Slashdot Mirror
Tufts Tells Judge, We Can't Tie IP To MAC Addresses
NewYorkCountryLawyer writes "Protesting that Tufts University's DHCP-based systems 'were not designed to facilitate forensic examinations,' but rather to ensure 'smooth operations and to manage capacity issues,' the IT Office at Tufts University has responded to the subpoena in an RIAA case, Zomba v. Does 1-11, by submitting a report to the judge (PDF) explaining why it cannot cross-match IP addresses and MAC addresses, or identify users accurately. The IT office explained that the system identifies machines, not users; that some MAC addresses have multiple users; that only the Address Resolution Protocol system has even the potential to match IP addresses with MAC addresses, but that system could not do so accurately. For reasons which are unclear, the IT department then suggested that the RIAA next time send them 'notices to preserve information,' in response to which they would preserve, rather than overwrite, the DHCP data, for the RIAA's forensic benefit."
Next hot network thing: RIAA approved DHCP ;)
I'm sure the ICT department were real sorry they couldnt facilitate RIAA's demands.
My -1 Troll is actually a +1 funny. And my -1 flame is actually a +1 insightfull.
I suppose in the US you have judges with clue. In the UK it's fuddy duddy old men in wigs who go "What is this 'internet'?".
http://www.theinquirer.net/en/inquirer/news/2007/05/17/judge-has-beatles-moment-over-internet
or maybe he didnt:
http://www.theinquirer.net/en/inquirer/news/2007/05/18/judge-didnt-have-beatles-moment-after-all
Apparently the original story of the judge saying 'Who are the Beatles?' might be a myth anyway...
At the university...
Put every computer behind multiple routers and hubs.
Good luck getting through the mess of routes and MAC addresses on each.
Remember kids: Just because an IP address doesn't necessarily identify a person doesn't mean that copyright infringement is OK.
Actually, I would and have done that.
Say you are in a situation where you can't connect your laptop to a network, but you can find the MAC address for a computer that is connected to that same network.
1) Disconnect the computer that is connected;
2) Change your laptop MAC (I assume you are all using some variant of GNU/Linux, but whichever, you can find information http://www.irongeek.com/i.php?page=security/changemac which will get you started, there is also a tool available for Ubuntu (and I guess other *nix) which can randomise your MAC, choice a MAC based on a specific company etc.)
3) Connect your laptop to the network in place of the other computer.
Did I mention profit? I never did, but all I wanted to do was not be forced to use Windows and MSIE. (Of course, disconnect your laptop before reconnecting the other computer, having two machines with the same MAC could cause problems.)
So, even if you have a case of having to register your MAC before connecting to the network (which is the case in many places), because it is so easy to spoof MAC's, I don't think that you can even reliably connect MAC addresses to a computer (at least in the cases where geeks are around), let alone an IP address to a computer.
Basically, the only way that one should be trying to identify individuals is by using username/password, and even that is potentially problematic. (At my old Uni, to connect to the Wireless network you had to use your network login/password, it then didn't matter which computer you were using. Though in that case, I think the software only worked for MS Windows, the Mac and *nix software for the protocol wasn't up to scratch.)
I wank in the shower.
I thought that was pretty much standard practice these days.
Anyway, it's trivial to do.
Deleted
In both cases the retention notice arrived in such close proximity to the expiration of the ten day retention period of the DHCP data that we were unable to access the data before it was overwritten.
So they used the same excuse twice - log rotation - RIAAs new enemy.
At the dorm I used to live we had to authenticate our computers in order to gain access to the network, this was done via username/password combos. There were several that multiple people knew (mostly to get around bandwidth limits - you'd just jump on another account if you exceeded your quota).
It registered the MAC address at this point, but I doubt they were actually saved, as the quota was obviously tied to the user account and not the MAC.
People should understand that MAC address is no more permanent than IP address is.
Unfortunately they don't.
-- Reality checks don't bounce.
On windows, most wired NIC drivers will let you set the "Locally Administered Address" which is your MAC address in the devices advanced properties.
And with Wifi, it's even easier (useful for these Kiosk-type nets wthat present you with a login page on first access):
Well, occasionally you (or the victim) might get one or the other dropped connection, but in practice, this is extremely rare.
This is almost exactly what I was thinking: aside from the difficulties and uncertainties of matching an IP to a MAC at any given time in the past, with NAT and everything adding a lot of ambiguity to whole mess, it's simply not possible to match a MAC address to any given NIC, much less to a user of the computing containing this NIC, let alone establish knowledge or intent of the alleged infringement.
MAC forgery for dummies:
1) start packet sniffer
2) start ping probe of network segment, record ARP replies
3) when you want to forge a MAC address, probe the network segment again
4) use MAC from any host that is not responding, but that you did record the MAC address for previously
5) enter MAC in advanced setting for the network card (in windows, all dummies use windows).
The only thing I can think of to prevent this, is tying the MAC address to the physical port on the router. This is, of course, not possible with a wireless network.
username/password systems won't work reliably either, passwords can be sniffed, keylogged, or brute-forced.
Nice move on Tufts' part. If they ever do receive such a "notice to preserve", they can relay it straight back to their students and staff and say "look, the RIAA is watching us with a view to screwing you, so behave yourselves" for the duration of such a notice; and if they don't, they have effectively insulated their charges from all further RIAA action. And all whilst looking extermely co-operative for the benefit of the courts...
