Slashdot Mirror
FBI and Next-Gen P2P Monitoring
AHuxley writes "Can the FBI get funding to create a next-generation network monitoring and database system for P2P networks, web sites, and chat rooms?
Could the FBI's Regional Information Sharing Systems (RISS) network be opened to more law enforcement agents across the USA?
Will the tracking of p2p users via 'unique serial numbers' generated from a person's computer be expanded from its first use in late 2005?
Is your p2p application or plug-in sending back your MAC address, firmware revision, manufacture date, GUID or other details?" Could this story submitter pose any more questions in his submission? Won't someone please think of the ... oh, never mind.
It's not the people who are slow. Their comments are just tied up in the RISS awaiting gov approval.
australian project gutenberg is better than the original.
Seriously though, how difficult is it to use the slashdot search engine with the capitalized words in the title? third hit...
Riiiight...
This is one hell of a slippery slope, my friends.
will wonder why all the files have Joe Biden in the filename.
sudo macchanger -r
I'm no computer scientist but isn't it fairly trivial for them to get your mac (or at least that of your router) from your network traffic anyway?
IranAir Flight 655 never forget!
In the olden days, when I was a kid, we happened into dealing with the F.B.I. Subsequently, I know to engage a large supply of salt anytime I read about any investigation that has been tainted by their crime lab. Think of the children and send more money. Yeah. Knowing their proclivity to abuse/disregard the law, I don't really see the upside to this.
The cost of that cleanup, of course, will be borne by taxpayers, not industry.
Heavy on fear, but light on facts... And with so many popular torrent programs open source, all of the sneakiness is no longer possible. No magic serial, or mac address in my torrent program. Oh, and it is encrypted.
"Is your p2p application or plug in sending back your MAC address, firmware revision, manufacture date, GUID or other details?"
Good fear. I wonder how often people review the code of even the F/OSS applications to make sure they're not doing this kind of stuff. And I wonder how often people check if binary distros executables match the source they supposedly come with.
I suspect every country's NSA-equivalent or other intelligence agency in the world probably has employees trying to put back doors in every major piece of software (think one intentional security bug in every country Microsoft employees engineers - that could explain why it stays so buggy). It'd be really interesting to know the various Linux distro's review practices to insure that the binary installers match the source and that the source is clean.
*ducks*
If the FBI really wants your MAC address, they can do it the old fashioned way:
Get a warrant to tap the ISP they think you are at and a warrant for your billing information, listen in for awhile to make sure you aren't being joe-jobbed or pwned/bounced-off-of, then raid your house and seize all your computers and routers.
Your MAC address will be somewhere in that pile of equipment.
My MAC address is Oak Brook, IL 60523.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Go on, take down my MAC address, 1. I'm in Canada, we don't serve your DCMA'ing kind here. 2. My router changes MAC addresses routinely, I made that change a long time ago.
-Ours is the wisdom of Solomon, the magic of Merlyn, the fall of Icaris.
Maybe if they do start monitoring all that traffic, people will get a clue and start using Tor for all their internet traffic. Especially their plaintext passwords. Dangerous business, letting the FBI know where those plaintext passwords are going. Better encrypt them with Tor!
Anyone wonder how many exit nodes the NSA already runs? That'd be a far better(easier?) approach than monitoring "normal" traffic since I suppose the interesting stuff is already going through Tor, though in a typical hour-long scan I can't find any really "interesting" unencrypted web traffic at my exit node.
Folks surfing porn? Plenty. Plenty of Chinese blogs with plaintext passwords, too. But even those Chinese blogs are benign and not something that would be censored by their gov't (I think). Based on the pictures and my basic proficiency with Chinese, it's either folks just fooling around with Tor or it's steganographic.
AHuxley:
Yes
Yes
Yes
Yes
CmdrTaco:
Yes
Hope that helps everyone.
This guy's the limit!
so wait, just because i renamed the video of a dog dropping a wicked deuce, eating it and then throwing up to "britney sex spears sex farm sex grandma sex pedo sex shower sex pee sex petite sex fat sex anal sex poop.avi" and shared it with emule...canada might be on to my computers serial number, now?!
OMGAH HOW DO I ERASE MY COMPUTERS SERIAL NUMBERS?!
lol...
...since the chinese for example already do it.
I guess the slogan 'land of the free' means that the government is free to spy on people...
How unique is a MAC address? Can't a given manufacturer reuse old addresses since they only need to be unique within the local network?
I am not a number - I am a free man!
Closed source applications from companies like M$ can't be trusted in this way.
The last time the FBI tried to build a large piece of custom software, a case-file management system, they ended up spending 170 MILLION dollars over 3+ years for software which basically did nothing useful (a complete failure). The only way that this will work is if the FBI contracts someone else to build it for them and even then the chances of failure are high unless they are willing to deal with criminals (i.e. Russian hackers who write the software for worms and spammers) to get it done which will happen about the same time that hell freezes over. The one good thing about governments when it comes to controlling the populace is that they are inefficient. If the government spent our tax money efficiently and effectively on surveillence and authoritarian enforcement actions then we would already be living in 1984.
