Slashdot Mirror
Darknets Coming Soon?
Anonymous Stalwart writes "CIO.com is running a story on darknets and their implications for security. With the ruling against Grokster, darknets seem poised to become a reality. How this will impact the future of the workplace, from top-level IT/IS managers all the way to non-IT jobs will depend on how the tech community that is developing this technology treats it."
Shouldn't the first sign "something" is up be an increase in bandwidth?
Once you know its happening, you know you have to identify the problem.
Unless somebody can root all the routers and IDS systems for every OS along the way, these darknets will always be detectable.
liqbase
The "Grokster" ruling says that network operators can be liable for users illegal network abuse when operators promote abuse. It's a stupid ruling, but limited. And its standards for proving promotion are unfounded, really allowing just "appreciation" of abuse, without any evidence of public promotion. But operators which do not include even internal organizational acceptance of abuse, which promote only legal use, which offer even minimal protections of abuse, rather than any internal corporate policies which rely on the abuse, are not threatened. The sloppy evidential and jurisprudential standards in that landmark ruling will make it much more expensive for legit operators to remain safe, as they're sued willy-nilly by vengeful media corporations. But the mass media story that "P2P is now illegal" ought to get no promotion on geek sites like Slashdot. If you're going to run a darknet, why not just leave out the abuse promotion, and let your P2P flag fly?
--
make install -not war
by prosecuting unencrypted networks like eDonkey, bittorrent, etc. they're only enforcing users to search for encrypted ways to transmit data. And I don't think encouraging encryption is gonna be any good for national security.
Just a thought.
Well, only 3 comments posted, and the link is already hosed.
As reported by Darknet dot com, a darknet is nothing more than a place where illegal communication (filesharing/hacking talk/speaking badly of the US president) can take place.
I don't see how darknets will make things any different. For years we've had gopher, IRC and other communication channels that have been below the vision of the management elite.
I think lawyers are starting to learn that techies can't be bullied as easily as most, because techies are able to build new infrastructures. Instead of giving up, techies take threats as a challenge or motivation to dive further and further away from public vision.
What are you eating? isItVeg?.
WOW! The media has discovered VPN's
If religous zealots don't believe in Evolution, then why are they so worried about bird flu?
A Darknet is a private virtual network where users only connect to people they trust. That's it. It can be used for good or evil.
That was a short, almost pointless article. Basically amounted to "use standard security practices."
I found this article about "darknets" that I found informative, even though it's a book ad.
Xbox reviews.. We think they're funny.
http://www.cio.com.nyud.net:8090/archive/110105/tl _filesharing.html
---
FILE SHARING
Spies in the Server Closet
BY MICHAEL JACKMAN
The Supreme Court might have stirred up a bigger problem than it settled when it ruled last June that file-sharing networks such as Grokster could be sued if their members pirated copyrighted digital music and video.
Since then, some programmers have announced they would pursue so-called darknets. These private, invitation-only networks can be invisible to even state-of-the-art sleuthing. And although they're attractive as a way to get around the entertainment industry's zeal in prosecuting digital piracy, they could also create a new channel for corporate espionage, says Eric Cole, chief scientist for Lockheed Martin Information Technology.
Cole defines a darknet as a group of individuals who have a covert, dispersed communication channel. While file-sharing networks such as Grokster and even VPNs use public networks to exchange information, with a darknet, he says, "you don't know it's there in the first place."
All an employee has to do to set one up is install file-sharing software written for darknets and invite someone on the outside to join, thus creating a private connection that's unlikely to be detected. "The Internet is so vast, porous and complex, it's easy to set up underground networks that are almost impossible to find and take down," says Cole.
He advises that the best--and perhaps only--defense against darknets is a combination of network security best practices (such as firewalls, intrusion detection systems and intrusion prevention systems) and keeping intellectual property under lock and key. In addition, he says, companies should enact a security policy called "least privilege," which means users are given the least amount of access they need to do their jobs. "Usually if a darknet is set up it's because an individual has too much access," Cole says.
---
What the heck is a darknet?
The first rule of the darknet is that you never talk about the darknet!