Unfortunately for people that try this at the school I work at this doesn't work. As soon as we see a MAC address on a switchport in the residence halls, that's the only address allowed on that port unless we specifically allow another one. So, if you try to change your address, you'll not only find that your new address doesn't work, but now your old one doesn't either because your port has been errdisabled and you have some explaining to do to network management.
Of course if a regime change happens at the end of the year, you can rest assured that there are certain politicians who will push hard for law changes to formally "outlaw" the use of DHCP in computer networks due to it's haphazard way of handling network IP's, traffic; and because it doesn't know who the user is!...
What a joke. If you think I'm wrong on this, take a look at the democratic side of the US Congress and look at some discussions that have been bantered about recently! Thats all I'll say on that.
God I hope and pray we get to replace them all next year! They're all bad.
All content in this message is copyright (c) 2008. All rights reserved. RIAA is prohibited here.
For reasons which are unclear, the IT department then suggested that the RIAA next time send them 'notices to preserve information,' in response to which they would preserve, rather than overwrite, the DHCP data, for the RIAA's forensic benefit."
I honestly wish Tufts hadn't even suggested this to the RIAA, since we all know this will be the next thing they'll try and have legislated through Congress. One of the congressmen on the RIAA payroll will attempt to slip it into a bill undetected.
They won't limit it to colleges either - they'll probably make it a requirement of ISPs in general.
Username/password is still better then MAC or IP. Yes there are problems, but as I outline below...
Encryption much? Prevents password sniffing. The protocol that my old Uni used was, I think, something based on http://en.wikipedia.org/wiki/Extensible_Authentication_Protocol EAP. No more sharing a single password amongst everyone.
My own computer much? Prevents keylogging. (Not to mention, software keylogging is prevented on lab machines by locking them down and drawing the image down the network when you login. So even if you install keylogging software, if it works at all, it would only work for your login. Hardware keyloggers are expensive/hard to get.)
Brute-forced... Joking much? The password file is stored at the other end of the network, you can't just grab it. And good luck tapping in different passwords by hand, with an enforced three second delay.
I wank in the shower.
For reasons which are unclear, the IT department then suggested that the RIAA next time send them 'notices to preserve information,' in response to which they would preserve, rather than overwrite, the DHCP data, for the RIAA's forensic benefit.
Why? The RIAA is not a court of law or even a government agency. Surely the university would have no obligation to comply with its requests? Talking about the RIAA in these terms ("notices", "forensic") lends it unwarranted legitimacy and authority.
That's not Picasso, that's Kandinsky!
The only thing I can think of to prevent this, is tying the MAC address to the physical port on the router.
Even this wouldn't prevent it if you can physically access the cables.
If you let users have physical access to your network hardware, you deserve to be cracked.
And how the fuck are you going to prevent them? Hide your computers and just let them access the screen, keyboard and mouse?
Unless you put your lab machines in a safe, there is always a way to access the network cables. (Even if it involves pulling the cover away from where they go into the wall.)
I wank in the shower.
.. Hey, RIAA, you guys must be pretty stupid if you don't realize that a MAC address can be changed with trivial ease. Therefore, even if we could dredge up the DHCP logs, the IP address to MAC address mapping you are so interested in wouldn't tell you anything anyway.
Please stop feeding the idiots, they foul the footpaths of life.
- I changed my ethernet card
- I was using a friends laptop
- I bought a new computer
- I bought two new computers
- Must have been a room mates friend
- etc...
20th century Marxism is not progress...
Had a quick scan through the PDF and note that they are saying they can identify a number of users via the MAC refering to the ARP..
With pretty much everyone and their cat knowing how to spoof/copy/clone/randomise a MAC could this one person still not be potentially someone else?
Ok it implies that it *could* be this guy but without certainty shouldn't it say just that, my reading of it suggests they are certain it is one person?
Who said anything about a lab? I'm talking about dorms, where there are two ports in a room and two people in a room.
you're the reason we aren't keeping logs of this stuff.
Good people go to bed earlier.
While I've never bought one, they seem to be readily available although buying one untraceably would be a bit more difficult (but not impossible) which would be a necessary step to avoid having the keylogger found and an investigator simply asking (perhaps under subpoena) the selling company for the purchase information for that (probably serialized) keylogger.
One CPU cycle wasted on digital restrictions management is ONE TOO MANY.
Hardware keyloggers are expensive/hard to get.
O RLY ? http://www.blueunplugged.com/p.aspx?p=121554
Squirrel!
Everyone has missed the point. The DHCP protocol does not use MAC addresses to identify clients. It uses client identifiers, which can be any unique string. The fact the *windows* chooses to use the mac address as a client identifier is beside the point. Who says the client being investigated is using windows?
I expected more from the MS-bashing Slashdot crowd. Apparently you are all windows users.
I was thinking the same thing--I'd never do something like that in an unknown environment without having already come up with some "good answer" for the low-level network fascist that might question what I was doing. I would think the least painful way to deal with restrictions in a NAC/NAP environment like often exists in residence halls (the test bed before they roll it out to everyone, unfortunately) is to hook up a healthy, compliant, good-boy Windows box and then connect your actual machine through the "blessed" Windows machine. Of course, if one of the conditions for NAC/NAP "health" is not running a DHCP server, that won't work.
One CPU cycle wasted on digital restrictions management is ONE TOO MANY.
In all of those cases, I'd ask you to email me a list of addresses you'd like allowed. Then you've identified yourself.
