Carnivore Update

A reader writes: "Yahoo has a news item about the continued use of DCS-1000 AKA Carnivore. Looks like it's being used more than ever, and some privacy groups are still fighting in court for more disclosure about its use."

Comments

Carnivore

[CrazyDuke]

I don't have the link anymore. But, I would like to point out, assuming I remember correctly, that after 9/11 the FBI was actually bragging that carnivore keyword sniffs all traffic. This is despite all their pre-9/11 vehminent denials that the device did this. It was only supposed to pick up on email sent to and from people they where specifically watching.

I guess everyone is under investigation for possible crimes then, huh? :P

Re:Carnivore

[UM_Maverick]

Right, carnivore (in my understanding at least) does sniff all traffic, and stores it for a set period of time. However (and it's a big however), if the FBI wants to go in and read anything that's been sniffed, it needs to get a warrant. And the warrant doesn't say "we want to open the box"...it says "we want to open the box, and read only emails to person X from date y to date z"

And if you think it's easy to just hop in and get a warrant, I suggest you go read 'Black Mass' - it will shed some light on your misconceptions.

Re:my packets

[sphealey]

Speaking of Carnivore: for 3 months, just after September 11th. I noticed that all of my traffic was being routed through Arlington VA. This stopped about two months ago. Now my packets travel normally, (no Arlington node in every traceorute). Was that Carnivore?

Its possible, and something you might want to think about.

OTOH, a large percentage of the East Coast's Internet infrastructure was located in and around WTC, and much was destroyed and/or shut down. Different routes were certainly used while this stuff was under repair.

sPh

You're right...it means nothing.

[Surak]

You may not be familiar with SMTP servers like sendmail, postfix, etc. Mails that are sent from clients go into a queue. In the case of larger ISPs with many many users, the mail servers handle quite a bit of mail, so messages may sit in queue for longer.

The order that they are sent out of the queue in is determined by settings set by the administrator. Some SMTP servers are actually setup so that small-sized messages get priority over bigger messages. Since most e-mails are small, your larger messages with attachments may sit in the queue longer, waiting for a bunch of smaller messages to be sent.

This queueing depends on the mostly on the *senders* mail server. The receivers mail server will generally put messages from the receive queue into the users mailboxes in the order they came in, but not always.

Have your mail client display all headers...these show where the mail was along its route and typically have date/time stamps on them. This will help you determine where the hold up is (on the sender's mail server, on your mail server, etc.) Look for the length of time between timestamps. If one is unusually longer than the rest, that's where the hold up is. I'm not saying it's not Carnivore, but what you describe is a fairly common occurrence.

Want to buy a Carnivore?

[wirzcat]

Here are the folks that make it:
www.niksun.com

Carnivore is called NetDetector for commercial sales.
http://www.niksun.com/products/pdf_files/N etDetect or_Data_Sheet.pdf
About $20k, runs on BSD.

Jam with M-x spook

[Tom7]

I like to use emacs M-x spook to insert "keywords" in my emails. This must really piss off the Carnivore folks...

You can get my comprehensive spook.lines file at http://www-2.cs.cmu.edu/~tom7/spook/. They're included below for your terrorist-finding pleasure.

