browsing Browsing in Secret

<!DOCTYPE html> <html lang="en-US"> <head> <meta charset="utf-8"> <title>Web design, development,
and strategy | Four Kitchens</title> <meta name="viewport" content="width=device- width, initial-scale=1.0, maximum-scale=1.0"> <meta property="og:title" content="Web design, development, and strategy"> <meta property="og:type" content="article"> <meta property="og:url" content="http:// fourkitchens.com/"> <link rel="canonical" href="http://

HTTP/1.1 200 OK Server: nginx/1.6.1 Date: Sat, 20 Aug 2016
03:42:11 GMT Content-Type: text/html; charset=utf-8 Content-Length: 56595 Last-Modified: Wed, 17 Aug 2016 00:07:26 GMT Connection: keep-alive Vary: Accept-Encoding ETag: "57b3aabe-dd13" Expires: Sun, 21 Aug 2016 03:42:11 GMT Cache-Control: max-age=86400 X-UA-Compatible: IE=Edge Accept-Ranges: bytes

The Internet Is Trusting   By Default

• Plain Text browsing • HTTPS browsing Browsing in Secret

<!QBPGLCR ugzy> <ugzy ynat="ra-HF"> <urnq> <zrgn punefrg="hgs-8"> <gvgyr>Jro qrfvta, qrirybczrag,
naq fgengrtl | Sbhe Xvgpuraf</gvgyr> <zrgn anzr="ivrjcbeg" pbagrag="jvqgu=qrivpr- jvqgu, vavgvny-fpnyr=1.0, znkvzhz-fpnyr=1.0"> <zrgn cebcregl="bt:gvgyr" pbagrag="Jro qrfvta, qrirybczrag, naq fgengrtl"> <zrgn cebcregl="bt:glcr" pbagrag="negvpyr"> <zrgn cebcregl="bt:hey" pbagrag="uggc:// sbhexvgpuraf.pbz/"> <yvax ery="pnabavpny" uers="uggc://

HTTP/1.1 200 OK Server: nginx/1.6.1 Date: Sat, 20 Aug 2016
03:49:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 56595 Last-Modified: Wed, 17 Aug 2016 00:07:26 GMT Connection: keep-alive Vary: Accept-Encoding ETag: "57b3aabe-dd13" Expires: Sun, 21 Aug 2016 03:49:34 GMT Cache-Control: max-age=86400 X-UA-Compatible: IE=Edge Accept-Ranges: bytes

• Plain Text browsing • HTTPS browsing • Onion Router
(gen 0 and gen 1) Browsing in Secret

• Plain Text browsing • HTTPS browsing • Onion Router
(gen 1) • Tor (The Onion Router, gen 2) Browsing in Secret

The Rule of Three

So Why Bother?

• Not all governments are that forgiving • Arab Spring
• Turkish Coup The Importance of Privacy

The Importance of Privacy • Not all governments are that
forgiving • Arab Spring • Turkish Coup • Not all jobs are fully ethical • Edward Snowden • Chelsea Manning • Your reading habits can have consequences • Open Societies Foundation

Well, Tor Seems Great!

But There’s A Problem

Hidden Services

http://fkdheignoueupfmf.onion/

http://facebookcorewwwi.onion/

Cooking up some delicious scallions... Using kernel optimized from file
kernel.cl (Optimized4) Using work group size 128 Compiling kernel... done. Testing SHA1 hash... CPU SHA-1: d3486ae9136e7856bc42212385ea797094475802 GPU SHA-1: d3486ae9136e7856bc42212385ea797094475802 Looks good! LoopIteration:40 HashCount:671.09MH Speed:9.5MH/s Runtime: 00:01:10 Predicted:00:00:56 Found new key! Found 1 unique keys. <XmlMatchOutput> <GeneratedDate>2014-08-05T07:14:50.329955Z</GeneratedDate> <Hash>prefix64kxpwmzdz.onion</Hash> <PrivateKey>-----BEGIN RSA PRIVATE KEY----- MIICXAIBAAKBgQCmYmTnwGOCpsPOqvs5mZQbIM1TTqOHK1r6zGvpk61ZaT7z2BCE FPvdTdkZ4tQ3/95ufjhPx7EVDjeJ/JUbT0QAW/YflzUfFJuBli0J2eUJzhhiHpC/ 1d3rb6Uhnwvv3xSnfG8m7LeI/Ao3FLtyZFgGZPwsw3BZYyJn3sD1mJIJrQIEB/ZP

But Drupal?

Drupal Hidden Services • Drupal Module (http:/ /dgo.to/tor) • Very
out of date, somewhat clunky • Tor on Production Server • Complicates production server • Potential attack vectors • Something else?