Yes but the proof RIAA would bring to the court is not just the IP/MAC address combination. That's just a pretext to grab a random student who's IP happens to match, seize his computer and find thousands of MP3 files in the shared folders of a P2P application. That would then constitute the actual evidence they need.
Anybody have some MAC addresses from the RIAA? That way people can use those in some semi-random rotating system and they can sue themselves.
After all if the IP can be linked to the MAC, the MAC can be linked to the user, so anybody with that MAC will be guilty.
Don't fight for your country, if your country does not fight for you.
... then you're liable! I'm expecting the courts to come up with that simple principle. Kinda like when your car is caught speeding: identify the driver or pay the fine.
That, of course, will make not only university LAN's but also corporate LAN's much more expensive to build. It'll also make it difficult to support multi-user machines as you'd have to tie each and every TCP connection to a user.
And after that liability scheme collapses under its own weight, we'll be rid of the whole copyright nonsense.
But that would be fine with me. All I want is to be able to tie your traffic to you. If your friend registered the windows box, then I'd tie it to him. Basically if I see a stream, I want to know who it belongs to on my end.
And how the fuck are you going to prevent them? Hide your computers and just let them access the screen, keyboard and mouse?
Unless you put your lab machines in a safe, there is always a way to access the network cables. (Even if it involves pulling the cover away from where they go into the wall.)
Give me a break. Physical Security 101. The network design itself is protected to the level it needs to be. Even the US Government realizes that it's ALWAYS possible to physically break in somewhere. Therefore, you build in the appropriate protection. The security either justifies the building across from the base golf course, or within E-ring at the Pentagon or 3rd floor in NORAD.
Until the next time the MAC address changes and he claims it was a different friend or another new computer or something.
Basically, there's so many legitimate reasons for a MAC address to change on a port that all you've really done is make everybody's life a little bit more miserable.
All I want is a secure system where it's easy to do anything I want. Is that too much to ask ~~ Randall Munroe
Aside from the hardware keyloggers, which would take ayd remotely competent freshman CS student a whopping whole Saturday evening to build from scratch (the PS/2 keyboard protocol is very slow, simple en well documented), you reasoning contains one major flaw:
universities (at least in the Netherlands) are basically government institutions and are run as such. I have yet to see a university with half-way decent network security, given that the network has to be usable by clueless non-CS students (and worse, professors).
Usually, security takes a backseat to accessibility, because the elderly making the decisions are about as clueless as the general public.
The whole point of my post was to show that is certainly not possible to pinpoint any user *given the current infrastructure*. Sure, it is possible to change to infrastructure to make it possible, but who is going to pay for that? The RIAA?
One of the IS guys at work came by, checked the number on my ethernet port, then asked if I was the f*cker that changed my MAC address to DE:AD:BE:EF:CA:FE. Yes I was. B00B1E5.
When I was working at CS Dept. / IT, your method would cause security to walk in within minutes... It was well known that MAC could not be relied for security. There were automatic remote checks (ssh-key for linux / unix + similar system for windows) to be done after computer bootup. If your machines identification doesn't match classes computer, it causes alert...
I'm fairly sure you weren't seriously asking meringuoid but I'm in a good mood and thought I'd answer below anyway. Someone might find it interesting... Maybe. Most will argue finer(and thicker) points below I'm sure but this WAS done in a coupla minutes.
I very glad to hear about the MAC spoofing and log rotation issues. I believe, technologically that all of us have at least access to stuff that insulates us from a lot of this bullying. I'm worried just like most of us that we'll be paying $1-3/GB or more in the near future by disparate ISPs acting cohesively.
Questions by meringuoid above, comments welcome - IANAExpert.
>>What, exactly, legally speaking, is a 'website'?
In it's basest form that would be a domain or sub-domain. A collection of pages logically linked together. www.google.com/* or www.geocities.com/user/*
>>Where does one 'website' end and another begin?
Change of domains/users/content, et al. Fairly simple to prove unless obfuscation were employed. Even then if you can dig deeply enough...
>>How does a 'site' differ from a 'page', if at all?
A site should have more than one page. (kinda old school but I also think a myspace page is a site in a way - there are pics/video page links)
>>Is a 'forum' part of a 'website', or only attached to it?
If the same people whom have authority over the website have authority over the forum or b) the people whom have authority over the website delegate authority over the forum.
>>Is there, as the media often says, a 'file sharing website' called 'BitTorrent' on which pirates trade music?
Nah - an infrastructure.
>>What exactly is this 'Web' thing anyway, and how is it distinct from the 'Internet', if at all?
The web serves html pages. The rest perform other handy networking functions.
It's often worse. I run a firewall/router in front of all my lab machines, between them and the wider university network. The router clones the IP and MAC address of a machine that is "officially" registered with the university via DHCP. So, in my case, one IP/MAC address combination == ~5 actual machines.
As I said, I agree that there are legitimate reasons. If he claims it's a different computer, he's either blaming his roommate or telling me that he left his room unlocked and some random person walked in and used his port. Give me a break.
Lawyers as a whole, and judges in particular, think that they can "cut to the chase" of a problem and dig into the details of any field by analyzing every activity with respect to the law. So they never grasp the technology per se as much as they extract talking points with which to argue their side. Judges just tend to go with whoever makes the better argument. Expert witnesses and consultants are brought in to boost the credibility of the lawyers and their talking points, not, to help aid in any real understanding.
This is my sig.
Can't MAC addresses be spoofed?
Patrick Doyle
I mod down every jackass who puts his moderation policy in his sig. Oh, wait a sec....
