Slashdot Mirror


Carnivore In Living Color

joel jaeggli writes: "The Carnivore talk done by Marcus Thomas from the FBI at NANOG 20 is now online... you can retrieve it from: University of Oregon Videolab. This talk was meant for a technical audience, and the discussion and questions from the audience are very enlightening. Major thanks should go to the folks from Merit/NANOG for managing to schedule this talk, to Marcus Thomas and the FBI for their candor, and the NANOG crowd for asking the important questions."

18 of 100 comments (clear)

  1. Carnivore, et al., can be beaten. by Siqnal+11 · · Score: 3
    A simple IP-level auto-negotiating protocol would be enough to stop all passive sniffers, while a few people exchanging their keys using an external channel (physically or maybe via encrypted email) could detect any MITM attack (since a MITM relies in being able to change the keys being used, and it would be easy to check if they don't match). It could protect any protocol, including UDP-based protocols, unlike TLS which can only be used with TCP-based protocols.

    --

    --

    --
    You are a fucking moron.
    1. Re:Carnivore, et al., can be beaten. by Yardley · · Score: 4

      The FBI is putting a black box between you and the Internet via your ISP. What this means is that your communication passes through this box. The FBI is now the Gatekeeper for whether or not your communication gets out and whether others communication (including the whole wealth of information from the Internet) gets to you. They know what you are looking at, what you download, who you email, chat with, or talk to. They know everything that you do on the Internet. And now the FBI also gets to decide if it wants you to have a connection at all.

      Yes, people will say, no, that's not what the FBI is doing. They're just putting a black box in at every U.S. ISP so that they can monitor certain people's communications only after receiving a judges signature (by the way, in California the DEA has a deal under the law which allows them to no longer get a courts permission when phone tapping people accused of dealing drugs -- they can sign the warrants themselves). The FBI says they will use this technology sparingly. They say it's for our own good.

      Do we really need our Internet communications being monitored? I think not.

      I for one do not want a technology in place (at my taxpayer expense) which allows the government the ability to shut down the entire Internet at a moments thought.

      --

      --

      --
      He lives in a world where those who do not run the client software of the omnipresent meme are unacceptable.
    2. Re:Carnivore, et al., can be beaten. by Billy+Donahue · · Score: 2

      The party is more important than the man (we don't elect a dictator). Economic freedom is #1. Vote Republican.

      Is that the kind of thinking which Republicans for Bush are reduced to? My God that's pathetic. How about this: The people are more important than the party OR the man... Personal freedom is #1. Vote Green!

      --
      -- The Funk, The Whole Funk, And Nothing But The Funk
  2. Um, a video codec: by 2nd+Post! · · Score: 2

    Though the definition isn't something I can explain, it's an mpeg format.

    I sorta thought the context of the article made that pretty clear?

    <em>and multicast live in h.261, mpeg-1 and mpeg-2</em>

    Though I guess it isn't obvious.

    The nick is a joke! Really!

  3. [OT]: mirrors by Anonymous Coward · · Score: 2

    Why can't slashdot spend a little bit of VA's
    cash and get themselvs a good mirroring system/box?
    I think it would be a little more polite than
    foisting crowds of data-hungry slashdotters on
    an unsuspecting site.

  4. Re:A Crack in the Wall by Yardley · · Score: 3

    Carnivore is one part of the start of a very dangerous trend in the United States of America. It began with the War on Drugs, the middle and early eighties saw the start of routine unlawful search and seizure by government officials and the bribing of witnesses to imprison (often with life sentences) other individuals. Lately, government officials have decided that no communications by its citizens can go unobserved or unencumbered. Complete censorship of entire categories of speech is becoming routine through mandatory "filters" at school, in libraries, and soon at your computer. Now Carnivore. The end of private communications as we know it. Now the government will know that I am the one who wants you to know about what the government is doing & that I think it is wrong.

    --

    --

    --
    He lives in a world where those who do not run the client software of the omnipresent meme are unacceptable.
  5. Or by ArchieBunker · · Score: 2

    Use snail mail. Simple and tamper proof. Is that a christmas card to grandma or stealth bomber blueprints, you would never know.

    --
    Only the State obtains its revenue by coercion. - Murray Rothbard
  6. Carnivoring MPEGs by juliao · · Score: 3
    Living outside the US, I have still followed the Carnivore debate with interest, since a lot of my traffic does go through US-Govt-controlled networks.