$400 million 1 October 15 May 1600 Pennsylvania Ave 17 November 3rd October 747 757 767 ACLU ADF AES AIDS AIIB AK-47 ALIR ANO ARD ARN ASALA ASG Abu Dis Abu Nidal Abu Sayyaf Aceh Merdeka Aden-Abyan Afghanistan Ahl-e-Hadees Air Force One Al Qaeda Al Quaida Al-Fatah Al-`Asifa Alamo Albanian Alex Boncayao Brigade Alliance of Eritrean National Force Alliance pour la resistance democratique Allied Democratic Forces American American Airlines Amn Araissi Arab Revolutionary Brigades Arab Revolutionary Council Arafat Area 51 Aum Shinrikyo Aum Supreme Truth Avtomat Kalasnikov BATF Babbar Khalsa Baghdad Berlin Bhinderanwala Tiger Force Black September Brigate Rosse CERT CIA CIRA CNDD CNRM CNRT Catholic Reaction Force Cessna China Chukaku-Ha Clinton Cocaine Communist Conseil Cuba DCS1000 DDoS DES DFLP DNA DXM Dal Khalsa Dayak Delta Airlines Delta Force Dev Sol Devrimci Sol DoS EFF ELF-RC ESSA EZLN Eastern Shan State Army Eiffel Tower Ejercito Popular Boricua Ejercito Popular Revolucionario Ellalan Force Eritrean Euzkadi Ta Askatasuna FALINA FALINTIL FALN FBI FMLN FRETILIN FROLINA FSF Farabundo Marti Fatah Force 17 Free Aceh Ft. Bragg Ft. Meade GHB GIA GRAPO George Bush George W Bush Gerakin Aceh Merdeka Grey Wolves H2O2 HAMAS Hague Conference Harakat ul-Ansar Hawari Hitler Hizb-i Wahdat Hizb-i-Islami Hizb-ul-Mujahideen Hizballah Hizbullah Honduras ICBM IIS 5.0 IRA IRA Ikhwan-ul-Mussalmin Interahamwe Iparretarrak Islamic Israel JKLF Jamaat ul-Fuqra Jamat-e-Islami Jamiat-e-Ahl-e-Hadees John Dillinger KGB KKK Kach Kahane Chai Kashmir Kennedy Khaddafi Khalistan Khmer Rouge Komala Kosovo Kurdish Kurdistan Kuwait LSD LSD LTTE La Cosa Nostra Lakshar-e-Taiba Lautaro Legion of Doom Lenin Les mongoles MAPU/L MD5 MDMA MI6 MILF MNLF Macheteros Macheteros Mafia Maktab al-Khidamat Mantis Manuel Rodriguez Marxist Maubere Resistance Mayfly Mayi-Mayi Middle-Core Mohajir Qaumi Mong Tai Morazanist Mossad Mothaidda Quami Mujahedin-e Khalq Myanmar NORAD NSA Navy Nazi Nellis Range Noriega North Korea Oklahoma City Ortega Osama Bin Laden PALIPEHUTU PCP PETN PGP PLO Pakistan Panama Pearl Harbor Peking Provos Qaddafi RC5 RDX RENAMO RSA Reno Rijndael Romania Rule Psix SCUBA SDI SEAL Team 6 SHA SWAT Saddam Hussein Saheed Khalsa Scientology Semtex Serbian Shora-e-Jehad Sivi Vukovi South Africa Soviet Steyr Students of the Engineer TATP TEMPEST THC TNT Tal Al Za'atar Talaa' al-Fateh Tamil Eelam Teamsters Terra Lliure Treasury Tupac Amaru U-235 UN US Airways Usama Bin Laden Uzi WTO Waco White House World Trade Center World Trade Organization Zapatistas airframe airport al-Gama'at al-Islamiyya al-Jihad al-Qa'ida algorithm amatol ambush ambush ammo ammunition anonymous anti-tank archives armada armor armor-piercing arms arrangements assassinate assassination assassination assault atomic bomb bank account biological blowfish bomb bomb boobytrap border broken arrow c4 camera carnivore carnivore charcoal chemical child pornography chinese class struggle claymore cocaine cockpit codebook colonel commando composition b conspiracy constitution cordite corporate corrupt council counter-intelligence crack-cocaine cracking cray credit card cryptographic czar d-day data haven defcon defenses democratie detcord detonate detonators dictionary disruption dissent divers doctrine domestic doomsday double agent e-bola echelon ecstasy efnet embassy embassy embassy empire encrypt enigma espionage explosion explosive face recognition faction fertilizer fissionable flight 800 football freedom freemasons fuselage genetic gold bullion government grenades gun gunpowder guns h-bomb hack harbor heroin hijack hostage hostages hydrogen bomb hydrogen peroxide illuminati impulse incendiaries infiltration infosec infrastructure initiators insurgent intel international internet internet worm interpol ireland jihad kamikazi kampuchea ketamine kibo kill kill kill kill launch codes lead azide lead styphante liberate liberation limousine lockpick loyalist main charge man-in-the-middle marijuana martyr massive DDoS maverick mercury fulminate mescaline microfiche microfilm minefield mines motorcade motorola mouvement munitions napalm nationalist negotiation negotiatior nitric acid nitrocellulose nuclear nuclear nukes olympics oppressed orthodox outlook express password picric acid pipe-bomb plague platter charge plutonium plutonium policy political pornography pre-teen president president primers private key propaganda psyops public key pulse detonation engine radar rail gun rebel remailer resistance revolucionario rijndael robotic rocket fuel rockets root-servers.net rubella salt peter sanctions satelliate satellite satellite phone secret secret key secret service secure security sequence shaped charge shoe bomb shotgun smallpox smuggle sniper sniper socialist space station special k spy steganography strategic submarine subsonic suicide suicide bombing suitcase suitcase nuke sulfur supercomputer supersonic surveillance tear gas teflon bullets terminate terrorism terrorist theater missile defense thermite thermonuclear timers triacetone triperoxide tunneling undercover undernet underwater united nations uranium violence virus virus warfare wargames warrant weapons white house white noise generator windows XP wiretap zenith