Here's the actual bill. $60 million per year. 15 cosponsors.
This is another piece of Bush Administration "security theater". Write to your representatives in Congress and your Senators to get them to put this money into fighting spam and computer crime.
I didn't see anything in either article about the question of offshore trackers and peers.
Can the FBI legitimately scan, say, The Pirate Bay, to discover the IP addresses of supposed child-porn torrenters? Obviously if the person is downloading the material to a computer in the US is liable under Federal laws, but was the evidence obtained legally if it's based on scanning a foreign tracker?
Giving the FBI unfettered access to monitor the entire global Internet raises profound questions about the meaning of limits on the FBI's activities overseas.
But, then, anything's fair game when it comes to protecting children.
And, really, relying on file names is just so ridiculous that I'm shocked it might have actually resulted in some legitimate prosecutions. I suppose there's a clueless bunch of pedo types who just browse sites looking for 'young girl in action' types of filenames, but there's also got to be a more clueful bunch who maintain their own private networks.
I spend so much time online that I see it all anyway.
Especially with his penchant for plagiarism.
Is anyone else worried?
---- Booth was a patriot ----
Oh yeah? So what did the pro-child porn activists have to say about that?
Oh. Nothing? I guess NAMBLA doesn't have a lobbying firm. Yet.
I predict that soon, all p2p filenames will change to include more patriotic themes.
Maroon 5- The FBI is Great.torrent
Hot Sexy Babes (Not Really, It's the State of the Union Address!).torrent
And the FBI will wonder why illegal file-sharing has almost disappeared but the distribution of pro-government materials has skyrocketed.
Fear the penguin.
I don't think freedom advocates have even begun to fight on this front, the major battle begins when people start creating false positives (with reprecussions).
Flaws like the flash vulnerability mean that even without the complicity of GNU or Microsoft the majority of communications are open to inspection.
I'm curious to see what would happen if there was a decentralized push for better communication security.
"And it hampers Corporate America's Gawd Given right to a profit!"
Hear that clapping sound in Congress? That clapping sound is the sound of freedom dying... with thunderous applause?
--- Grow a pair, liberals... stop letting the Republicans bully you!
haha at piggy-backing wifi. just -try- to catch me
It's so funny watching the US government spending so much money on "internet" based projects. Instead of helping protect people from identity fraud, credit card fraud, online business scams, junk mail, spam and backdoors. How about protecting the things that adversely effect the tax paying populius and cost the private sector, federal and state governments, along with countless other venues money every year. The fact is, if the movie and music industry was to disappear over night. It wouldnt truely effect anything. But if your local SECU was to get hacked and 5000 SSNs stolen, imagine the financal impact of that. Wow, you still see websites and computers getting DoS'ed, by a almost 20 year old attack method.
You're government is doing what? Trying to help protect the sales of the Music and Movie sectors? Why? Why so much interest in p2p, internet game, file sharing, mp3 and movie sharers? I think Americans need to start digging deeper into there congressmans agendas, makes some calls, make a website to get people aware.
Seriously, do they think the American tax payers want to spend every, (well more because of our debt) dime on helping the RIAA, and the MPAA? This can only go on so long before income tax rates are around 90%, all so the FBI can load backtrack onto an iPhone and sit outside your house, while you watch Battlestar Gallactica in your underwear. Seriously, the kid has more to worry about when mom comes home and finds that he's been sitting on the couch all day instead of getting a job, or a girlfriend, or a life. Now if that kid had only come to /. his life would have been enriched. He would have seen the Dice dot com adds, he would have voted in polls, and he sure as hell would have read this post. He would look out the window and see goons with earpieces acting like they're talking on their little pentest devices. Then, and only then, would the kid have grown up. Slashdot, this is my story. The kid was me. But the kid was also each and every single one of us. We, who are believed to be intelligent, are watched, while the real criminals (drug cartels, corrupt corporations, the child molesters) all seem to be getting caught by accident. Someone has to call and file a complaint, it seems, before an investigation into wrong doing of these suspects is looked at. It seems they're treating techies, engineers, and the like as though they are part of hamas or hezbollah or hibbitywho'sawhatsit. And they're doing that for a reason. As tech people, the guys in the NSA, CIA, and FBI are not just police, they are trained scientists, often with military backgrounds, who are now more afraid of the American people, than they are of any foreign government. It was said long ago, "a government, by the people, and for the people." In a family, you worry about your kin. You do what you can for them. So I pose the question, "how is big brother, sitting outside, in his little van, eating cheetos , watching me, watch him, in any way a good use of tax dollars?" I tell yah what, he just wishes he was home with his wife and kids watching battlestar gallactica. When we talk about the good folks at the various alphabet organizations as some shadowy group of ill-intentioned individuals, then we are no less guilty than George Bush of creating an aura of fear. I do not fear the gov't, and they do not fear me. I'm more worried about the guy in the van. I know my sleep schedule, and I wonder, how it is that he stays up that long. How does he get any time to spend with his kids?
