Kuwait Data Bank

Introduction

 I've been pitching the idea of Kuwait National Datacenter to government officials and parliament members since 2017, in a holistic manner, covering migration of applications, learning center, audit requirements, security, ...etc. -- unfortunately, those efforts fell on deaf ears.

Fast forward to 2021, and I got the chance to work with a fantastic group of volunteers for Kuwait Foundation for  the Advancement of Science (KFAS) to create something more specific: Kuwait Data Bank -- an entity that would hold data from all of Kuwait's government entities and government-owned companies, to do Data Analytics and Data Science.

The group of volunteers comprised of multiple disciplines; experts in law, business management, organizational structure, information technology and security. A friend of mine & I were covering the information technology (IT) and security aspects.

KFAS gave us 1.5 months, that we extended to 2.5 months max to get the initial draft out, and we were done in Oct or Nov 2021. We're now in discussion with KFAS to see how to proceed & hopefully we get to see this project go live at some point!

Project Scope and Goals

We've checked regional and international open data projects, and almost all had very limited sets of samples of data, over inconsistent timespans, and sometimes one time shot kind of data only. Our project's aims are ambitious and exceed anything we've checked.

1. Initially, we'll focus on 1-5 critical reports to the Council of Ministers for decision making support.
2. Gradually, as we sanitize data, and find a source with the most truthful data (or combined sources), then we aim to make data pulling and reporting mainstream and real-time.
3. Data and reports will be available/accessible in this order:
1. Council of Ministers
2. Expand access slowly to government entities in need of help in accurate decision making
3. Universities in Kuwait
4. Public access inside of Kuwait
5. International access to data and/or reports or reporting services
4. Leverage latest technologies of graphics card acceleration and Massive Parallel Processing (MPP) databases in software (non-appliance) to keep things agile and portable.

Data Access & Analysis Methodology

1. Start slow with as few sources of data as possible to deliver the critical reports
2. Deploy data masking & replication connectors to the various databases at the sources
3. Anonymize data at the source, then replicate to our organization's repository/repositories
4. Sanitize data and compare accuracy with help from people at each data source, initally
5. Run Machine Learning models on highly parallelized data access databases
6. Produce reports or dashboards with results of multiple ML models and compare results
7. Initially, those reports will be private and delivered only to the Council of Ministers or KFAS, but gradually, the platform will expand to allow real-time access to reports, and then later, our anonymized data sources
8. Data access & reporting may be monetized to help the platform grow and become self-sustaining, in addition to providing services for companies to run analytics on their data, or using our data sets.
9. Legal aspects of data access, anonymization & privacy, and cooperation from government entities have been addressed in our report/proposal, but I'll not get into that here.

Privacy & Anonymity

1. A primary design aspect is to respect privacy and anonymize data at the source, before it's sent to our repositories/databases
2. Example: if we're to take everyone's full address, we'd remove the house number, but keep the area, and area's block number
3. If our systems get compromised, there will be no personally identifiable information (PII) that would cause personal risks
4. We believe that leaving the data masking (anonymization) in the hands of each government entity giving us access is probably the best approach, so that we will never be able to make changes to what data we receive, without manual intervention from the data sources (government entities)

There's a lot more to the project, but I'll stop here and then maybe revise things once we see how the project will move later.

It's an ambitious project, which is why we need to grow gradually and cater for specific needs that help the country's decision makers in making critical decisions and answering crucial questions, before making a decision.

Identity Validation Regardless of Message Source

There are cases when one needs to communicate securely with a specific person to ask for help or to share private information. In such cases, one's private account must never be used, and instead, a new anonymous ID must be created.

Scenario example: Person Alpha has published secure ways to be reached (PGP/GPG Public key to be used for emails, or a secure chat facility). You need to contact that person from an anonymous account.

Solution:

1. Create an ID for the intent of sending ONE message only.
2. This message must start or end with a hash.
3. The hash is an output of a text that you have randomly selected (old news article, historical event, ...etc.) that is not included in the same email, but instead, included in the next email exchange.
4. This way, the recipient is able to validate the sender's identity even if the sender used a different ID or email, simply by hashing the first/last paragraph to result in the same hash output of the previous email.

A source for the random text should not be anything that can be linked to you. Not your favorite song lyrics, name, birth date, ...etc. It must be RANDOM. A good example is an article, or a part of an article, from Wikipedia. Luckily, Wikipedia offers an option to get a random article: https://en.wikipedia.org/wiki/Special:Random

It's also a good idea to mix 2 sources of random text to avoid having an adversary pre-compute text (something someone with lots of compute power can easily do). Google's "I'm Feeling Lucky" button will take you to a random topic.