Yes but the proof RIAA would bring to the court is not just the IP/MAC address combination. That's just a pretext to grab a random student who's IP happens to match, seize his computer and find thousands of MP3 files in the shared folders of a P2P application.
That's exactly the point. It has been established that the IP address on its own is not enough as it can not be tied to single user/pc. That's the reason why they try to use IP/MAC pair to single out the computer they want to confiscate.
IP/MAC is just as reliable as IP address on its own.
-- Reality checks don't bounce.
I have yet to see a university with half-way decent network security, given that the network has to be usable by clueless non-CS students (and worse, professors).
The computer lab at Cambridge University certainly used to have a policy (not sure if it still applies) that if you rooted one of their boxes, they would buy you a beer, if you rooted another one, they would buy you a whole evening of beers (at the legendary Eagle pub), and if you rooted a third one, they would offer you a job.
Their IT security was way, waaaaaaay better than any commercial company I have worked at. Full-time security staffers with PhDs, pro-active scanning, keypad entry to server rooms with CCTV, and so forth. I suppose with folk like Markus Kuhn and Ross Anderson in the department, they have to make a bit of an effort. :o)
Does this have the potential to significantly impact any case other than Zomba v Does 1-11? I would love to see some precedents set that were based in actual technical fact rather than the typical RIAA pixie dust fantasy world.
My cheap-ass router (4-port) allows me to make up a MAC address to use. I could, theoretically, post crap to Kazaa under MAC address #1, and then change to a completely different MAC Address (and new IP to go with it). What's the RIAA gonna do about that? As far as they know, I didn't do anything....
At my work we use two-factor authentication. (We use RSA SmartID tokens and a RADIUS server, but other similar systems are available.) Two factor authentication relies on something you know (in this case, a PIN number), and something you have (in our case, a hardware key-fob that generates a pseudo-random number every 60 seconds). We use this to allow VPN connections into our network while on the road.
The price for these tokens is coming down to the point where banks are considering giving them to their customers who wish to bank online, I don't see why universities couldn't use them to allow access to their network, whether via Ethernet or wireless.
If your keyfob is lost or stolen, you report it immediately and the IT department disables that fob and issues a new one, presumably with a fee. Otherwise, you are held accountable for whatever is done with your account.
I'd imagine that this fob would also allow you to access any of the other services that are typically offered online by universities (access to library resources, registering for classes online, etc).
It's not that difficult to store information as to which IP address is issued to which account during which time, we do it at work.
Now we just have to convince them that blocking incoming ports at the ISP damages the RIAA rights to whatch for themselver how any computer is acting, and that NATs and the small address space of IPv4 help anonymizing users from RIAA investigations.
Rethinking email
The RIAA and the courts will eventually figure out that any computer forensic logs can be faked, and will not be a reliable means of identifying computer users.
Trying to pin criminal or civil liability on someone based on DHCP logs or ARP tables is sheer stupidity. These records could easily identify multiple users - we aren't talking about DNA evidence here.
The justice system is slow - intentionally. It will take a while before judges get the technical details of this and realize that these identification methods are unreliable.
What worries me is that the RIAA/MPAA will buy enough of congress to legislate unique tokens for computer users and mandatory log retention. It is possible that congress will make all of us (network admins) do the dirty work for private industry. It happened in banking, and it will probably happen again.
I think I need to make another donation to the EFF and to the ACLU. Those organizations might be our only hope.
-ted
MAC addresses can be altered utilizing wonderful software out there. Any type of monitoring is then useless for anyone who knows what they are doing. How do you track something that keeps changing...
I wonder how soon before the RIAA demand the ability to soft-set your MAC address via Device drivers is removed from PC's.
The drivers on my Laptop (and servers) allow the override of the Chip MAC address with a new one determined by me
This could give rise to MAC address cloning as a means to hide ... Now all you need to do is get someone else's MAC address when they are not active on the network.
To be truly accurate for "Audit" purposes, people would have to
1) disable all Wireless access, using only wired connections
2) Log all switches arp caches, and configs
a massive overhead for IT departments, as well as an inconvenience to all.
Some DHCP servers dont allow "leases" to be easily audited/determined
All the RIAA is doing is forcing people to think outside the box. Friends of mine have been trading MP3s for a while now by sharing USB keys. Other friends of mine trade those small 350GB USB external hard drives for movies.
Say you are in a situation where you can't connect your laptop to a network, but you can find the MAC address for a computer that is connected to that same network.
Don't tell anyone, but this is the preferred way of not having to pay $15 a day for Internet access at crappy motels and Starbucks. Who cares if you and your, umm, sponsor both get each others packets? Your IP stack will ignore the ones it didn't expect.
Dewey, what part of this looks like authorities should be involved?
The biggest challenge really lies between the chair and the keyboard. How can the court be sure that the one owning the computer is the culprit? I could just have lend it out to someone. Finding the right computer is also just the beginning in proving someone has committed a crime. Thanks to rampant trojan distribution on Windows computers its very common for a computer to be controllable by third parties, sometimes multiple parties, from remote. While in reality its mostly the owner that downloads nobody can prove it even if they could prove who was the owner of said computer.
Proving who used it is the challenging part where courts up until now have always assumed that the owner is always the user. If thats how it should be there should at least be a law written that states that the owner is always accountable for whatever happens at his computer. Right now the courts dont really grasp this and some people get sentenced while no real proof exists.