Strictly speaking no facts were presented. The questions do not state that anything is happening or true now, nor do they imply that if the suggested precursors and conditions are met that the event will happen. "Could" is a marvellous question if you plan on FUD, because almost anything COULD happen and cause-and-effect is left for the reader to infer. If I eat a cheezeburger, a meteorite COULD land on top of me, but unless McDonalds have gravitic weaponry installed, there would be no relationship between the two. Now, if I were to post about cheezeburgers on a lolcat site, maybe.
This exemplies to me why critical thinking, high-level language skills and logic should be core subjects in any education system. If people learned to be less passive in their reading and comprehension, they should be less subject to brain DoS attacks, otherwise known as FUD.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
wait wait wait, before the government impedes on yet another failed government venture, can one point out to me what government programs have actually worked? Social security is in the toliet, medicare is set to go belly up this year, nothing they do is right, and they want to do more? This is like having an employee at your company that just fails at everything he does, maybe it's not his fault, but sooner or later you have to make a decision, let him go or keep him aboard and let the company fall apart. The US Government has absolutely no position in trying to monitor p2p traffic. The FBI offers the end user absolutely no help when it comes to internet problems, such as hacks, and attacks. None what-so-ever. Sure they will help the large companies when they get ddos'd, but you try getting help from them. This is equal to your local police department doing nothing but arresting people all the while doing nothing to protect the community, only there to "police" and not "serve".
This just means you and your smart friends will have to develop legal technologies to protect yourself from entrapment.
I think entrapment is the whole point of this. Not only can you be entrapped by a cop into being a pedophile, but you can also be sent an illegal file by a cop and then arrested for accepting it.
So figure out a way to make it more difficult for yourself to be entrapped, or just expect to be entrapped.
All they'd have to do is scan the filenames to see what the md5 or fingerprint is and then they'd know what it is.
If you use a software random number generator, it's not really random.
Encryption would be a start, but you need hardware encryption.
Software encryption isn't very good because it's not like you can trust closed source windows to actually encrypt without being buggy.
Hardware encryption is what you'll need to protect your privacy. Hardware encryption, combined with an updated Privacy enhanced Linux, and you'll have a solution.
You'll want to move your entire OS onto CD/DVD and into ram as well. All files stored on the harddrive should be stored in encrypted form, including the swap and cache.
And you'd probably want a stegnographic file system, or a plugin on top of the current linux filesystem you use.
There you go, there is your solution. All you have to do is assemble a team of coders and write the software. It's probably going to cost a bit of money to pay for some of the software, as I can see a steganographic file system plugin being difficult to code.
The solution is actually simple. It's just a matter of people deciding to code it. And I don't think the will is currently there, but where theres a will theres a way.
Steganographic file system
StegFS
The first step would be finishing up the development of StegFS, porting it to the newest Linux Kernel and all the distributions. And let the SERIOUS users have privacy.
The only solution to defending privacy would be to develop Steganographic software solutions. A steg file system is already in development called stegFS.
And theres plenty of theories on how to do it. The question is who is actually going to write the software and who is going to pay for it?
I don't think theres enough demand for it, but in theory of course it's possible to have privacy and security. I think most linux users are more focused on paying for getting games working in Linux through Transgaming than they are focused on protecting their privacy.
Eventually critical mass will be reached and this will change. The result will be better software and hardware.
Ultimately this just means you have to design good software. Design a steganographic protocol for P2P and a steganographic file system for linux. That would be a start.
One example of a protocol I can think of off the top of my head is a stego P2P protocol where I sent you a file with a secret word associated with this file, the file looks like an ordinary legal PDF file, you can even read it, but if you enter the secret word the PDF file decrypts into the real file.
You could even add unlimited layers so that you can get 10 different files from 10 different secret words.
It's as simple as designing a steganographic protocol into either the file system, or the file sharing application.
Example, you want to send me an a file, on your Linux machine you combine 10 files into one big PDF file. The PDF file looks like a legit file with text, images etc, and the file name is also very boring, but associated with this file we both know a secret word known only between us.
The only way I can decrypt it into the correct file out of the 10 files you combined into it is if I know the exact secret word out of the 10 secret words that you picked.
So let our secret word be magic, there are 9 other words which would decode the PDF into any of the 9 other files, but because only you know the secret word, you enter it and you get the encrypted file.
Simple steganography. This will probably never be something for windows users, but I'm surprised Linux, the so called Free Software Operating System does not have it built into the file system.
There is a steganographic file system in development for linux called magikfs. If you value your privacy, you'll want to check it out.
MagikFS
MagikFS
Sorry, probably should've put that at the end. Jeese, you had to go and hash on my parade....
Fear the penguin.
Gah! Curse HTML not showing up. Sorry, their was supposed to be an "end joke" at the top of that....
Fear the penguin.