It is up to you to select the text, but make sure it's at least 1 paragraph, then use a STRONG 1-way hash function such as SHA512. Avoid weak functions such as CRC & MD5. It is also advisable to NOT use any online converters. Download a tool to do the hashing offline on your computer.

This method can also be used to publish posts on famous text dump sites, such as pastebin, without having to register an ID. People can verify that the next dump is legit by hashing the paragraph you define in your next post.

Example posts to pastebin verifying the authenticity of the poster:

Message 0:

======== begin SHA512 hash ========
07f0f838fe03b92682728e8b2164796ea53bfa8f9a11dd29f0057ab9ea8a222142819c3c9d40d170519977544d9b623d02099bdc0e25f1f6e739a34b065e2793
======== end SHA512 hash ========
I need help. I have secret docs that I need to publish and require you to do it on my behalf. I can't expose myself.

I'll send details from another account in a different email. Write "The weather is nice today" in your public Twitter account so that I know that you received this and agree.

The sender then sends another email from a different account (to avoid creating an association between sender & receiver).

Message 1:

======== begin SHA512 hash ========
dd5e53f533d6d740857249b215e0a49c61f221abc5c633d6cda141efad5a558426e9c943ef1015a2b468c6fc9289a302b6ef455459d19d6283a24612710894cc
======== end SHA512 hash ========

======== begin hash text ========
Vernon Reginald Pinkney (born May 27, 1955 in St. Louis, Missouri) is a former American football defensive back. He played five seasons in the National Football League, two with the Detroit Lions and three with the Baltimore Colts.[1] Pickney was drafted 166th overall in the 1977 NFL Draft after an All-Conference career at East Carolina University.

Under the rule of the House of Este, the city of Ferrara attracted great artists and scholars of the Italian Renaissance, and the city itself expanded according to Renaissance ideals of urban design.
======== end hash text ========

Here's the link to the Tor hidden service to download the documents: http://dx2oyt83zbdgc3uy.onion/.files/secrets.7z

When receiving and downloading the files successfully, put a hidden HTML tag in your blog/site that says 'I can has cheezburger'.

As you can see, the sender changes his email , and didn't have to provide a way to be contacted back. Some email services even allow you to set an expiration date on an email account & it gets auto deleted.

Additionally, the first block of hash text is for the NEXT email to be authenticated, if any. It's always a good idea to keep one in case you have to reach out to the person and to prevent any impersonation attempts.

Below the hash output is the text that should be hashed to get the hash output of the previous email (Message 0). This is how the receiver validates the sender's identity.

Recommendations:

1. Only email the person if s/he has a public key published, otherwise if you email in plaintext, you risk the email being intercepted & modified, rendering all future exchanges to be altered by an adversary.
2. If the person doesn't have a public key or an encrypted messaging option, ask them to do so using an anonymous account. Twitter, web-to-SMS, ...etc. Always use Tor to browse and create any anonymous/fake/temp account.
3. It's good practice to add spelling mistakes and random characters to the random text you chose, to further reduce the chance of it being pre-computed.
4. Use a new email/messaging account for each message you send. Many tools and adversaries online exist that can correlate between frequency of emails and possible people to monitor. By sending from multiple accounts, each one only once, you reduce the chance of being tracked or linked.

Be paranoid. Be safe.

HOWTO: Tor2Web on Debian

What is Tor2Web?

Tor2Web is an open source software that allows the general public to browse Tor hidden services, which are servers running anonymously behind the Tor network. These servers could be web servers, email servers or any other services, and are normally accessed only via the Tor software, but if for some reason you cannot install it, or need a quick look, tor2web provides this kind of easy access via standard web browsers.

Tor's hidden services (HSs) usually look like this http://sx3jvhfgzhw44p3x.onion (Wikileak's HS), but with tor2web, you can create a general public proxy where people enter the HS like this https://sx3jvhfgzhw44p3x.tor2web.org/ or bind your tor2web node to a specific HS (yours or someone else's) so that when someone accesses your tor2web domain name, it will only view your specific HS.

In all cases, Tor2Web cannot be used alone. You still need a 2nd node that has the HS running on it. This guide will not cover how to setup a HS. You can refer to Tor's guide for that. Never run both the HS & tor2web on the same node!

