By Dark Politricks
From a users perspective the Internet contains a myriad of security and privacy issues which if the user is not aware of could cause potential problems on all manner of levels. For the privacy conscious person who wants to be able to surf the net without worrying about someone looking at the content they have visited in real time or at a future date then there are a number of issues. For example with a few lines of script client side or server side you can find out details that can be used to identify your computer e.g
Powered by IP Address Locator
As with most web content if you wanted to be 100% anonymous on the web it will be pretty hard to do but there are various forms of tracking that you should be aware of so that you can limit the risks to you whilst surfing.
Javascript urchins
These are little bits of script that are added to the source code of the HTML page you are visiting. They use JavaScript to record identifying features about the user and their browser such as the user-agent, system details and location by calling a script on another server that then logs these details to a central database. A good example is Google Analytics.
How to bypass
Turning off Javascript will prevent this logging from occurring.
Webbugs
Similar to urchins these are little images, usually so small they cannot be seen, that point back to a web server and run some code whenever the image is loaded by a client. They tend to be used by email marketing tools and are embedded within HTML emails so that they can record who has actually opened the email and track the email if its forwarded it on.
How to bypass
Many email clients if they don’t do it automatically have the option to display emails as plain text which would prevent these webbugs from working.
Server Side logging by the page
Most pages on the web nowadays are more than pure HTML/CSS and contain code that runs server side e.g .asp, .php, .jsp, .aspx etc.
When the page is requested the web server parses the page and runs any code before returning the generated HTML to the client. This code has access to a lot of information about the client requesting the page such as IP address which can be used for GEO tagging, User-agent details, accepted file types and other information contained within the headers. They could choose to log this information to a database or file if they wanted to even if the IIS or Apache web server had its own logging disabled.
How to bypass
Please read the guide under the following section about web server logging as it applies to both.
Logging by the Web Server
Every time you make an HTTP request e.g access a web page, a record is made on the web server that hosts that page to a log file. Each separate file contained within that web page is logged so every image, css file and script is logged along with your IP address, the method e.g POST or GET, the URL, bytes sent and received and much much more.
Although its possible to turn off this logging most companies running web servers require these logs for traffic analysis e.g with a tool such as Webtrends as it helps analyse traffic from all agents including robots who do not have JavaScript support. Also many countries now require ISP’s to keep log files for up to a year or more in case the data is required at a later date.
How to bypass
As you must assume that the web servers you are visiting sites on have logging enabled then the only way to not get tracked is to go through proxy servers. A proxy is an intermediate server that sits between you and the web server you want to access. If someone was tracking you they would only see your request to the proxy server and not the actual content that the proxy server requests on your behalf.
There are various forms of proxy some that are anonymous and others that pass your IP address along in the HTTP_FORWARDED_FOR and HTTP_X_FORWARDED_FOR headers.
There is a form of proxy known as an “anonymizer” as it hides all the users identifying information such as headers that hold the IP and user-agent.
Anonymizers are not entirely secure. If an anonymizer keeps logs of incoming and outgoing connections and the anonymizer is physically located in a country where it is subjected to warrant searches then there is a potential risk that government officials can reverse engineer and identify all users who used the anonymizer and how they used it.
Most anonymizers state they do not keep logs but there is currently no way to confirm that. However, if the user used another anonymizer to connect to the exposed anonymizer, that user is still anonymous. This is sometimes called daisy-chaining.
Cookies
Cookies are small text files that are stored on the clients computer and contain very small pieces of text. They are mainly used by websites to store flags that enable the site to know whether you have previously been to their site or not. Advertisers use them to track the type of sites you visit so that they can deliver targeted advertising.
Another type of cookie is a session variable which is used by many sites to store a unique ID that refers to a visit on the site. The ID is generated by the web server and the session cookie only stores this ID so that on each request to the server the system knows that the visitors requests belong to one visit.
How to bypass
If you are concerned about tracker cookies then you easily disable site related cookies in your browser but if you disable all cookies then Session variables won’t work and you will most likely find yourself getting logged out of member only areas of websites or not being able to login in the first place.
Flash, ActiveX, Java Applets
3rd party components such as Flash, ActiveX controls and Java applets come with their own security concerns. There have been numerous security vulnerabilities reported with these types of component as due to their complexity and power they have more access to the clients computer than a normal web page. They should be seen as mini applications rather than just a fancy banner, game or helpful utility to enable you to upload files to Facebook more quickly.
You shouldn’t install these types of application unless you are totally sure they are safe as they could have a lot more control over your computer than you realise. There have even been hacks that have enabled remote users to video and record a user through their webcam without them knowing.
How to bypass
You can use Firefox extensions such as FlashBlock or AdBlocker to disable flash on specific pages. If you decided to choose privacy over anything else then you will end up having a pretty boring web experience as more and more sites use Javascript and Flash to deliver interactive content.
However if you are really security conscious you should use a text browser such as Lynx which won’t load images, flash, JavaScript or any other form of plug-in. It will show you the textual content of the pages you visit and will ask if you want cookies to be stored for each request. Due to only loading text and links you will have fast load times so there is a benefit to having a reduced web interface.
You should also regularly check your PC for viruses and spyware. One of the first things modern Trojans do nowadays is download good anti-virus software so that they don’t get overwritten by another spyware app!
They also try to disguise themselves as virus checkers to avoid detection. Even the best off the shelf virus checkers don’t catch all forms of spyware especially those that have to regularly download virus definition patterns as it means new viruses don’t get caught until they have been identified, a pattern created and downloaded by the client.
Virus payloads can also be modified randomly to avoid pattern detection so tools that don’t use pattern matching such as hijackthis.exe which runs an analysis of all currently running processes looking for odd behaviour are good tools to use. This tool will generate a report which can then be analysed by members of the special Hijackthis.exe message board for signs of infection. One of the best removers of Trojans I have found is a tool called SDFix.exe which managed to detect and remove a Trojan that four other tools including an off the shelf app didn’t detect. Tools to use to aid privacy on the web Firefox Add-Ons
- Web Developer toolbar. Disable Javascript, cookies, view cookie and header info, modify the DOM, view generated source code, show password fields.
- Flashblock disables flash movies until you enable them. Allows creation of a white-list of allowed sites.
- FoxyProxy manage your proxies with an easy to use tool.
- Tamperdata acts like a proxy and allows you to modify HTTP requests as they are made from your client.
Google Searching
- Scroogle Search a way to search Google through an SSL, with no logging, no adverts and no cookies.
Google Chrome
- Use Incognito browsing to prevent browser and search history and cookies from being stored.
All browsers
- De-activate Javascript, VBScript (IE only)
- De-activate domain and path cookies.
- If you share a PC Clear your cache, autocomplete, and history regularly.
If you need more details about the various forms of Internet Censorship and how to bypass it then check out the following article that contains a lot of details about the various methods used and how to bypass them.
How to bypass Internet Censorship If you are looking for an up to date list of available proxy servers then you can check out the following links:
http://www.digitalcybersoft.com/ProxyList/fresh-proxy-list.shtml
http://www.workingproxies.org/
The following page has an index where you can find more proxy lists http://www.dmoz.org/Computers/Internet/Proxying_and_Filtering/Hosted_Proxy_Services/Free/Proxy_Lists/
If you want to quickly access some web based proxies you can pick from the following list or you can read my guide on creating your own web proxy which comes with an example and some code you can use to get running.