D&C GLug - Home Page

[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]

Re: [LUG] Re Malware being distributed using list emails

 

On 17/03/2022 15:00, Dom Rodriguez/shymega via list wrote:
On Thu, Mar 17, 2022, at 11:51 AM, maceion@xxxxxxxxx wrote:
On 17/03/2022 00:37, Simon Waters wrote:
On Wednesday, 16 March 2022 21:14:18 GMT Rock Storm wrote:
On Wed, 2022-03-16 at 14:10 +0000, Simon Waters wrote:
Email generally isn't the answer, although with strong encryption it
...........

Use of TOR browser is not possible as it is always detected at other end
in transit from exit server. And local forces are knocking on my
recipient's door in minutes.
TOR worries authorities so response is very heavy handed.

Eion, I'd be interested to know why you think TOR results in that sort of response.

BBC for example has publicly announced a TOR service they host - 
https://www.bbc.com/mediacentre/articles/2022/advice-on-accessing-bbc-news - surely 
if this was undesirable, or seen as a 'bad thing', such a trusted news source would 
not publish...?


*The PRC places very great importance* on 'control' of information from outside to inside PRC.
refer wikipedia Internet censorship in China.
refer (old it has increased since then)
https:// nationalinterest .org /feature /how-china-controls-its-citizens-29467
refer https://    restoreprivacy   .com   /vpn   /best/china/

Shifting to a TOR browser is detectable.

This is the very reason the BBC has published a TOR address.
Its own website is not obtainable from PRC or many other countries.
It allows a chance (slim, but yes, it is possible) to access the BBC International website .
It des NOT, repeat NOT, access the internal UK BBC website.

Actual Websites with Their Own TOR .onion address work and using their own fixed "xxx.onion" website very much reduces the strain on other TOR network nodes and the overall system and the users connection success.

Difference is between a fixed "xxxx.onion" address and a random TOR request to the normal BBC website where the outlet node is not specific, and changes from time to time as routes and loan of access/exit/transit points vary.

Selecting the URL for the BBC .onion site works IF and ONLY IF the local servers permit access to TOR network. (easy from UK)
Likewise for other TOR uses.

Connection to TOT, and encrypted mail facilities (e.g ProtonMail) are at best 'random' and unsure.

E.g. iPhones sometimes do not work ( perhaps for a couple of hours or so, in any one day, in any specific area or housing block) random area access blocking. To ensure connectivity, best to climb in local hills inside Beijing, you then have a number of possible connection masts. Evening strolls by folk with intent mobile phone use in hills is quite noticeable.

A colleague in a main city in PRC with international cable access points at his local ISP's main building, has his requests to UK email point (mine), diverted over at least *another extra* 6 to 8 internal PRC servers including to main analysis site in "A City" about 800 miles from his city before exiting PRC to Pacific cables to USA and thence to UK.

Monitoring 'his email' in real time from UK and internally in PRC by others shows immediate divergence when he requests a non-PRC address.

The browsing person has to get onto the TOR network from their device.
As internet connectivity is monitored (auto monitoring) at all times, when user drops accredited known (and authorised points and browsers) then actions are immediately instigated.

TOR is accessible by convoluted routes (e.g. using a VPN inside a foreign 'enclave', example English Tutoring Schools or external schools set up inside PRC are allowed to access outside world by approved VPNs. The school VPN can access for instance the BBC normal website, the school can access the BBC .onion website) Many in PRC run or have 'loaned' to them 'spare' entry points on a local authorised body with a VPN to outside. A VPN is in strict terms 'legal' for personal 'approved' use.

One PRC CCP party member known to me uses it to 'keep them informed' on events outside the 'official route'. So some in CCP allow some interaction to disguise their own use of the system (like US Navy with TOR)

Essentially:
BBC is banned throughout PRC.
BBC TOR address may work for those who can access TOR (this is certainly not the average computer user in PRC)
Note BBC has also published Ukraine and Russian language TOR .onion websites

In one case my colleague had police at his door within minutes of a connection with me. He has been stopped in his car, and imprisoned (hand and foot cuffs) in an unheated container (at minus 17 C) for 37 hours with no food, no water, no correspondence or outside body notified, while they 'examined' his mobile phone. Had to sign confessions of 'unspecified' harm to PRC before ultimate release.

However we use a goodly number of different channels including person to person carry (many intermediaries) and on 'normal email' do not raise the 'trigger words' used by auto monitors.


Humour fact. I had a personal licence from HMG (like a UK export licence for goods) to correspond with Iraq during UK-Iraq-Kuwait business.

I am as the phrase goes, "known" to certain bodies in a few countries.



--
regards
Eion MacDonald

--
The Mailing List for the Devon & Cornwall LUG
https://mailman.dcglug.org.uk/listinfo/list
FAQ: https://www.dcglug.org.uk/faq/