Would 2014 be another dark year for cybernauts?

"Everything you said on the internet might be soon used against you"
(photo from https://www.team-cymru.com/)

Internet security and privacy during the upcoming weeks might dive into disastrous repercussions :
Due to the solemnity of the recently discovered security loopholes (stated subsequently), 2014 is nominated to be the year of credential theft, online payment fraud and privacy violation.

Taking into consideration hackers' notorious motivations and skills: "not profiting from this occasion will go unforgivable"; By exploiting the discovered vulnerablities all together, internet security might face the darkest ages that internet itself will strive to disremember.

If you are too lazy reading technical stuff, you may directly jump down to the recommendations section.

History - One week ago:

A- Mar 3 2014 : Thomson, D-Link, TP-Link, Micronet, Tenda, and Zyxel routers (giant routers manufacturers for home and small business) have recently been targeted by a malware that modifies network configuration to forward traffic towards malicious servers.

The listed routers are continuously being hijacked in the ongoing attack - the malware is propagating via ISPs and XSRF (Cross Site Request Forgery) caused by a flaw in the firmware (Previously discussed here). That malware modifies the router's configuration at the DNS level and maliciously deviates traffic towards undesirable servers, resulting in data theft. (but some data is encrypted right ? so what ? jump to the next point)

B- Mar 4 2014 : Vulnerability in TLS that renders encrypted traffic decryptable by third parties

`goto CleanUP` is the new title of the critical bug discovered in GnuTLS library shared by most Linux/Unix based Operating Systems.
Knowing that GnuTLS is an open source library and its code was written in 2005, many eyes missed the bug for almost 10 years - not being exploited in the wild is out of all expectations.

Bonus 1 Feb 21 2014 : iOS Crypto Fail aka `goto fail`; a bug discovered in iOS code that helps attackers circumvent SSL encryption. It is safe to assume that it's been exploited in the wild.

Bonus 2 : Whatsapp Crypto Fail - Whatsapp uses RC4 encryption algorithm for data transit since decided to encrypt in August 2012, it also uses the same RC4 encryption key for incoming and outgoing streams. This is sad since Whatsapp is one of the most used mobile/internet messaging applications - if haven't yet, consider all your previous conversations compromised and refrain sending confidential information via this medium - Replace Whatsapp by Telegram, TextSecure or CryptoCat for Mobile (recently released for iOS) for their support for `strong 2nd layer of encryption` besides SSL/TLS.

A bit of math A + B = ?

Hackers are forwarding your encrypted traffic to their servers

Encrypted traffic can be cracked

---------------------------------------------------------------------------------------------------

= Your private data in hackers' hands [credentials, your e-banking accounts, your mobile banking accounts, etc, etc, etc, etc, etc, etc ...]

Attack anatomy:

What to do ?

In order to mitigate and minimize the stated risk below are some recommedations:

Install DD-WRT on your router: DD-WRT an open source third-party firmware, opensource means less risks since code is securely reviewed by the community. DD-WRT is designed to replace the original firmware on some commercial routers. Alternative firmware may offer features and functionality sets that differ from the original firmware it is replacing. (As an alternative, Buffalo Wifi router offers DD-WRT firmware off-the-shelf)
If Point#1 wasn't possible, change all your passwords - use different strong ones for each account, don't reuse old and new ones.
Update your router firmware to the latest version - change the administrator default password and disable default existing users for telnet such as `user/user'.
Sadly, lots of ISPs lock down their routers preventing you from 'fixing' or 'reconfiguring' - contact them asking for security upgrades or take your router back by force hacking it by yourself yourself (do it at your own risk!)
Back up your blog and websites. Do it on encrypted channels such as SSL/TLS (weak-encryption is better than no-encryption after all). Keep a local copy for your backup files.
Refrain from using FTP to your server - replace it by sFTP or FTPs - change your old ftp passwords.
Try as much as possible to use applications that support 2nd layer of encryption.
Stop using Whatsapp, replace it by Telegram, TextSecure or CryptoCat for Mobile (recently released for iOS and soon for Android) - the stated mobile apps support `strong 2nd layer of encryption` besides SSL/TLS.
Keep your operating systems up to date by enabling `security` automatic updates.
Always monitor your DNS configuration at the router level.
Use web antivirus that scans your browser's transiting data for attacks such as XSS and XSRF.

Generic Closure:

SSL is being phased out for known weaknesses and TLS is there to replace it. Gerenerally, we got used to having a backup service each and every time a well known and relied-on service gets compromized, this time and considering all over the world monitoring systems, I find internet stuck - security is a double edged sword. We always tend to top-up and patch our existing ideas for improvement, but `problems cannot be solved at the same level of thinking that created them` - it's time to think different, maybe encrypting on a different level? maybe moving the internet to different medium? Internet 2.0 ? an alternative for internet ? "Alternet" seems an nice fictional idea, we all tend to believe in beautiful thoughts that make us `feel` secure.

Very interesting and possibly related links:

Growing exploitation of small office routers creating serious risks <--- A MUST READ !
Reference for GnuTLS patch (for system and security administrators)
Downloading SSH client safely is almost impossible
A crypto challenge for Telegram developpers
Should we all have something to hide?
GNU security library GnuTLS fails on cert checks: Patch now
iOS goto fail
Crytpoweakness in Whatsapp
Hackers hijack 300,000-plus wireless routers, make malicious changes
Python interface for WhatsApp