Mashapedia
Browse by Chapter
Chapter 1

Chapter 1

Tor

A network that enables anonymous communications. By using the Tor Browser you can visit web sites without letting them know your location or your actual IP address. More about Tor (including questions “is it legal?”):

Facebook Tor Hidden Service

A site that allows access to Facebook through the Tor protocol. According to Alec Muffett “Facebook’s onion address provides a way to access Facebook through Tor without losing the cryptographic protections provided by the Tor cloud. … it provides end-to-end communication, from your browser directly into a Facebook datacentre.” The address is facebookcorewwwi.onion where .onion is the common top-level domain name for sites in Tor network. You can enter this domain name in the Tor Browser’s address field. It won’t work in your normal (Chrome, Firefox, etc.) browser. More:

Sectec

A fictional networking device produced by Xoth. Not a CCTV camera produced by Shenshen Sectec Co. (http://www.sectec.com.cn/)

0-day or zero-day

A vulnerability that has not been fixed by the vendor or was fixed just recently which allows hackers to exploit it. More:

Exploit

A piece of software or a methodology (series of steps) that allows hackers to use a known vulnerability to get access to a target computer. More:

Tunnel out

To use an SSH tunnel to get secure access to a remote box. Usually you use SSH tunneling to bypass firewalls that prohibit certain Internet services. More:

Bootloader

A piece of software which normally starts at the early stages of computer start-up process, after executing the BIOS, but before the operating system starts. Its purpose is to load the operating system (hence the name). Bootloader integrity check is important to avoid a “boot attack”: type of attack that replaces the original bootloader and installs a bootloader that can intercept passwords, including those used for hard drive encryption.

Learn more:

Semtex

General-purpose plastic explosive.

Learn more:

Hardware keylogger

A device used to log all keystrokes on a computer which is used to capture passwords.

Learn more:

Catching password from key sounds

Different keys on the keyboard produce slightly different sounds so the recorded acoustic pattern of you typing in your password can be used to guess it. That’s why Masha does ““medium-loud AAAAAH”” when typing her password.

Learn more:

Faraday cage

An enclosure that blocks electromagnetic fields. Could be a room, a cabinet, a bag.

Learn more:

Tails

A security-focused Linux distribution that aims at preserving privacy and anonymity. It usually loads from a live DVD or USB and provides Linux environment that is based on Tor network. Your browsing information is not stored anywhere unless you specifically instruct it to do so. Tails provides an emergency shutdown: when you pull the USB out of the slot, the system erases all computer memory and shuts itself down immediately.

Learn more:

MIT Media Lab

A research lab at MIT famous for its inventions and projects in areas of human-computer interaction, artistic visualization, musical devices, sociable robots, etc.

Learn more:

USB Port Physical Lock

There are several variants of such a device that physically blocks access to the USB port. Some of them have keys, some should be physically destroyed to get access to the port. Examples:

EL wire

Electroluminescent wire is a thin copper wire coated in a phosphor that produces light through electroluminescence when an alternating current is applied to it. More:

Lidar

“Light radar” – a device that used laser light to scan the area and measure distances to objects, walls, etc. It is also used as an acronym of “light detection and ranging” and “laser imaging, detection, and ranging”. In the book Masha uses a drone to get “lidar outlines of all the human in the space”.

Learn more:

Raspi Altair 8800

Altair 8800 is one of the first personal computers which was introduced in 1974. For many people it has sentimental value – that’s why some people design and sell Altair emulators that use modern technologies such as Arduino and Raspberry Pi.

Learn more:

Blinkenlights

Usually refers to the diagnostic lights on computer’s front panels (in the old days). The term derives from the famous text dated as far back as 1955.

ACHTUNG!
ALLES TURISTEN UND NONTEKNISCHEN LOOKENSPEEPERS!
DAS KOMPUTERMASCHINE IST NICHT FÜR DER GEFINGERPOKEN
UND MITTENGRABEN! ODERWISE IST EASY TO SCHNAPPEN DER
SPRINGENWERK, BLOWENFUSEN UND POPPENCORKEN MIT SPITZENSPARKEN.
IST NICHT FÜR GEWERKEN BEI DUMMKOPFEN. DER RUBBERNECKEN
SIGHTSEEREN KEEPEN DAS COTTONPICKEN HÄNDER IN DAS POCKETS MUSS.
ZO RELAXEN UND WATSCHEN DER BLINKENLICHTEN.