    So the Government wants to have access to whatever "bad elements" send over the network. But will they ever be able to do it? This isn't voice we're talking about, this is data. Any "bad element" can encrypt it and make it unreadable by Govt officials in any useful timeframe.

    And the Govt knows this, so clearly this isn't their objective. So what is? Mass scanning of John Doe's traffic? Must be.
    Now let's look at their own site. An MPEG. How do you mass-scan MPEG files for BadThings(tm)? How do you mass-scan JPEGs? I'd like to know other people's view on this.

    1. Re:Carnivoring MPEGs by kfg · · Score: 2

      And this is precisely the point I've made before. The REALLY bad people will be using some form on encryption, and when the encryption is broken it will be a code, like: " The groceries came in, meet me at Joe's."

      The really, really SMART bad people will be even more sophisticated than that.

      No, Carnivore won't be used primarily against terrorists, any more than phone taps are now. Mostly it will be used against the average dumb Joe selling some pot or other contraban.

    2. Re:Carnivoring MPEGs by Goonie · · Score: 2
      So the Government wants to have access to whatever "bad elements" send over the network. But will they ever be able to do it? This isn't voice we're talking about, this is data. Any "bad element" can encrypt it and make it unreadable by Govt officials in any useful timeframe.

      Ever heard of traffic analysis? You can extract plenty of useful information out of monitoring encrypted messages.

      --

      Any sufficiently advanced technology is indistinguishable from a rigged demo
      --Andy Finkel (J. Klass?)
  7. this post is being monitored by Dr.+Tom · · Score: 2
    beep beep beep -- this HTTP link is being monitored by the FBI -- beep beep beep

    that'll slow those terrorist bombers down

    beep beep beep -- this HTTP link is being monitored by the FBI -- beep beep beep

    i wuzn't gonna say anything about my neighbor makin' hootch in his basement, anyway..

    beep beep beep -- don't even THINK about using encryption -- beep beep beep

    I'm startin' to get used to it already, fnord.

  8. Re:asdf by gunner800 · · Score: 2
    There is unlawful 'search' and seizure. I wonder how far the U.S. thinks it can bend our rights.

    Yes, and there is such thing as a search warrant. Many of them are even justified, based on probable cause. In such cases, the FBI needs the tools to get the right information.

    We should certainly worry that they are abusing their power, or that some black hat will subvert the technology. But you cannot expect them to do their jobs without access to modern tools.


    My mom is not a Karma whore!

  9. Mirrors? by discore · · Score: 2

    Well, I don't mean to be redundant or to flame VA for not mirroring things, but would some folks post a few mirrors? =)
    I tried to set one up but after 30 tries I still couldn't get onto the FTP. Hope someone else is having better luck!

  10. Mirror here... by MKalus · · Score: 2

    ....

    but please be nice, will ya:

    http://mirror.swma.net/carnivor/nanog-20-carnivo re-update.mpg

    If you blow the box I blow the file ;)

    Michael

    --
    If you want to e-mail me, use my PGP Key.
  11. What's the right right? by kfg · · Score: 3

    Most people are thinking of this as a first ammendment right, and it is in one sense, but the REAL right at issue here isn't the first ammendment, it's the fifth:

    You have the RIGHT not to give evidence against yourself.

    Prior to actual charges being filed you have the RIGHT to protect yourself in any way possible from intrusion into your affairs. You may encrypt, code, obfuscate, and outright destroy anything you want to, for any reason. It is your RIGHT to have it assumed that all such actions are innocent of any wrong doing. You have a RIGHT to be secure * against government intrusion * into your papers.

    Once charges have been actually filed you have the RIGHT to * shut the hell up. * This right to shut the hell up includes the right not to tell them your password, not to give them any key codes, the right not to tell them where you hid stuff, the right not to give a statement, the right not to utter one single blessed word. Speak ONLY to your lawyer.

    Use your rights. Encrypt everything. Your laundry list. Your cat's birthday. Your phone conversations. Everything. Use as much personal jargon that will be meaningless to anyone but the intended recipient, ( which could be noone but yourself), as possible. Learn to use steganography and encrypt and code things before you embed them. Use assorted DIFFERENT encryption and encoding techniques.

    Destroy everything that is of no more use to you. Don't just delete, destroy. Everytime you reinstall an operating system write 0's to the entire HD first. Eat memos. Just because you now have the power and the space to document your life in exquisite detail dosn't mean it's a good idea. Keep your house, real and virtual, squeaky clean. Throw away old phone bills. Throw away all financial records that current law, ( unconstitutionally), does not require you to retain. Throw away all reciepts except for those things that you WISH to be able to prove ownership of. When I say throw away I don't mean throw away or shred, I mean BURN.