HTTP/1.1 400
Will this all become moot once ipv6 assigns everyone a static IP? Not sure if this is a good or a bad thing, but it seems inevitable.
This reminds me of when we were in university and a network admin had his computer recycled. We "borrowed" his MAC address that he never unregistered. Put us on the unmonitored/uncapped network access, and it actually allowed us to use P2P and Xbox Live.
He became suspicious when the network log had him as the top downloader and uploader on the network, and he did track down the person that did it. Luckily, we "borrowed" a neighbors unsecure wireless to do it from, so it appeared to be someone else.
A'int I a stinker?
The secondary NIC on most of the clusters I built would be named 02:DE:AD:BE:EF:20. My partner was more creative, but one of his ideas for a MAC was sorta sick.
deleting the extra space after periods so i can stay relevant, yeah.
Isn't it possible to disconnect the port when the cable is unplugged? I believe they do this at my mom's work. Of course you have a big problem when you're recovering from a power outtage....
But i believe the switches/routers at her work just disconnect the port whenever you pull the cable out of the machine.
"For reasons which are unclear, the IT department then suggested that the RIAA next time send them 'notices to preserve information..."
So based on the university IT department's willingness to accommodate, I should maybe send Natalie Portman a "Notice That I'd Like A Date", and I could have a reasonable expectation of spending an evening in geek ecstasy?
If all it takes to persuade a major university that it should bend over and drop trou is a freakin' notice, there MUST be hope for me.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
You should encrypt it with ROT-1, and sue the RIAA for DMCA violation. Jg zpv dbo sfbe uijt, zpv bsf voefs bssftu!
mcgrew's razor: Never attribute to stupidity that which can be explained by greedy self-interest
College students are highly irresponsible. You'll be replacing fobs left and right.
They'll also share them out or leave them in pools with the username taped to them...grab one, use it for a bit, put it back.
I found it depends entirely on the router that you're connecting to.
Not that I've ever done highly dubious and probably illegal activity of jumping onto someone else's network.
so just find a few mac addresses from some RIAA computers and use those to do your downloading
How hard is it to assign yourself an IP and never have to worry about DHCP logs?
Or modify from an existed one. To make it generate MAC address dynamically and avoid collision automatically. It may become a "survive through RIAA jungle" tool.
And attached to each P2P software release and set a world record of d/l.
Can I apply a patent for this? (Just in case I may violate some RIAA's patent.)
Try it. Might work.
Yup yup. And I have to say, Tufts Networking group is full of people who really know their stuff. Though students, even ones who know they are doing something wrong, aren't that smart about their dealings.
I still chuckle thinking back to the day that a student that had been a pain before and managed to weasel by with narry a slap on the wrist decided to start spamming... though one of the main email servers. The network group went as far as to send one of their engineers out to the physical site to verify that the machine doing the spamming was the same MAC...
she showed up and called Campus police for access to the office, and the Student showed up while she was waiting. She said she needed to verify some information, checked it out, at which point the police showed up, she explained the situation, and the officer dragged the student off.
This, I think, shows that their position is consistant over time. They have known for years that these issues would crop up, and they took steps to verify the info end to end, in person.
-Steve
"I opened my eyes, and everything went dark again"
You can tie the mac address to the device that connects to the broadband provider. For example, I am a Comcast subsriber and I have a cable modem device. When it was activated, the mac address was entered into the Comcast database. This allows me to pull a dynamic IP from their system over the cable modem "bridge". This mac address cannot be spoofed or I would not get service. This address is tied to my home address.now, here is the fun part. If I am commiting a "crime" using my broadband connection, my house can be siezed, the same as if I was running a crackhouse or making meth. It only takes a little creativity on the part of the police and DA. Here is the really fun part. I may be cleared of all wrongdoing by a slick lawyer but the house has to go to a "hearing" in which it can be proved that illegal activity was taking place. The house is then transfered to the local law enforcement for disposal in an auction or other sale. This happens every day in america. Car, boats, houses all siezed during criminal busts. Now, the RIAA claims that what downloaders are doing is a felany and the courts agree due to the nature of the huges costs associated with the "crime". All the RIAA has to do to deter the downloaders is to start having the homes seized. The hearing over the seizure is pretty cut and dried and very hard to win, for the citizen. Before you start claiming "BS", check the us code and search the web for property siezaures by the feds.
Sure, but once you are logged in a skilled user can just clone your mac address and kick you off the network. The only way around this as far as I can tell is to have each and every user in their own encrypted and authenticated tunnel.
The labs in the engineering building where I attended had all the cases strung with a cable that was linked to an alarm. Try to dick with the case and through some mechanism the alarm was triggered and EVERYONE knew.
Seems like that could easily be extended to cover manipulating the cables as well.
If you can't see the value in jet powered ants you should turn in your nerd card. - Dunbal (464142)
Linux makes it incredibly easy to use a different MAC address. Hell, most routers these days let you specify a MAC address. Based on that, you still can't guarantee that the IP was actually being used by the hardware with the detected address.
When I was at my old college, to get my laptop on the network, I would just clone the MAC of whichever workstation I was at, thank the DHCP server, and have internet access.
Yes because we all know that college students are just all anti-social shut-ins.
Laptops have been pervasive in academia and corporations for at least a good 10 years now.
A Pirate and a Puritan look the same on a balance sheet.
That's more than a little disturbing. That, or a great route to corporate espionage (I'm betting it'd be trivially easy to install keyloggers in your average corporate office, particularly given how small and discrete those things are). Not to mention the fun a disgruntled employee could have...