For those that are asking, a darknet is used in this context as a closed P2P system (i.e. you, your mates, your mates' mates and others by invitation only sharing what you have with each other over the internet).
Reminds me of something me and my brother used to do. We wanted to play a game online over the Internet but didn't want to sign up to yet-another online gaming service (The Zone or something it was called). We both had legit copies of the game, we both had internet connections and we just wanted to play online against each other. We couldn't do a straight TCP/IP connection for some reason or another so the only options left in the software were LAN, Modem or this Zone thing.
So what we did was set up PPTP between our routers, assigned nearby IP addresses on both sides that routed across the connection and played a "LAN" game over the Internet. As far as I can see this was a type of darknet if you like.
If we'd had non-legit copies, many games of the era would let you plan LAN without the CD so long as one player had the CD but not across the Internet. Or, say we'd cracked or VirtualCD'd the CD so that neither of us had a legit copy but could still play online. Then this sort of "PPTP darknet" would be used to let groups of friends without the legit CD to play over the Internet without needing the authorisation or intervention of the person running the gaming servers.
A further thought, bringing it up to the modern day, would suggest that things like Steam could be played over this sort of "PPTP darknet" as a LAN game (connecting to PC's spread over the internet, all disconnected from the "real" internet and bypassing restrictions on who / what is allowed to play)?
It's a interesting idea, sort of like a hidden black market for the internet (which I'm assuming is where the name comes from). As companies crack down on people lending movies to their friends and similar other quite legitimate activities, things like this are going to appear, translated from the real world where this happens all the time to the Internet.
It seems to me that these sorts of things have existed for a while, though. I've heard that things like paedophile rings are already using such tactics? Detection is much, much harder than for a centrally administered P2P network. The only way to detect is to infiltrate the network itself, which is basically social engineering?
You can't teach the RIAA anything. They think they can stop P2P file sharing but the truth is all their legal efforts are driving it underground...where it was before Napster appeared.
There are a lot of very talented techies out there who can come up with some astonishing new tech. A fully encrypted P2P service that masks a user's IP address would make it hard for "the man" to find those who are illegally filesharing. Also, the hacker community can adapt to changing situations faster than any corporation. This is because they aren't hindered by office politics, ethics, patant and copyright compliance and legal compliance. They operate above the law, so it was really no surprise to me when Slashdot ran the story of the trojan that exploited the cloaking ability of Sony's DRM.
I wasn't surprised one bit.
Because of Grokster and others the RIAA bring down a new, bigger, and better P2P service will emerge with multiple layers of custom encryption, IP address masking, and no central server that can be distrupted. You could even block ports at the ISP level and they'll adapt again to support multiple ports at once. Its a loosing battle they just don't get it yet.
Why do you think Internet Security and Antivirus Industies are racking in so much money these days. They DON'T want to see the hacker put in jail because if all the security threats cease and no more viruses are being made they are all out of a job. It a multi-billion dollar industry.
The RIAA is utter and completely out of their league.
Michael "TheZorch" Haney
thezorch@gmail.com
http://thezorch.googlepages.com/home
Hell, they'll probably set up a few darknets of their own, as "loss leaders" in their quest to fuck as many people out of as much money as possible. And they'll start a terror campaign, too. Did I say terror? I meant public relations. As in "The Guy You're Sharing Files With Might Be A Cop."
This is not my sandwich.
From TFA:
... And although [darknets are] attractive as a way to get around the entertainment industry's zeal in prosecuting digital piracy, they could also create a new channel for corporate espionage''
``The Supreme Court might have stirred up a bigger problem than it settled when it ruled last June that file-sharing networks such as Grokster could be sued if their members pirated copyrighted digital music and video.
Since then, some programmers have announced they would pursue so-called darknets.
Am I the only one who thinks that if darknets are attractive vehicles for corporate espionage, they would be built no matter what the Supreme Court rules on filesharing?
Please correct me if I got my facts wrong.
One definition is an encrypted protocol over the Internet. The other definition is using wireless technologies off the Internet. Oddly, the person quoted in the CIO article was trying to claim that encrypted, closed file sharing over the Internet was nothing like a VPN. That makes no sense to me, especially given the other definition of a darknet (the wireless one off the Internet) really is nothing like a VPN.