    Use cash. They hate that. They're making it illegal by bits.

    If called before a grand jury or civil court where it is currently held that the fifth ammendment dosn't apply get a really, REALLY bad memory. Repeat after Reagan. " I don't recall, I don't recall, I don't recall."

    These are your rights, use them or lose them

  12. Search warrants by wowbagger · · Score: 2
    My question is, "What percentage of wiretap search warrants ever generate evidence that is used in a real criminal prosecution, and how has that percentage changed in recent times?"

    From what I've heard, the number of actual wiretaps is going up, while the number of times those wiretaps actually contribute to a prosecution is going down.

    In fairness to law enforcement, the mere fact that the number of wiretaps is going up is not in and of itself a bad sign, since the amount of communications is going up. However, one would hope that the ratio of (wiretaps that generate evidence used in a prosecution)/(wiretaps) would be holding constant or increasing. From what I've heard, the actual ratio is plummetting - the government is fishing more and more, and getting less and less for it.

    I believe that the government should be required to place a specified time limit on any wiretap warrant (time <= 6 months), and at the end of that time either
    1. prosecute a case and present the data from the wiretap, or
    2. go to the individual tapped, inform him of the tap, and present to him the data gathered in the tap (and destroy all other copies of the data).

    This would force the government to be more careful in selecting targets to tap. As it is now, if "Murry the Snitch" says I'm selling drugs (because he's on the hot spot and needs to give a name, any name, to the police), and they tap me for a few years and find nothing, then they quietly bury the data without so much as a by your leave. If they had to present to me the data so gathered, and the source of the information leading to the search warrant (does "the right to confront your accusor" ring a bell?), then I could (hell, would) bring suit against the the law enforcement agency involved as well as "Murry".

    Of course, this has about as much chance of being passed into law and enforced as freezing a pot of water by placing it on a hot stove.
  13. Transcript? by MobyDisk · · Score: 2

    MPEGs are cool, but does anyone know where I can find a transcript?

  14. Some points by QuMa · · Score: 2
    I'm writing this as I watch the mpg, a few points I've noticed:

    • I really love the fact that the average bandwidth has come so far that we can just send around 300M mpeg's of these things. YAY!
    • The FBI guy doesn't really seem that technically competent, for instance one of the slides mentioned not storing the "re:" and "subject:" lines... Hmm, did I miss an rfc? I don't recall the re: header... Also, he didn't know email addresses were case-insensitive, no biggie but you'd think someone close to carnivore would know that.
    • Pity they couldn't have gone a bit higher res, non of the computer screens where readable.
    • Does anybody know an mpeg-player for linux that shows a time-index in the controls (apart from mtv). Gtv is great, but only gives framenumber, which isn't even relative to the start of the mpeg but to the point where you started playing it.
    • For some reason he seemed to be trying to avoid the 'only gather addresses' mode because he thought there would be a lot of disagreement about how much it could gather. Isn't bringing that into the open the entire idea of this thingy?
    • a large part seems to consist of explaining how a packet filter works. Fun, but not what I wanted to see...
    • They've demonstrated how carnivore can filter to very specific rules, so not to collect anyone elses traffic. I haven't however heard how many of the court orders allowing carnivore use so far have specified any of these filters, or which ones....
    • All irrelevant data is discarded, and sealed and locked away. Why? Why not just log that data from from was discarded, and wipe it, giving better chances of privacy for those not involved?
    • In the demo they have a webinterface is used. This uses a form, which implies a cgi (could be javascript, but unlikely), which implies a webserver. That implies a webserver is running locally. Seems to be a) slightly overkill b) a security risk if the webserver is malconfigured, ie somebody could connect to it remotely.
    • On the public: This is a really cool bunch of geeks, I love em. I want to take em home...
    • As far as sniffers/parsers go, carnivore/coolminer seems pretty nice stuff. I want! Could the person who got into microsoft please nick this stuff from the fbi and put it on geocities? A port to linux/bsd (X11) would be nice too.
    • Hmm, there's one guy doing a feature-request. Weird. :-)
    • I really get the feeling the fbi guy is just saying what everybody wants to hear...
    • The mpeg just ends somewhere in the middle of a discussion. Very irritating. (It could be the end, but it doesn't look like it)