[Android General] Illidan Pornrage:
Firstly some little rant about keweon which is the most hypocrite security service I've ever seen:

[

The mentioned bet was with me. PM for details or public if you make me care enough.

>Copypasting all the elaborate posts from the Telegram sphere as I cant bother to spend much time on it.

I mostly agree with whats written there.

Seriously I dont care about Thorsten (MrT69) personally or in any other way.

I am actually quite sick of this topic. Even mad that I have to deal with basic **** like that. These people managed to trigger a hermit into logging on to tracking heavy XDA.

Why I do this? It needs to be done.

I could have never imagined that such a blatant scam could gain enough traction that it regularly annoys me.

]

<<< A little bit of ranting about keweon >>>

"

Evidence and proof of concept that keweon Online Security is not as secure as claimed by its developer.

After a group of independent IT and cyber security specialists proved that keweon is not as secure as claimed by the developer, they confronted the developer with the results and reminded him of a bet. All keweon support groups on TG then were deleted by the developer personally and without further explanation on the morning of February 4, 2019.

We all know by now that the way keweon DNS works is based on users using keweon's DNS and the keweon root certificate.

What has now been proven is exactly what keweon could do with its users, but Torsten vehemently denies and claims "that's impossible" and "that doesn't work":

1. get users to use your DNS server.

2. get users to use your root certificate.

3. redirecting a page, e.g. mybank.com, to one of the keweon servers (by changing the DNS record)

4. issue your own SSL certificate for the website, users have installed your Root-CA and so this is not a "witch work"

5. read username/password from the connection (if 2FA is used, just wait until the user logs in and use the token again quickly as it is valid for 30 seconds).

We now have proof that this is possible without a doubt. In fact, this is a classic MITM attack, and anyone who denies that it is possible either has no idea (you shouldn't assume this from Torsten) or is trying to hide something from his users.

The developer of keweon has repeatedly asserted and insisted that a root certificate cannot intercept connections or collect data.

Quote from the keweon developer with his PayPal bet:

"Prove that to me. Give me any DNS and a root certificate and try to get my PayPal data.

I'll then even contact you when I sign up for PayPal. If you manage to get my PayPal data this way, you can log in and transfer 500 Euro to your account. I have made this offer very often and this is a serious offer from my side."

Unfortunately the developer of keweon didn't contribute his part to the test as he promised so often and of course he didn't log into Paypal via our provided DNS and root certificate.

The only reaction on his part was, apart from some insults, the deletion of all keweon groups on TG.

The security test of the keweon servers also revealed that under certain conditions connections are even redirected to keweon's own termination server and answered with 1x1 pixel gifs.

The fact is that the requests contain tracking IDs that can be easily managed from these servers.

So even Torsten's statement that the keweon SSL server only terminates requests with empty (0 byte) responses is wrong.

This again contradicts Torsten's own statement.

The point now is that the developer of keweon Online Security is actively trying to deny that it is possible for him to abuse the root certificate, although it has now been proven that it is actually possible for him to do exactly that with the keweon root certificate and its users.

Until the developer decides to disprove the accusations made against keweon Online Security or can prove that the accusations against him are unfounded, it is advisable for obvious reasons of security not to use keweon Online Security for the time being.

Anyone who is interested in repeating this test can do so at:

http://https-interception.info.tm/, where you will find a DNS and a root certificate, same as with keweon Online Security.

Furthermore there is a real-time log about recorded connections.

Everything else can be found there.

Please be careful not to use your correct email address or password for this test!

#keweon #test #bet #evidence #ProofOfConcept

"

<<< /rant >>>

<<< Explanation of some DNS and TLS/HTTPS basics for noobs >>>

DNS And Root Certificates - What You Need To Know

e8aebe8eb8b24035ae75260ca0ea80a7 / 20190205

Due to recent events we felt compelled to write an impromptu article on this matter. It's intended for all audiences so it will be kept simple - technical details may be posted later.