A wireless-off-the-Internet darknet could serve Thomas Paine purposes if the U.S. government ever shuts down the Internet in response to a terrorist attack. An encrypted, closed information sharing network on the Internet could not.
I'm talking about snailmail. If it gets right down to it you can fall back to this time honored completely private way of transporting any files you wish to share. It also has the advantage of carrying a federal criminal violation against anyone who attempts to stop your mail. If things gat so bad in this country that even this becomes too troublesome we can all move to eastern europe or china as they will become the beacons of freedom much as our country used to be.
Gnunet is here and working. Fully usable as a P2P network, not as fast as unencrypted but close. I haven't tried using it in pure friend-to-friend mode but the functionality is there. And of course it has all the things you'd expect from an advanced P2P network, searches for automatically extracted keywords, signed namespaces where you can publish content anonymously but show that it's all from you, directories, etc.
I am trolling
Actually, If you establish the DarkNet in the right way, once you are connected to a trusted node you could connect to any other node by passing authentication and encryption keys the long way. This would allow for dynamic (re)routing.
Think of an IRC style web. Basically, a properly designed network would allow one party to inform another that it wanted to make a connection. Then it would make that connection. By pre-passing the keys and proof of identity, you would be able to make arbitrary connections within a "closed surface" of the net.
===
What I have been waiting to see make a comeback is the good old fashioned POTS modem. With all the internet wire-tap laws being generally weaker than the phone tapping laws, it would _really_ make sense to transfer authentications (etc) through a old-fashioned BBS style "drop sites" that were not really on the net.
So you downloaded some particular binary splash. To turn it into the song or whatever you would have to go get the key/completion-tidbit. Heck, the actual directores could be encoded so you _couldn't_ know what you were passing unless you were also in on the sideband/drop-site.
Innocent people shouldn't be forced to pay for inferior software development.
--"Code Complete" Microsoft Press
there was a wired article on this very topic several months ago.
[Fuck Beta]
o0t!
HOST1: ping -c 1 -p facedead12349876 host2
PATTERN: 0xfacedead12349876
HOST2: tcpdump -x ip proto \\icmp and src host host1 .R....EP$-...lwC
.4.v.....4.v....
.4.v.....4.v....
11:41:51.646216 IP host1 > host2: icmp 64: echo request seq 0
0x0000: 4500 0054 0000 4000 4001 1af7 8752 0886 E..T..@.@....R..
0x0010: 8752 0888 0800 4550 242d 0000 cf6c 7743
0x0020: 25e5 0900 face dead 1234 9876 face dead %........4.v....
0x0030: 1234 9876 face dead 1234 9876 face dead
0x0040: 1234 9876 face dead 1234 9876 face dead
0x0050: 1234
Sure, you'll see a lot of icmp traffic, but odds are most network folks won't considering the pad data in a ping to be payload.
It's like the old ppp over email implementations. Connectivity means data transfer. If some journalist or newbie network admin thinks otherwise, then it's just that much easier.
Can You Say Linux? I Knew That You Could.
Whatever devices are between the nics (no crossover cable) leave an opportunity to see whatever traffic is going between them. Even ntop will tell you what types of traffic it's seeing - not to mention if you are inside a bunch of hubs. 'Darknet' sounds spectacular, but it just comes down to another stupid protocol running on a non-standard port. If you're lucky, your best luck is to invent your own protocol, encrypt it, and don't share the source with anyone. Good luck getting anyone to trust you though.
Join the Slashcott! Feb 10 thru Feb 17!
That group has lists of what they have rather than the items themselves, so it's fairly easy to check for particular files. Sometimes they'll collaborate on new movies coming out. You bought Batman last month, we'll buy Mr. & Mrs. Smith next month. Maybe one of them has a coupon or gets a copy from a neighbor. And so on. They IM back and forth, but never the FTP address which everyone already knows.
It's not exactly a darknet but the principle is similar. Trusted users, encrypted files. If corporate snoops were going to try and catch that group they'd have to hack their way on to an FTP server, pull files pretty much at random then spend days trying to crack the PGP wrapper. Good luck with that. You might be surprised at how much material five or six different families actually have. Movies, music the differing tastes produce quite a wide selection. They save hundreds, maybe thousands a year and the risk is pretty minimal. And there's no special clients required, just a copy of PGP tools. If that group were 10 people or families instead of five, imagine how much more material would be available?