Why Use Tor2Web?

Tor2Web is part of a bigger project called GlobaLeaks, but one can use tor2web to provide access to banned/blocked material or provide services anonymously, not related to whistle-blowing, like an anonymous chat service. Taking down the tor2web node doesn't affect the HS & it's always easy to bring up a new tor2web node.

Another reason is to simply hide your stuff. With news of governments snooping on everyone and everything, one doesn't feel safe anymore. They could use anything against you at any point in the future. So, by running a HS, you can run your own email server or file server, and not worry about some law enforcement goons seizing your hardware and disrupting your work, even if you're collateral damage (like when Mega Upload servers were seized, many other websites were also affected).

Of course, one cannot attain full anonymity without taking all possible precautions such as registering the host/VPS/domain name using Tor to not be tracked to you, paying for the services using Bitcoins, and SSH into your system from behind Tor.

Requirements

1. Debian Squeeze (6) or Wheezy (7)
2. tor
3. python2.7
4. python-Twisted version 13.1.x
5. tor2web

tor2web v3.0 uses Python Twisted as a webserver rather than a standalone webserver like Nginx.

Note: This guide has slight differences from the Tor2Web guide. Feel free to refer to both and modify as you please.

1) Debian

Some Virtual Private Server (VPS) providers do not support Wheezy, but tor2web needs packages only available in Wheezy. You will have to install a lot of packages from Wheezy to be able to use python2.7 and its requirements, but you don't need to run a dist-upgrade. So, in the end, your distribution will still be Squeeze.

If you're already running Wheezy, then you can simply ignore the parts about adding Wheezy's specific repositories and removing them later.

1.1) Initial Sources

Modify the file /etc/apt/sources.lst with your favorite editor (vi, vim, emacs, nano, pico)

deb http://ftp.uk.debian.org/debian             squeeze main contrib non-free

deb http://ftp.uk.debian.org/debian-security    squeeze/updates main contrib non-free

deb http://ftp.uk.debian.org/debian-backports squeeze-backports main

deb http://ftp.uk.debian.org/debian-backports squeeze-backports-sloppy main

deb http://deb.torproject.org/torproject.org squeeze main

deb http://dl.bintray.com/globaleaks/deb /

Replace "squeeze" with "wheezy" if that's what you're running, but ignore the backports lines as you don't need them.

Your sources above could be from a different mirror for Debian's packages. Always use the closest mirror to your host.

1.2) Upgrading the box

You need to be root to run these commands, or have "sudo" installed with the correct privileges.

The last command will upgrade your host to the latest packages of your distribution. It's always good to stay up to date and avoid buggy packages.

sudo apt-get update

sudo apt-get upgrade

1.3) Add Wheezy repositories

Modify the file /etc/apt/sources.lst with your favorite editor (vi, vim, emacs, nano, pico) again, and add Wheezy repos

deb http://ftp.uk.debian.org/debian             wheezy main contrib non-free

deb http://ftp.uk.debian.org/debian-security    wheezy/updates main contrib non-free

2) Tor

Import Tor's keyring to authenticate the packages and install Tor.

Note: If you're running as root, or you don't have sudo installed, simply remove "sudo" from the 2nd command above.

sudo apt-get update

sudo apt-get install debian-keyring debian-archive-keyring

sudo apt-get update

gpg --keyserver keys.gnupg.net --recv 886DDD89

gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -

sudo apt-get install deb.torproject.org-keyring

sudo apt-get update

sudo apt-get install tor

Now you should have tor installed. You check the service status using: service tor status

3) Python

Check if you already have python installed and which version:

python --version

python2.7 --version

Now to install python and some of its fellow packages:

sudo apt-get install -t wheezy python2.7 python-pip python-dev wget ca-certificates

If you're running Squeeze, you'll be asked to also install glibc, and during the install you'll be asked to restart the services associated with it. If this is a fresh host, it's safe to say "Yes" if it's a production box with services running live, choose "No." This will also upgrade & install a lot of packages from Wheezy, as python-pip is dependent on them.