1. What Is DNS And Why Does It Concern You?

DNS stands for Domain Name System and you encounter it daily. Whenever your web browser or any other application connects to the internet it will most likely do so using a domain. A domain is simply the address you type: i.e. duckduckgo.com. Your computer needs to know where this leads to and will ask a DNS resolver for help. It will return an IP like 176.34.155.23; the public network address you need to know to connect. This process is called a DNS lookup.

There are certain implications for both your privacy and your security as well as your liberty:

- Privacy

Since you ask the resolver for an IP for a domain name, it knows exactly which sites you're visiting and, thanks to the "Internet Of Things", often abbreviated as IoT, even which appliances you use at home.

- Security

You're trusting the resolver that the IP it returns is correct. There are certain checks to ensure it is so, under normal circumstances, that is not a common source of issues. These can be undermined though and that's why this article is important. If the IP is not correct, you can be fooled into connecting to malicious 3rd parties - even without ever noticing any difference. In this case, your privacy is in much greater danger because, not only are the sites you visit tracked, but the contents as well. 3rd parties can see exactly what you're looking at, collect personal information you enter (such as password), and a lot more. Your whole identity can be taken over with ease.

- Liberty

Censorship is commonly enforced via DNS. It's not the most effective way to do so but it is extremely widespread. Even in western countries, it's routinely used by corporations and governments. They use the same methods as potential attackers; they will not return the correct IP when you ask. They could act as if the domain doesn't exist or direct you elsewhere entirely.

2. Ways DNS lookups can happen

2.1 3rd Party DNS Resolvers Hosted By Your ISP

Most people are using 3rd party resolvers hosted by their internet service provider. When you connect your modem, they will automatically be fetched and you might never bother with it at all.

2.2 3rd Party DNS Resolver Of Your Choice

If you already knew what DNS means then you might have decided to use another DNS resolver of your choice. This might improve the situation since it makes it harder for your ISP to track you and you can avoid some forms of censorship. Both are still possible though, but the methods required are not as widely used.

2.3 Your Own (local) DNS Resolver

You can run your own and avoid some of the possible perils of using others'. If you're interested in more information drop us a line.

3. Root Certificates

3.1 What Is A Root Certificate?

Whenever you visit a website starting with https, you communicate with it using a certificate it sends. It enables your browser to encrypt the communication and ensures that nobody listening in can snoop. That's why everybody has been told to look out for the https (rather than http) when logging into websites. The certificate itself only verifies that it has been generated for a certain domain. There's more though:

That's where the root certificate comes in. Think of it as the next higher level that makes sure the levels below are correct. It verifies that the certificate sent to you has been authorized by a certificate authority. This authority ensures that the person creating the certificate is actually the real operator.

This is also referred to as the chain of trust. Your operating system includes a set of these root certificates by default so that the chain of trust can be guaranteed.

3.2 Abuse

We now know that:

- DNS resolvers send you an IP address when you send a domain name

- Certificates allow encrypting your communication and verify they have been generated for the domain you visit

- Root certificates verify that the certificate is legitimate and has been created by the real site operator

How can it be abused?

- A malicious DNS resolver can send you a wrong IP for the purpose of censorship as said before. They can also send you to a completely different site.

- This site can send you a fake certificate.

- A malicious root certificate can "verify" this fake certificate.

This site will look absolutely fine to you; it has https in the URL and, if you click it, it will say verified. All just like you learned, right? No!

It now receives all the communication you intended to send to the original. This bypasses the checks created to avoid it. You won't receive error messages, your browser won't complain.

All your data is compromised!

4. Conclusion

4.1 Risks

- Using a malicious DNS resolver can always compromise your privacy but your security will be unharmed as long as you look out for the https.

- Using a malicious DNS resolver and a malicious root certificate, your privacy and security are fully compromised.