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
Try monitoring a campus network where you have several thousand users and an obscenely large amount of bandwidth. Oh, and you have live research data being generated on campus and moved to places like the NCSA etc... Bandwidth consumption may vary by tens of megabytes by the minute. So I ask you, in that situation (which I work in) what is an "increase in bandwidth" a sign of?
;)
Effective monitoring is actually quite achievable with freely avalible software.
On a properly managed network you should be able to tell exactly who is using how much traffic and what type of traffic (and where it's coming in and out from) and to spot suspicious changes in usuage patterns, with historical data avalible in a format appropriate for a quick visual comparison. All of this should be fed in to your monitoring platform with alerts raised once set thresholds are reached.
In practice though, it's usually not cost effective to actually clamp down on misuse of bandwith and it's more prudent to let it slide (and/or go for the low hanging fruit if spot anyone taking the mickey) and just pickup the tab afterwords.
(Disclaimer: The next part of this post drifts away from this specific thread
I'm not sure why so many people imagine monitoring traffic by source and type is difficult and that they can't be spotted and rate limited on a per user basis, in an entirely automated fashion.
Using tools like jflow and cflowd (and various other commerical purpose built tools) to do detailed traffic profiling, and to a limited extent shaping, is something a few carriers and large providers do already. Even if your provider doesn't do this, there is a really good chance their transit providers do it.
At the moment, the majority of providers mark P2P traffic as the lowest priority for QoS purposes as it is, because (a) it's so all consuming and disproportionately resource intensive (compared to far more common tasks like legitimate HTTP traffic and FTP data transfer) and (b) it's hard to complain about slow transfer speeds of what is almost certainly Warez between you and an anonymous DSL/Cable subscriber in another state/country. This is partly why P2P transfer rates can be very crummy (the other major reason being of course the limited upstreams of most users).
Once you have profiling data for a given port or IP on your network, all you need to do is send a trigger to the switch/router/DSLAM/etc. to either trottle the traffic for that port on the TCP/UDP ports required (as the hardware permits - ideally on a per-TCP/UPD-port basis), or - if your feeling adventurous (or your hardware is crummy) - dynamically re-route traffic for that destination seperately, though a series of systems that are capeable of enforcing very fine grained QoS controls (on appropriate hardware, the 2.6 kernel with iptables and some appropriate modules is actually capeable of impressive work in this area).
If users start tunneling large amounts of traffic down other ports (and disguising it as as regular HTTP, SSH, HTTPS, etc. traffic) then it's going to be really obvious to spot using automated software, and those those users will find that providers will just impliment systems to nobble that specific type of traffic on their connection while they persist in doing that, and if they want unnobbled connection, they'll have to pay a real premium to compensate. It's also entirely possible providers will start enforcing QoS based on destination too, so that transfers to systems that are common P2P traffic destinations are effectively crippled (and traffic to network ranges used by Cable/DSL/College dorms/etc. could even be rated by default).
If any users imagine they can 'sneak around' by tunneling P2P traffic and making it look like encrypted VoIP traffic (and warzing to their hearts content at the expense of the rest of legitimate users) they are in for a big shock. They are going to find that suddently their VoIP traffic starts having specific (weekly/monthly) transfer limi
doesn't public access go against the definition of a dark net?
If you are doing traffic on our network that I need to know what it is, I'll go to your computer and check. In a managed environment, like a corperation, you don't have privacy of your data. You can encrypt traffic, and should (we fight all the time to get the last few telnet users to switch to SSH) but that's to keep random malicious users out, not your IT staff. Your IT staff can come and ask to see what's happening on your computer and "no" isn't a legit answer, as the computer is company property.
I personally don't see any problems with Darknets that didn't already exist with SSH. If I work in an environment where we don't care what you do, unless it's a problem, then we'll ignore your traffic unless it's excessive. If I work in an environment where we restrict what you can do, then we'll monitor your traffic and if we see unknown encrypted traffic, you'll be asked what it was and your computer will be checked.
