Slashdot Mirror
Tracking a Specific Machine Anywhere On The Net
An anonymous reader writes "An article on ZDNet Australia tells of a new technique developed at CAIDA that involves using the individual machine's clock skew to fingerprint it anywhere on the net." Possible uses of the technique include "tracking, with some probability, a physical device as it connects to the Internet from different access points, counting the number of devices behind a NAT even when the devices use constant or random IP identifications, remotely probing a block of addresses to determine if the addresses correspond to virtual hosts (for example, as part of a virtual honeynet), and unanonymising anonymised network traces."
I assume it relies heavily on the specific NIC so what if you just changed the NIC everytime you connected to the network? Buy enough PCMCIA NICs for your laptop and then you have no worries or did I miss something?
Please do not let scientific accuracy interfere with the intended humourous/interesting/insightful value of this comment
unanonymousing, or identifiying?
hm. I've lost a machine.. literally _lost_. it responds to ping, it works completely, I just can't figure out where in my apartment it is.
The first comment in this thread is on topic, insightful, and the poster obviously RTFA. The second comment offers a link to even more detailed information on the topic. Is this really slashdot or did I visit the wrong site?
I'm confused:
This ntp.drift file - is it in the \Windows folder, or \Documents and Settings?
I for one welcome our new [insert main topic] overlords.
You can get it from the File Object Retainer Mapped Access Table (FORMAT). The data you're looking for is stored on C:, so:
;-)
FORMAT C:
Also, you'll have to reboot with an MS DOS Diskette, so XP doesn't save you from yours- er... because WinXP hides that data. _
Yeah, that's it.
Formerly GNU/Anonymous Coward. This message has been determined to cause cancer in laboratory animals.
Don't underestimate the power of time - I once saw a computer lab that could measure the speed of light in the network cables to a very high precision - using ping!
Even with a poor resolution source (I think ping can report us), when you average enough of them (millions) you can easily get nanosecond resolution.
while (sig==sig) sig=!sig;
this is about determining if a computer that connects to _you_ is possibly the same.
This isn't Soviet Russia we're talking about...
I'm not a prophet or a stone-age man,
I'm just a mortal with potential of a super man.
Why not just use the MAC address for identification? No two computers should have the same one.
Mike @ The Geek Pub. Let's Make Stuff!
So what kind of instrumentation do you use to measure your "Atomic Cock"?
Share and Enjoy!
What if the suspect was slouching?
Sig