Manual: Safe communication with free and cheapo tools

[Sviborg]

As we all may see from past loud hits, done to carding communities by LE, is that carders was never caught on wiping someone's bank account or hacking kind of server.
All that was done by gaining control to VPN servers, used by carders, intercepting their communications and by gettting their real info (when receiving WU transfer to own name, meeting with colleagues, receiving stuff and so on)
From other side, what I can see - is that english-talking carders think less about their security then russians.
My own stats is like following:
Only ONE guy from asia use SIMP to encrypt his messages on ICQ
Only ONE guy use Jabber, but wasn't able to encrypt messages until I help him configure his PSI client to work with GnuPG.
Other's just use ICQ with plaintext messages, which may be sniffed by anyone, from ISP to feds.
So, in this small article I will try to describe cheap methods how to be more secure online.
Sorry for my poor english, but this is not my native language.

Lets cover following issues:

a. ANONIMITY, WHILE WE POST SHIT ON FORUMS
I believe, that for hiding your origin IP for just posting on forum will be enough to download portable Tor browser.
It can be obtained here : http://www.torproject.org
You may put it on USB PayPal, so it will not leave traces on your system.
Just run it and it will establish encrypted circuit. I dont think its controlled by any government, since server itself is opensource as well as all servers are located in different countries.
Anyway, this is my opinion, that this security is enough to post on forums.

b. HIDING YOUR TRAFFIC FROM YOUR ISP EYES.
Of course, we may buy VPN etc, but, I do not trust some other carders to rely on them in case of my own security.
But, in this case we may do our personal VPN by establishing SSH port forwarding.
For example, you may establish VPS in Russia for as low as 10$ and you can pay by WMZ. If you dont like Russia - use China, Malaysia etc.
Once you get an account and SSH access, lets start hiding our traffic.
First of all, we need to hide our IM traffic from our ISP (how to encrypt it, we will see in the next chapter)
Download PuTTY software(www.chiark.greenend.org.uk/~sgtatham/putty/) and place it somewhere on your PC. I think, that C:\Program Files\Putty will be fine.
Navigate to that folder and double click on putty.exe file. Once it start, click on window and appearance tabs and configure appearance as you will like.
This is my preferences, your may be different.

Then, come to SSH->Tunnels tab and configure port forwarding. If we need to hide your ICQ traffic, then we need to forward port 5190.
Just as you can see on pictures below:

Now click on SSH and configure Enable compression and USE SSH2 ONLY. As you can just see on picture. Now click on Session and enter public IP address or qualified host name of your server.

Enter unique name for your server and click on SAVE. Now you may select your server, click on OPEN and login to server with your credentials.
Sorry guys, my server is my server, so I enter someone else server address
You may do same things for Jabber, MSN, Yahoo, Socks, whatever you are using. Of course, you will appear like guy connecting not from your IP. but from server IP.

Now lets configure your ICQ client. If you are using Miranda, then come to Settings->Accounts and change your login server to localhost:5190 as on picture

Sorry guys, that this screenshot is on russian, but, Im russian

 

[Sviborg]

Well, now you know, how to encrypt your traffic, lets now talk about encryption of your messaging:
I use ICQ for business ocassionally, mostly just to let someone know, that I have jabber account and to paste my GnuPG key.
Since I use SSL channel encryption, which is going over SSH channel and each message encrypted by 2048bit RSA key, generated by GnuPG - I feel myself very safe.
But, we will talk on GnuPG enabled email and jabber messaging in the next post, since I'm bit tired hitting my keyboard, so now lets cover questions on how to encrypt ICQ messaging. Of course, all of you listen or ever use Simp or Simp PRo, but I just dont trust proprietory software.
Thats why, I will tell you how to encrypt your ICQ messages with open-source and free OTR(off the record) messaging software.
if you are using miranda(like me) for ICQ messaging, then you may just download OTR plugin and install it into plugins folder of your Miranda installation. Then, just open Settings->Plugins->OTR and set settings you need:
Generate private key for each account you need and set default policy for contacts you need. Like here:

Once it done, lets start communications. First time you start communication, you will receive private key, which you need to confirm

Once it done, you may communicate just nice and secure. No one hear you now
If you do not use miranda, but using any other client, or even shit like ICQ 7 - you may download OTR proxy from developers site and install it in your system. You may download it here: http://www.cypherpunks.ca/otr/binaries/windows/otrproxy-0.3.1.exe
In order to show you how it work, I just disable OTR plugin on test Miranda installation and setup SOCKS5 proxy as you can see on this image:

First time it run, you may select your account and generate key:

Once you receive first handshake from another OTR user you will get popup, showing you prompt to verify key. Like here

Now all keys in keystore and you may use your client to communicate securely.

Also, main window show you, what connection is secured, and what - not:

I hope, that now this illustrated manual will help someone to secure own business and harden anonimity.
In the next post we will talk on GnuPG encryption in email and jabber communication, which is(I believe) much more secure way of messaging just because of non-existence of central server and database.

Yours, Sviborg