So I see Darknets as a problem for the RIAA maybe, and frankly I don't give a shit about them, but not for corperate IT.
Darknets are just the latest "OH MY GOD WE MUST ALL FEAR" line the computer industry is going to use to field a "solution" (probably some kind of sniffer for corporations, which tries to detect traffic which it cannot categorize and produces reports for suits).
Say it with me: darknets have always been here, and they will always be.
Hackers have IRC and other invite-only forums, and all the ways in which they've used them to secretly pass information around without the squares being in on it. P2P networks are darknets (for YOU, anyway) if you don't have software which uses the protocols and don't know anyone who knows about them. ANY new network protocol can be a darknet. You can roll your own anytime you want.
Darknets are the modern equivalent of the Captain Midnight Secret Decoder Ring. They are NOT the Beginning Of The Fall Of Civilization(tm).
Don't believe me? Fine. Be that way. Try this fun experiment:
Write yourself a Java suite that:
CLIENT SIDE:
1. Briefly touches a server, downloads the current list of IP addresses that have announced themselves to the server, announces ITSELF to the server, and then logs off. The server IP is probably best implemented as one of a list of possible server sites, so that if one is compromised (doesn't give the correct handshake or whatever) you just move on to the next one. All communication should be encrypted using the server's public key and YOUR public key (RSA between the two points, or whatever is fashionable in your circle of friends).
2. Lets you compose messages, or file transfers, or whatever, destined for whatever IP address you want to communicate with, again encrypted with both public keys. Maybe you even compress the data first, to reduce bandwidth usage.
3. Lets you "blackball" any IP address you think is compromised. You could implement this as "My PC Only" or as a common blackball pool, which everyone could vote on, or as a common blackball pool which people could consider provisional and accept or not accept.
SERVER SIDE:
1. Manage lists of IP addresses and their status.
2. Provide a handshake which is meant to test whether your software is authentic and you are in fact an approved node. If you're not, you get sucked into a honeypot and studied. You are NOT given an actual IP address list; rather you are given a fake list full of false leads.
3. Allow certain admins to control the system to some extent, ousting problematic members (bans) and so forth. This could alternately be implemented on the client side, with a voting scheme, or whatever.
Bam. Instant darknet. And it's a piece of cake for anyone who's passed the junior-level networking course at any public university. THINK about it -- why do you think anyone studies computer science these days? It sure ain't to find a job... People study computer science to build themselves cool, weird things that stiff, stick-up-their-ass types don't approve of.
Deal, people. The world is not all simple and sparkly, like an amusement park. We are all grown-ups, and we can do grown up things even if it frightens The Man(tm). And, really, computer science is the closest thing any of us gets to wielding supernatural power. Us geeks can do things NOBODY else can do. Why not do them? Why be a boring square if you don't have to? Build something freaky, get yourself one of those weird, off-kilter cover photos in Wired that makes you look like Dr. Evil. Why not? You weren't put on this earth to make Sheeple feel comfy and warm. Fuck 'em.
Farewell! It's been a fine buncha years!
At which point, you either have a) no scalability (all must trust all) or b) no trust, which negates the entire point of the darknet
/arbitrary
Recognizing that there is no such thing as an entirely trustworthy network (unless you know and implicitly trust each individual involved, and their security) couldn't you just implement a scalable trust level? By this I mean limiting the number of hops, or degrees of separation from who you implicitly trust (your 'friends'), to who they implicitly trust, and so on to the unknown computer. In this way you could come to a trade off between data available, and the level of insecurity you consider acceptable. In the case of highly sought after information we would see a trickle-down sort of effect... There are lots of possible variations on this theme.
How would the degree of trust-separation be tracked? I am not entirely sure, but perhaps a public key encryption of each individual's friends list could work. Files searched for in levels - first your friends, then their friends, etc until the file is found or the security limit reached?
Sorry, but if you're using the same network and infrastructure as the rest of us then those connections can be monitored, your endpoints mapped, and your packets and traffic patterns analyzed.
I'm quite sure, however, that the NSA appreciates your spreading your "totally secure" viewpoint around...
Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
W.A.S.T.E.