Slashdot Mirror
FBI and Next-Gen P2P Monitoring
AHuxley writes "Can the FBI get funding to create a next-generation network monitoring and database system for P2P networks, web sites, and chat rooms?
Could the FBI's Regional Information Sharing Systems (RISS) network be opened to more law enforcement agents across the USA?
Will the tracking of p2p users via 'unique serial numbers' generated from a person's computer be expanded from its first use in late 2005?
Is your p2p application or plug-in sending back your MAC address, firmware revision, manufacture date, GUID or other details?" Could this story submitter pose any more questions in his submission? Won't someone please think of the ... oh, never mind.
It's not the people who are slow. Their comments are just tied up in the RISS awaiting gov approval.
australian project gutenberg is better than the original.
Seriously though, how difficult is it to use the slashdot search engine with the capitalized words in the title? third hit...
will wonder why all the files have Joe Biden in the filename.
Yes, and that whole show included numbers about how much the child porn industry is worth... WTF? If they already know how much it's worth, why do they need to monitor it even more?
I am seriously hoping that anonymous begins to get rather political toward November. It would just make me happy to see masked people picketing courthouses with signs that tell everyone how senator so-and-so can't count, or has close ties with felons, or whatever... just some signs showing the sins of those who would have our votes.
I think that is the only effective way to use a smear campaign, and I think that it should be done.
Support NYCountryLawyer RIAA vs People
sudo macchanger -r
I'm no computer scientist but isn't it fairly trivial for them to get your mac (or at least that of your router) from your network traffic anyway?
IranAir Flight 655 never forget!
In the olden days, when I was a kid, we happened into dealing with the F.B.I. Subsequently, I know to engage a large supply of salt anytime I read about any investigation that has been tainted by their crime lab. Think of the children and send more money. Yeah. Knowing their proclivity to abuse/disregard the law, I don't really see the upside to this.
The cost of that cleanup, of course, will be borne by taxpayers, not industry.
Heavy on fear, but light on facts... And with so many popular torrent programs open source, all of the sneakiness is no longer possible. No magic serial, or mac address in my torrent program. Oh, and it is encrypted.
*ducks*
If the FBI really wants your MAC address, they can do it the old fashioned way:
Get a warrant to tap the ISP they think you are at and a warrant for your billing information, listen in for awhile to make sure you aren't being joe-jobbed or pwned/bounced-off-of, then raid your house and seize all your computers and routers.
Your MAC address will be somewhere in that pile of equipment.
My MAC address is Oak Brook, IL 60523.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Go on, take down my MAC address, 1. I'm in Canada, we don't serve your DCMA'ing kind here. 2. My router changes MAC addresses routinely, I made that change a long time ago.
-Ours is the wisdom of Solomon, the magic of Merlyn, the fall of Icaris.
Maybe if they do start monitoring all that traffic, people will get a clue and start using Tor for all their internet traffic. Especially their plaintext passwords. Dangerous business, letting the FBI know where those plaintext passwords are going. Better encrypt them with Tor!
Anyone wonder how many exit nodes the NSA already runs? That'd be a far better(easier?) approach than monitoring "normal" traffic since I suppose the interesting stuff is already going through Tor, though in a typical hour-long scan I can't find any really "interesting" unencrypted web traffic at my exit node.
Folks surfing porn? Plenty. Plenty of Chinese blogs with plaintext passwords, too. But even those Chinese blogs are benign and not something that would be censored by their gov't (I think). Based on the pictures and my basic proficiency with Chinese, it's either folks just fooling around with Tor or it's steganographic.
AHuxley:
Yes
Yes
Yes
Yes
CmdrTaco:
Yes
Hope that helps everyone.
This guy's the limit!
I think any of those would be quite hard to inject into open source code.
After all, in a p2p app the traffic is the most important thing ... and is going to be watched very closely. Patches that modify what go over the wire will be under considerable scrutiny.
And how are you going to collect those details once they're transmitted? By their nature p2p apps are hard to keep track of.
Not to say it couldn't happen. But I don't think it's much of a risk compared to the simple fact that your IP address is very visible when using a p2p app...