If you have multiple versions of python installed (2.6, 2.7 & 3.x), you'll need to change the default to 2.7:

update-alternatives --install /usr/bin/python python /usr/bin/python2.7 10

If you need to change the default later on, run this:

update-alternatives --config python

4) Tor2Web

First to grab the tor2web requirements and install them:

wget https://raw.github.com/globaleaks/GLBackend/master/requirements.txt

sudo pip install -r requirements.txt

sudo apt-get install tor2web

sudo service tor2web status

sudo service tor2web stop

Now that you have tor2web installed, and stopped, you need to create certificates for session encryption between the tor2web node and the user's browser.

when running the 2nd openssl command, make sure the Common Name (FQDN) is the same as the domain name that will be used to access the tor2web server. If you're planning to access it by IP, use the IP here.

The 3rd command will create a certificate valid for a year (365 days). If you want it to live longer, increase the number of days.

The last command will take a long time to generate the file. If your computer is faster than your host, run it on your computer then copy it there.

cd /home/tor2web/certs/

openssl genrsa -aes256 -out tor2web-key.pem 4096

openssl req -new -key tor2web-key.pem -out tor2web-csr.pem

openssl x509 -req -days 365 -in tor2web-csr.pem -signkey tor2web-key.pem -out tor2web-intermediate.pem

openssl dhparam -out tor2web-dh.pem 4096

Don't change the file names as tor2web is coded to use them as is.

The certificates created will require you to enter the password whenever you [re]start the tor2web service. This is good in case your server was hijacked & your certs were taken, they cannot be used unless someone knows the password (which shouldn't be the same as the root password!).

If you don't care, then you can create a certificate without a password:

openssl rsa -in tor2web-key.pem -out tor2web-key.pem.insecure

mv tor2web-key.pem tor2web-key.pem.secure

mv tor2web-key.pem.insecure  tor2web-key.pem

5) Configuring Tor and Tor2Web

Limit tor to the local host IP and prevent external connections, by modifying /etc/tor/torrc and add this line:

SocksPort 127.0.0.1:9050

Copy the example file into a new one:

cp /etc/tor2web.conf.example /etc/tor2web.conf

Modify /etc/tor2web.conf

nodename = whatever you want here. It can be the IP since it's unique

listen_ipv4 = IP of your VPS

listen_ipv6 = IP of your VPS, if you want to use IPv6

Change these to the IPs. If you don't want to bind by IPv6 or IPv4, comment the line out by adding a # sign at the beginning of the line. One of them must be present.

listen_port_http = 80

listen_port_https = 443

You cannot comment out http port, as tor2web will automatically redirect to https, but you can change the default ports.

basehost = this should be the root domain name (example.com not www.example.com or any subdomain, unless you happen to be running behind a subdomain). It can also be an IP. If you do not use the exact name/IP that the tor2web service will be accessed from, tor2web will not function.

Sockshost = 127.0.0.1

socksport = 9050

These should match the SocksPort config in /etc/tor/torrc file.

cipher_list = DHE-RSA-AES256-SHA

I do not trust the others, as DSS is not quite common and is only used by Microsoft for some reason, and RC4 can be misused at times.

mode = TRANSLATION

onion = hidden service name: name.onion (jntlesnev5o7zysa.onion - piratebay's HS)

blockcrawl = True

Using mode Translation means you'll bind tor2web to a specific hidden service defined in the onion option. If you want tor2web to function as a general proxy, leave the default options. The blockcrawl option blocks search engines.

I commented out the email notification options as I don't really care about notifications.

#mirror = ...

comment it out unless you happen to be running multiple tor2web nodes and want this one to list them in the banner.

6) Clean Up & Run the Services

If you're running Squeeze, remove the Wheezy main repo and only keep the security one to prevent upgrading the entire host to Wheezy.

Now run the tor2web service: (it will run tor for you)

service tor2web restart

You'll be asked to input the password of the certificate every time you [re]start the service, unless you have removed the password. Read the caution about it above.

It's always a good idea to NEVER ssh into your hidden service node using its real IP from your tor2web node. Should your tor2web node ever get seized or compromised, you do not want anyone looking at the logs or history to find the IP of your hidden service, as it won't hidden anymore.

7) Help

If you need my help setting up a HS, never contact me with your personal email and do not ask for help in the comments section. Create a fake email or use tormail.org. I don't want to know why you're setting it up or what kind of material you're hosting. The less I know, the better for the both of us.

You can ask anonymously on my blog about generic config or a problem you're having, but if you need specific help, send me an email with no details and then we'll agree on how to proceed.

8) Sources

• http://backports.debian.org/Instructions/
• https://github.com/globaleaks/Tor2web-3.0/wiki/Getting-started-with-Tor2web
• https://www.torproject.org/docs/debian