The Unix Way™

Reverse Proxy Setup • Drupal server only accessed as standard
web server • Can’t blame Tor if the server white screens • Drupal server can continue to collect logs normally • Tor server can be locked down and scrubbed

# Try to run Tor more securely via a syscall
sandbox. # https://www.torproject.org/docs/tor-manual.html.en#Sandbox Sandbox 1 # Disable the SOCKS port. Not like anything else on this box is using tor. SocksPort 0 HiddenServiceDir /var/lib/tor/hidserv #HiddenServicePort 80 127.0.0.1:80 HiddenServicePort 80 unix:/var/run/nginx-80.sock #HiddenServicePort 443 unix:/var/lib/nginx/nginx-443.sock

server { server_name fdg22p3lmweopgho.onion; listen unix:/var/run/nginx-80.sock; allow "unix:"; deny all;
#listen 80; #allow 127.0.0.1; # Set cache on this nginx end so that we avoid fetching from # the real infrastructure when possible. proxy_cache tor; proxy_cache_valid any 5m; proxy_cache_revalidate on; proxy_cache_use_stale timeout updating; proxy_cache_key $request_uri; proxy_ignore_headers expires set-cookie;

Ideal Setup Private Networking 192.168.1.100 192.168.1.101

location / { proxy_pass https://192.168.1.100; proxy_http_version 1.1; proxy_set_header Host "www.website.org";
proxy_set_header Connection $connection_upgrade; proxy_set_header Upgrade $http_upgrade; #proxy_ssl_server_name on; proxy_read_timeout 30; proxy_connect_timeout 30; # Don't compress data, since the subs module can't replace proxy_set_header Accept-Encoding ""; # TODO: denying non-GET requests due to some bot-related # abuse on some endpoints that poorly handle that. limit_except GET { deny all;

An Important Step http://fkdheignoueupfmf.onion/ http://website.org/node/42

### SUBS https://github.com/yaoweibin/ ngx_http_substitutions_filter_module ### # We're rewriting links, but
we need to preserve rel=canonical for analytics. subs_filter "rel=\"canonical\" href=\"http:// www.website.org" "-----CANONICALHTTPfdgDOTORG-----" i; subs_filter "rel=\"canonical\" href=\"https:// www.website.org" "-----CANONICALHTTPSfdgDOTORG-----" i; # Keep links in .onion subs_filter (http:|https:)?//(www\.)?website.org //$server_name gir; # Restore the rel="canonical" tag subs_filter "-----CANONICALHTTPfdgDOTORG-----" "rel=\"canonical\" href=\"http://www.website.org" i; subs_filter "-----CANONICALHTTPSfdgDOTORG-----" "rel=\"canonical\" href=\"https://www.website.org" i; ### /SUBS ###

# We're rewriting links, but we need to preserve rel=canonical
for analytics. subs_filter "rel=\"canonical\" href=\"http:// www.website.org" "-----CANONICALHTTPfdgDOTORG-----" i; subs_filter "rel=\"canonical\" href=\"https:// www.website.org" "-----CANONICALHTTPSfdgDOTORG-----" i; # Keep links in .onion subs_filter (http:|https:)?// (www\.)?website.org //$server_name gir; # Restore the rel="canonical" tag subs_filter "-----CANONICALHTTPfdgDOTORG-----" "rel=\"canonical\" href=\"http://www.website.org" i; subs_filter "-----CANONICALHTTPSfdgDOTORG-----"

### HEADERS http://wiki.nginx.org/HttpHeadersMoreModule ### more_clear_headers "Age"; more_clear_headers "Server"; more_clear_headers "Via";
more_clear_headers "X-From-Nginx"; more_clear_headers "X-NA"; more_clear_headers "X-Powered-By"; more_clear_headers "X-Request-Id"; more_clear_headers "X-Runtime"; more_clear_headers "X-Varnish"; more_clear_headers "Content-Security-Policy-Report-Only"; ### /HEADERS ### }

Ideal Setup

It’s only illegal if you get caught - me, 1998

- me, 2016 It’s only secure if they can’t prove
anything

Ideal Setup • All logging turned off • All log
paths set to /dev/null • Belt and suspenders? • Increase speed • One instead of three?

Future Improvements • Future Improvements • Single Onion Services -
1 hop server () • OnionBalance - load balancing • SSL Certificates

There Can Be Only One • Hidden sites, by their
nature, have unique and secure URLs • It’s still possible to be exposed to malicious Tor nodes • Your browser might try to communicate to non- Onion addresses

There Can Be Only One • DigiCert • Only game
in town, currently

There Can Be Only One • DigiCert • Only game
in town, currently • Working to standardize .onion as a TLD

Extra Credit Assignments • Generally secure networking - email, calendar,
etc • OnionShare filesharing • Non-hidden but protected sharing (Tor + secret key) • A true speakeasy! • DNS circumventing routing - share your localhost

Resource Links General: https:/ /www.torproject.org/about/overview.html.en https:/ /www.torproject.org/docs/hidden-services.html.en https:/ /www.eff.org/pages/tor-and-https ProPublica
setup: https:/ /www.propublica.org/nerds/item/a-more-secure-and-anonymous-propublica-using-tor-hidden-services https:/ /gist.github.com/mtigas/9a7425dfdacda15790b2 HTTPS: https:/ /www.cybersecureasia.com/blog/tor-ssl-onion-certificate-from-digicert Vanity URL: http:/ /www.zdnet.com/article/facebook-sets-up-hidden-service-for-tor-users/ Future Stuff: http:/ /onionbalance.readthedocs.io/en/latest/ https:/ /blog.torproject.org/blog/whats-new-tor-0298 https:/ /onionshare.org @milsyobtaf

Thanks!  Questions?    @milsyobtaf https://github.com/milsyobtaf/prez

The Digital Speakeasy: Secure and Anonymous Acc...

The Digital Speakeasy: Secure and Anonymous Access to Your Website

More Decks by milsyobtaf

Other Decks in Technology

Featured

Transcript