How unique is a MAC address? Can't a given manufacturer reuse old addresses since they only need to be unique within the local network?
I am not a number - I am a free man!
Closed source applications from companies like M$ can't be trusted in this way.
The last time the FBI tried to build a large piece of custom software, a case-file management system, they ended up spending 170 MILLION dollars over 3+ years for software which basically did nothing useful (a complete failure). The only way that this will work is if the FBI contracts someone else to build it for them and even then the chances of failure are high unless they are willing to deal with criminals (i.e. Russian hackers who write the software for worms and spammers) to get it done which will happen about the same time that hell freezes over. The one good thing about governments when it comes to controlling the populace is that they are inefficient. If the government spent our tax money efficiently and effectively on surveillence and authoritarian enforcement actions then we would already be living in 1984.
Here's the actual bill. $60 million per year. 15 cosponsors.
This is another piece of Bush Administration "security theater". Write to your representatives in Congress and your Senators to get them to put this money into fighting spam and computer crime.
I didn't see anything in either article about the question of offshore trackers and peers.
Can the FBI legitimately scan, say, The Pirate Bay, to discover the IP addresses of supposed child-porn torrenters? Obviously if the person is downloading the material to a computer in the US is liable under Federal laws, but was the evidence obtained legally if it's based on scanning a foreign tracker?
Giving the FBI unfettered access to monitor the entire global Internet raises profound questions about the meaning of limits on the FBI's activities overseas.
But, then, anything's fair game when it comes to protecting children.
And, really, relying on file names is just so ridiculous that I'm shocked it might have actually resulted in some legitimate prosecutions. I suppose there's a clueless bunch of pedo types who just browse sites looking for 'young girl in action' types of filenames, but there's also got to be a more clueful bunch who maintain their own private networks.
You would need OS independence.
Unique file id's passing out in "real time".
Unique user id.
The user would have to feel safe and happy about the above.
I would suggest a something like a helpful new anti junk file database/plug in?
Domestic spying is now "Benign Information Gathering"
Especially with his penchant for plagiarism.
Is anyone else worried?
---- Booth was a patriot ----
Oh yeah? So what did the pro-child porn activists have to say about that?
Oh. Nothing? I guess NAMBLA doesn't have a lobbying firm. Yet.
I predict that soon, all p2p filenames will change to include more patriotic themes.
Maroon 5- The FBI is Great.torrent
Hot Sexy Babes (Not Really, It's the State of the Union Address!).torrent
And the FBI will wonder why illegal file-sharing has almost disappeared but the distribution of pro-government materials has skyrocketed.
Fear the penguin.
I don't think freedom advocates have even begun to fight on this front, the major battle begins when people start creating false positives (with reprecussions).
Flaws like the flash vulnerability mean that even without the complicity of GNU or Microsoft the majority of communications are open to inspection.
I'm curious to see what would happen if there was a decentralized push for better communication security.
"And it hampers Corporate America's Gawd Given right to a profit!"
Hear that clapping sound in Congress? That clapping sound is the sound of freedom dying... with thunderous applause?
--- Grow a pair, liberals... stop letting the Republicans bully you!
Considering we're speeding toward the bottom at Warp 9, there's not a lot further to go. I'm thinking, we all might as well line up at the prisons now and serve our time for whatever the government decides is a crime tomorrow and get it over with.
Understanding the scope of the problem is the first step on the path to true panic.
You scrape it off with a metal file, duh.
Proud neuron in the Slashdot hivemind since 2002.
Strictly speaking no facts were presented. The questions do not state that anything is happening or true now, nor do they imply that if the suggested precursors and conditions are met that the event will happen. "Could" is a marvellous question if you plan on FUD, because almost anything COULD happen and cause-and-effect is left for the reader to infer. If I eat a cheezeburger, a meteorite COULD land on top of me, but unless McDonalds have gravitic weaponry installed, there would be no relationship between the two. Now, if I were to post about cheezeburgers on a lolcat site, maybe.