Show of hands, how many people here have written a TCP socket application to span multiple machines?
Yet another reason you can't tie a specific connection to a specific person in a heterogeneous network.
Lodragan Draoidh
The more you explain it, the more I don't understand it. - Mark Twain
Seriously, what a dumb setup... I'd be putting masking tape over my plugin when I wasn't using it to make sure my roommate didn't plug in accidentally. Or God forbid somebody came over and wanted to plug in their laptop... no, sorry, there's only two plugins and we're using them. What, use my computer? Like hell you will... actually, let me start up my keylogger and I'll let you have it for a bit.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Hmm, that actually gives me a great idea... I'll just go and check all the doors in the hall, and if anybody left their room unlocked I'll plug my lappy into their ports (using a different MAC address each time, of course). Then I'll be laughing as you try to get the mess straightened out when half a dozen rooms can't get on the network and you have no idea who did it.
While I'm at it, if anybody left their laptop accessible (yeah, how stupid, anybody could walk in and steal it), I'll just install a little script to change their MAC address periodically. That should be entertaining...
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
And, of course, nobody has *ever* spoofed a MAC Address ....
How many kids have any clue whatsoever on how to do this? I'd wager most CIS and IS students don't even know how to do it. You'd have a few really savvy kids that would know how, but honestly, the vast majority of kazaa users don't even know what a MAC address is.
Whatever you think of the RIAA and their methods, that's not a valid legal defense here. Tufts would have to prove that MAC spoofing is common knowledge and a common skill to mount that defense for their students, and that just isn't going to fly in court.
Life is hard, and the world is cruel
I haven't actually seen that for awhile now. My DSL modem operated in bridge mode. Currently, my router -- a Linux router, which can, indeed, spoof a Mac address -- is on fiber, and has a real, live IP address. Every Linksys router I've seen lately has something called "mac clone", which is explicitly designed to spoof a Mac address -- I assume that's actually useful somewhere. (I've used it when my ISP doesn't want to let go of my DHCP lease.)
Oh, and this is at a university. When I was there, it was all a local Ethernet network -- which, in fact, was handing out live IP addresses, but it'd be worse if they didn't. The only saving grace for the RIAA was, my school required users to register their Mac addresses with an account, and that account was actually tied to their identity.
Don't thank God, thank a doctor!
yes
RIAA sees "infringement" occur.
DHCP logs are overwritten immediately
They file a Notice to Preserve
IT department replies with "Ohhh, sorry, too late. Next time let is know in advance that you wanted some overwritten data preserved. The forms are clearly posted in the dark basement..."
UTF-8: There and Back Again
Essentially this a distributed system isn't it? The RIAA have logs (supposedly) which say at what time an IP was (supposedly) sharing copyright (supposedly) files.
Assuming all their logging servers share the same clock (which I highly doubt), you've also got the University & ISP servers, which have their own times. Thus, a simple mistake in either log, and all of a sudden you are potentially looking at another machine. Given the high incompetence of the RIAA technical investigation (at least from what I've heard reported), I wouldn't put it past them to even forget about timezone changes or DST.
Stupid much?
Brute-forced... Joking much? The password file is stored at the other end of the network, you can't just grab it. And good luck tapping in different passwords by hand, with an enforced three second delay.
So? Most people use password related to the school they're at and their class. Seriously. football2010 or [mascot]2010 are great examples. If you can enumerate enough login names (shouldn't be too hard, honestly) you'll be able to find an account that you can log in to. Bonus is that you probably won't trigger account lockouts for any of the aforementioned accounts, making it less likely that you'll be detected.
If you are a college student, you already have access to a free music download service. www.ruckus.com All you need is a .edu email address to get an account and download free (albeit DRM'ed) music.
Comment removed based on user account deletion
Comment removed based on user account deletion
I'm hoping someone can help me understand a part of Tuft's response. They say, on page 4:
"Occasionally, only one MAC address comes up in the ARP database...Therefore, if the IP address in question does not serve a high volume of users, there is a reasonable probability that the single matched MAC address was, in fact, the computer at use at the time of the alleged infraction...However, any such identification lacks the reasonable technical certainty of DHCP described above, since it is technically possible that another unidentified user accessed the system and used the IP address without being recorded in the ARP database."
In what scenario would DHCP capture an "unidentified user" while ARP would not?
Lots of people pontificating about logs and regurgitating the last chapter of 'Networking for dummies' they just read. Stop stealing shit. Really. Its a song. Whippy freaking do. Listen to the radio, satellite t.v. has lots of free songs. You whimpering little bitches brag about your 10G mp3 collection... but then complain about your mom telling you to turn down that music. Get a life, a paycheck and stop stealing.
I got an error message to the effect that the Portman requested was blocked.
Have gnu, will travel.
At the dorm I used to live we had to authenticate our computers in order to gain access to the network, this was done via username/password combos. There were several that multiple people knew (mostly to get around bandwidth limits - you'd just jump on another account if you exceeded your quota).
Once upon a time CMU had a writeup on the net of a system they'd developed which would put everybody who connected to the network on a VLAN that could do local DNS, DHCP, and talk to the Kerberos server. That's it. Once you authenticated, an authorization system would pop your port onto an Internet-connected VLAN.
Anybody seen a modern equivalent to this? It would be lovely for elementary schools that have problems with inappropriate access.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
So, even if you have a case of having to register your MAC before connecting to the network (which is the case in many places), because it is so easy to spoof MAC's, I don't think that you can even reliably connect MAC addresses to a computer (at least in the cases where geeks are around), let alone an IP address to a computer.