Learn more:

Paranoid Android

In the book it seems to be the Android-based OS for smartphones focused on security. The main feature of it is that you update it very often to make sure all known vulnerabilities are patched or at least there are no known exploits for them. Masha explains that you should always check the OS signatures to make sure you are actually installing the correct bits and not something created by the government hackers containing backdoors and loggers. Apparently there is such a project in real life, but it’s not specifically focused on security – it just uses the cool name.

Learn more:

IMSI-catcher

A device that can pretend to be a cell phone base station and make all phones in the nearest proximity to connect to it (because its signal stronger than the real cell towers that are farther away). That way it will be able to collect all information about the connected phones such as IMSI (international mobile subscriber identity), etc. Also it will be able to intercept phones’ traffic, voice and data using “man-in-the-middle” attack. Devices can be purchased online, as well as anti-IMSI-catchers. You can build one yourself, if you want (see the link below).

Learn more:

Dazzle mask

A mask that allows you to trick facial-recognition software into thinking you are not human. They may use reflective tapes, infrared lights, lenses, etc.

Learn more:

Pastebin

A storage site where people can post pieces of code and other text information.

Learn more:

Regular expressions

A (smart) way to search specific patterns or strings in text files. You can describe patterns like “one to three numbers followed by a dash followed by several capital letters, no more than 8.”

Learn more:

Anonymouth

Document anonymization tool written in Java. More:

Stylometry

A method to study linguistic style to find out who the author of the document is.

Learn more:

PGP

Pretty Good Privacy, a cryptographic method used for encryption and digital signing documents, emails, etc.

Learn more:

Malware

Malicious software: software intentionally designed to cause damage to computer systems.

Learn more:

NFC, Near-Field Communication

A set of communication protocols for communication between two electronic devices over a distance of 4 cm. Used in various types of key cards, passes. etc.

Learn more:

Information Cascade

A pattern of information flow when you can see how information or decision coming from one person triggers the series of decisions or information passes from several other persons.

Learn more:

Anti-Stingray

Tools to protect oneself from IMSI-catchers.

Learn more:

Asterisk

An open source phone framework that can be used to build a Voice-over-IP or IP PBX system. Masha runs such a server on the cloud and uses it to route her calls. One of the examples: https://aws.amazon.com/marketplace/pp/Technology-Innovation-Lab-of-Texas-Asterisk-1770-A/B079Y7449R

Learn more:

Signal

A communication application which is considered to be the most secure for end-to-end encryption. Trusted and used by Edward Snowden, Jack Dorsey, Bruce Schneier. It uses the open-source Signal protocol. Works on iOS, Android, Linux, macOS, Windows

Learn more:

Binary Transparency

A method that allows users to verify that the piece of software they use is exactly the same used by other users, i.e. it was not substituted by a compromised version.

Learn more:

Hashing

Masha explains it pretty well in the book.

Learn more:

Public-private key cryptography

Again, Masha does a great job explaining the basics.

Learn more:

BadUSB

It is a way to use the microcontroller embedded in a USB device to inject malware in your computer. The most dangerous thing about it is that all the work is done by that microcontroller, invisible to the target computer’s CPU.

Learn more:

Baseband phone security

It was confirmed that the software that controls the baseband radio on smartphones can be compromised and can allow attackers to control other smartphone devices such as camera and microphone. More (some papers are a bit dated, but it’s quite possible some vulnerabilities described in them still exist):

Man-in-the-middle attack

This is the category of attacks where the attacker injects something in the transmission channel (voice, data, etc.) that can listen to the traffic and potentially alter the traffic.

Learn more:

Openstreetmap

Wrongly called “Openstreetmaps” in the book. An open source alternative to Google Maps.

Learn more:

Citizen Lab

A laboratory based at University of Toronto which works on protecting human rights and privacy in cyberspace.

Learn more:

IntroductionChapter 2