This exemplies to me why critical thinking, high-level language skills and logic should be core subjects in any education system. If people learned to be less passive in their reading and comprehension, they should be less subject to brain DoS attacks, otherwise known as FUD.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
wait wait wait, before the government impedes on yet another failed government venture, can one point out to me what government programs have actually worked? Social security is in the toliet, medicare is set to go belly up this year, nothing they do is right, and they want to do more? This is like having an employee at your company that just fails at everything he does, maybe it's not his fault, but sooner or later you have to make a decision, let him go or keep him aboard and let the company fall apart. The US Government has absolutely no position in trying to monitor p2p traffic. The FBI offers the end user absolutely no help when it comes to internet problems, such as hacks, and attacks. None what-so-ever. Sure they will help the large companies when they get ddos'd, but you try getting help from them. This is equal to your local police department doing nothing but arresting people all the while doing nothing to protect the community, only there to "police" and not "serve".
This just means you and your smart friends will have to develop legal technologies to protect yourself from entrapment.
I think entrapment is the whole point of this. Not only can you be entrapped by a cop into being a pedophile, but you can also be sent an illegal file by a cop and then arrested for accepting it.
So figure out a way to make it more difficult for yourself to be entrapped, or just expect to be entrapped.
All they'd have to do is scan the filenames to see what the md5 or fingerprint is and then they'd know what it is.
If you use a software random number generator, it's not really random.
Encryption would be a start, but you need hardware encryption.
Software encryption isn't very good because it's not like you can trust closed source windows to actually encrypt without being buggy.
Hardware encryption is what you'll need to protect your privacy. Hardware encryption, combined with an updated Privacy enhanced Linux, and you'll have a solution.
You'll want to move your entire OS onto CD/DVD and into ram as well. All files stored on the harddrive should be stored in encrypted form, including the swap and cache.
And you'd probably want a stegnographic file system, or a plugin on top of the current linux filesystem you use.
There you go, there is your solution. All you have to do is assemble a team of coders and write the software. It's probably going to cost a bit of money to pay for some of the software, as I can see a steganographic file system plugin being difficult to code.
The solution is actually simple. It's just a matter of people deciding to code it. And I don't think the will is currently there, but where theres a will theres a way.
Steganographic file system
StegFS
The first step would be finishing up the development of StegFS, porting it to the newest Linux Kernel and all the distributions. And let the SERIOUS users have privacy.
The only solution to defending privacy would be to develop Steganographic software solutions. A steg file system is already in development called stegFS.
And theres plenty of theories on how to do it. The question is who is actually going to write the software and who is going to pay for it?
I don't think theres enough demand for it, but in theory of course it's possible to have privacy and security. I think most linux users are more focused on paying for getting games working in Linux through Transgaming than they are focused on protecting their privacy.
Eventually critical mass will be reached and this will change. The result will be better software and hardware.
Ultimately this just means you have to design good software. Design a steganographic protocol for P2P and a steganographic file system for linux. That would be a start.
One example of a protocol I can think of off the top of my head is a stego P2P protocol where I sent you a file with a secret word associated with this file, the file looks like an ordinary legal PDF file, you can even read it, but if you enter the secret word the PDF file decrypts into the real file.
You could even add unlimited layers so that you can get 10 different files from 10 different secret words.
It's as simple as designing a steganographic protocol into either the file system, or the file sharing application.
Example, you want to send me an a file, on your Linux machine you combine 10 files into one big PDF file. The PDF file looks like a legit file with text, images etc, and the file name is also very boring, but associated with this file we both know a secret word known only between us.
The only way I can decrypt it into the correct file out of the 10 files you combined into it is if I know the exact secret word out of the 10 secret words that you picked.
So let our secret word be magic, there are 9 other words which would decode the PDF into any of the 9 other files, but because only you know the secret word, you enter it and you get the encrypted file.
Simple steganography. This will probably never be something for windows users, but I'm surprised Linux, the so called Free Software Operating System does not have it built into the file system.
There is a steganographic file system in development for linux called magikfs. If you value your privacy, you'll want to check it out.
MagikFS
MagikFS
Sorry, probably should've put that at the end. Jeese, you had to go and hash on my parade....
Fear the penguin.
Gah! Curse HTML not showing up. Sorry, their was supposed to be an "end joke" at the top of that....
Fear the penguin.