So what you're saying is that a mischievous user at a university could hop on to the wireless network in the administrative building and assume the President's MAC address, and then proceed to make egregious copyright violations, and there would be mass panic and confusion when the RIAA letter came in?
That would be bad, m'kay?
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
They can tie an IP address to a MAC address, although with less than total certainty. But, depending on how the network is wired, there is also no total certainty in tying a MAC address to a specific ethernet controller (and hence to a student). If their network is ethernet technology based, a MAC address can "float" from one port to another, even if there is a time delay in that from a switch flushing its cache.
All someone has to do is know the MAC addresses of other computers in the LAN. This can be known by sending IP packets to each of the addresses in the subnet, and checking what MAC addresses respond (and seen in the local ARP table). By scanning this network periodically, they can discover which computers get turned off or unplugged. As soon as that happens, the MAC address of the computer no longer responding is fed over to another computer which has an ethernet controller which allows substituting the MAC address by software. That other computer then assumes the MAC address and its associated IP address. Most ethernet switches will eventually associate that MAC address with a new port. Usually I see that happening within 3 to 10 seconds (the computer on the new port has to be sending ethernet frames with that MAC address as the source, plus some other computer trying to send ethernet frames to that MAC address). In the worst case I've seen it took 2 minutes for the switch to figure out where the MAC address "moved" to.
Once the switch associates the MAC address with a new port, the computer there can do whatever they want and there and it will be known under the original MAC and IP addresses.
There are means to prevent this. But would these means be implemented and deployed? One is for the switch to be configured to disallow a MAC address to move to another port. But that can make life difficult for students in dorms, where students with laptops, and even students with towers, are known to gather in one room, or a commons area, to work on things together with multiple computers (whether it is class work or otherwise). Another possibility is for the switch itself to log any port changes. That would at least reveal which dorm room a given MAC was "stolen" from. A more secure network would force all communications through an encrypted tunnel within the ethernet infrastructure, but this would be costly, impact performance, and require special drivers and/or proxies.
Imagine a plot of degree of security vs. cost. As you get close to 100% security, the cost begins to rise dramatically. At some point the cost of more security exceeds the potential loss due to that security not being 100%. Of course the **AA's would like to see their own losses figured into that, and without them having to pay for the extra security. The reality is, most schools will not achieve 100% security on their networks, and aside from the issue of piracy, will not be concerned with it. It's the same as the issue of how well do you secure your home from burglars. For most people it's just not worth tens of thousands of dollars in security equipment to protect tens of thousands of dollars of property. People like Bill Gates would certainly have a lot more security at home. But he's the exception. I'd expect the restricted areas of government intelligence agencies to have far more network security than any college or university.
So what it comes down to is, even the one and only student named as the user of a given MAC/IP combination, and even if their own computer was kept perfectly secure, may be just as much a victim of someone else doing the piracy, as the content owners are. And we know from history, the **AA's don't really care about making sure they have the true pirate.
If they would like to see the schools achieve 100% total security, maybe they should pay for it. Of course they don't want to. They want someone else to pay for maintaining their profit margins, even if that means raising taxes and/or tuition.
now we need to go OSS in diesel cars
It's worth noting that there are some great comments on Ray's blog (link in the summary) that don't appear to have made it to Slashdot. Worth reading for those of you with an intense interest in all this RIAA foolishness.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Too bad both of them have pissed me off so badly in the past.
The ACLU over the Second Amendment and their insanely restrictive view of the separation of church and state.
The EFF over their stand in the Michael Savage versus CAIR case.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Thanks...phony abbreviations aside, that really DID make me laugh out loud.
Cheers!
I've calculated my velocity with such exquisite precision that I have no idea where I am.
What they said was that in some of the requested users, they cannot provide a single user, and are not sure of the ramficiations of providing larger scoped lists of possible users in light of OTHER laws they have to adhere to, so they would like further discussion and guidance from the judge before proceeding.
... even if they were somehow able to definitively identify someone based on MAC and IP addresses, that evidence still can only be extracted using the unconscionable end-run around the intended purpose of federal court procedures. If such use of those procedures in John Doe suits is stopped by a judge, they won't even see the MAC addresses unless they wiretap the ISP.
"We are Microsoft. You shall be assimilated. Competition is futile."
That's more than a little disturbing. That, or a great route to corporate espionage (I'm betting it'd be trivially easy to install keyloggers in your average corporate office, particularly given how small and discrete those things are). Not to mention the fun a disgruntled employee could have...
1) Install hardware key logger on your own computer.
2) Wait for someone from desktop support to log in for some reason.
3) Profit! (Or at least install all that stuff that requires admin rights.)
Nothing for 6-digit uids?
Actually, a MAC address is more permanent than an IP. Except in very rare cases, a MAC address stays the same on a particular network device no matter what network it's connected to nor where the device is physically located.
There's nothing saying it can't be spoofed by those knowledgeable enough to do so, though, which is what I presume you were getting at.
Get your ass kicked for talking like a moron much?
Hardware Keylogger: $30. Ebay.
Inexpensive, easy to get.
Not to mention, asking stupid college kids for their password over the phone would probably have about a 75% success rate.