4.2 Actions To Take

Do not ever install a 3rd party root certificate! There are very few exceptions why you would want to do so and none of them are applicable to general end users.

Do not fall for clever marketing that ensures "ad blocking", "military grade security", or something similar. There are methods of using DNS resolvers on their own to enhance your privacy but installing a 3rd party root certificate never makes sense. You are opening yourself up to extreme abuse.

5. Seeing It Live

5.1 WARNING

A friendly sysadmin provided a live demo so you can see for yourself in realtime. This is real.

DO NOT ENTER PRIVATE DATA!

REMOVE THE CERT AND DNS AFTERWARDS

If you do not know how to, don't install it in the first place. While we trust our friend you still wouldn't want to have the root certificate of a random and unknown 3rd party installed.

5.2 Live Demo

Here is the link: http://keweonbet.info.tm/

- Set the provided DNS resolver

- Install the provided root certificate

- Visit https://paypal.com and enter random login data

- Your data will show up on the website

6. Further Information

If you are interested in more technical details, let us know. If there is enough interest, we might write an article but, for now, the important part is sharing the basics so you can make an informed decision and not fall for marketing and straight up fraud. Feel free to suggest other topics that are important to you.

For more information/feedback/corrections visit our chat linked in the pinned post. (Search ID 0728e516cf2446e7b25af7622c26d8d + 5 in case you hid it.)

All content is licensed under CC BY-NC-SA 4.0. (Attribution-NonCommercial-ShareAlike 4.0 International https://creativecommons.org/licenses/by-nc-sa/4.0/)

- DNS resolvers send you an IP address when you send a domain name

- Certificates allow encrypting your communication and verify they have been generated for the domain you visit

- Root certificates verify that the certificate is legitimate and has been created by the real site operator

How can it be abused?

- A malicious DNS resolver can send you a wrong IP for the purpose of censorship as said before. They can also send you to a completely different site.

- This site can send you a fake certificate.

- A malicious root certificate can "verify" this fake certificate.

This site will look absolutely fine to you; it has https in the URL and, if you click it, it will say verified. All just like you learned, right? No!

It now receives all the communication you intended to send to the original. This bypasses the checks created to avoid it. You won't receive error messages, your browser won't complain.

All your data is compromised!

4. Conclusion

4.1 Risks

- Using a malicious DNS resolver can always compromise your privacy but your security will be unharmed as long as you look out for the https.

- Using a malicious DNS resolver and a malicious root certificate, your privacy and security are fully compromised.

4.2 Actions To Take

Do not ever install a 3rd party root certificate! There are very few exceptions why you would want to do so and none of them are applicable to general end users.

Do not fall for clever marketing that ensures "ad blocking", "military grade security", or something similar. There are methods of using DNS resolvers on their own to enhance your privacy but installing a 3rd party root certificate never makes sense. You are opening yourself up to extreme abuse.

5. Seeing It Live

5.1 WARNING

A friendly sysadmin provided a live demo so you can see for yourself in realtime. This is real.

DO NOT ENTER PRIVATE DATA!

REMOVE THE CERT AND DNS AFTERWARDS

If you do not know how to, don't install it in the first place. While we trust our friend you still wouldn't want to have the root certificate of a random and unknown 3rd party installed.

5.2 Live Demo

Here is the link: http://https-interception.info.tm

- Set the provided DNS resolver

- Install the provided root certificate

- Visit https://paypal.com and enter random login data

- Your data will show up on the website

6. Further Information

If you are interested in more technical details, let us know. If there is enough interest, we might write an article but, for now, the important part is sharing the basics so you can make an informed decision and not fall for marketing and straight up fraud. Feel free to suggest other topics that are important to you.

For more information/feedback/corrections visit just PM the poster here.

He activated Mail forwarding.

All content is licensed under CC BY-NC-SA 4.0. (Attribution-NonCommercial-ShareAlike 4.0 International https://creativecommons.org/licenses/by-nc-sa/4.0/)