Our unnamed university uses Cisco Clean Access which registers every MAC address to a particular user. If the RIAA/MPAA were to subpoena that information from us, we'd not have the luxury to make that argument. We make a point to tell our students this and it has somewhat reduced the number of nasty cease and desist letters. (I think they've found other solutions like "Tor" to keep themselves anonymous).
We have a visitor wireless network that is the preferred "anonymizer" for students. The networking guys throttled this network to make P2P sharing a total pain although many students use it.
It's kind of a shame because there are plenty of legit uses for P2P sharing but the overwhelmingly negative reputation for them is for piracy.
It's funny how the RIAA/MPAA lawyers throw the book at people and basically blackmail them into a settlement but when one of their goons totally brings down a media company with a DoS, they pretend they didn't break federal laws.
I might know what I'm talkin' about, but then again, this is Slashdot...
The hard-coded MAC address in a network adapter is simply a number that's guaranteed to be different from every other hard-coded address in every other adapter; in other words, it's a matter of convenience. It allows the software to use an address that should avoid conflicts with other machines. It's still nothing more than a recommended value, and using a different value is hardly drastic. "Spoofing", although I kind of like the term, makes it sound more drastic than it really is (maybe that's why I like it). Oh well...
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Some of us get 15 mod points at once!
Comment removed based on user account deletion
Maybe I just listen to songs online. Maybe I listen just long enough to figure out which album, band, or song I like or dislike, and go buy the CD of the ones I like. BTI (before the internet), people had to choose albums based on slick marketing and faux cover art. Now days, people can hear just what is on the album by sampling what's online. This really does result in fewer album sales, and the RIAA members hate that. Their business model was based on people buying way more than they really wanted to keep. Just look at the efforts they have made to stop people from selling the CDs they bought (through used CD stores).
now we need to go OSS in diesel cars
This still requires using an authenticated tunnel to maintain the user login state, rather than the traditional IP-over-media routing. That means a lot of servers the school has to deploy to hash all the bandwidth the students are using. This is a high cost for that last one percent of bandwidth. The school's basic concern is stolen bandwidth (at the cost of their infrastructure and upstream pipe). Once that cost is below the cost of security to decrease the loss, they are at the sweet point. The {RI,MP}AA want schools to expend much greater costs which do not benefit the school, but without paying the school for it. Maybe in the future these shysters might get something like that into law. But today, schools generally do not have 100% authentication of bandwidth used simply because it is not economical to do so. And as soon as schools are forced to pay this cost, we will see higher tuition, higher taxes, and some schools completely shutting off internet access.
Someone broke into my house and stole property. Maybe the local police should be required to keep track of every vehicle and person who has traveled on the road in front of my house, and retain these records for at least 10 days.
now we need to go OSS in diesel cars
I have this vision of the RIAA lawyers as a group of seals clapping their fins and barking, "arp, arp, arp, arp".
not sure why.
Salut,
Jacques
that would be 2C:00:1B:AB:E5 or look for more combinations here:
http://www.nsftools.com/tips/HexWords.htm
nosig today
"Spoofing", although I kind of like the term, makes it sound more drastic than it really is (maybe that's why I like it).
Unfortunately juries can't get over the silliness of the word and don't believe it enough to give them reasonable doubt. They'd understand that a machine can be configured to lie about its identity to frame someone else, but calling it "spoofing" makes it laughable, so that defense fails.
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
I don't know about the "legally speaking" part, but in purely technological terms, those have pretty easy answers:
> What, exactly, legally speaking, is a 'website'?
All files available from a particular domain. Note that multiple, distinct websites may be served from a single computer, that a single person can own many different websites, and that multiple domains can be aliases for the same website.
> Where does one 'website' end and another begin?
At the boundaries of what is served by that domain, with exceptions for websites that act as proxies and solicit the content from other webservers.
> How does a 'site' differ from a 'page', if at all?
A page is the content addressed by a single URL. The site is a collection of all pages served from a given domain, subject to the caveats above. Website and site are synonyms, as are page and webpage, unless otherwise qualified (does anyone even have a gopher page these days?).
> Is a 'forum' part of a 'website', or only attached to it?
It's a part of it, even though the posts were made by various authors.
> Is there, as the media often says, a 'file sharing website' called 'BitTorrent' on which pirates trade music?
No. There's a BitTorrent protocol, and there's a website called bittorrent.com, but the two are different entities. There are many 'bittorrent sites' which serve torrent files. These files reference computers called 'trackers' that keep track of people using the bittorrent protocol, to the best of their knowledge, that are sharing pieces of the file(s) the torrent file enables them to share.
The tracker's information is not always reliable, though, for many different reasons and you cannot take the trackers word for it that someone is actually a part of any given 'swarm' or 'torrent' (the group of all computers sharing pieces of a given torrent).
Strictly speaking, the torrent sites only offer torrents, which are almost always created (and therefore copyrighted) by their users. The files the torrent enables others to download, however, may have any copyright status. While the use of torrents to share pirated content is not uncommon, the bittorrent protocol is often used to share legal content that could not otherwise be made available.
> What exactly is this 'Web' thing anyway, and how is it distinct from the 'Internet', if at all?
The web is one part of the internet. The web consists only of web pages, which are HTML files communicated via the http and https protocols. The internet is more expansive, including the web and everything else connected to the largest worldwide computer network we call the internet. Many computers transmit information via FTP, BitTorrent, and other means. These information channels are not part of the web, strictly speaking, even though the web may be used during some protocols (e.g. BitTorrent files are commonly available from websites, even though the actual distribution of the content referenced by the BitTorrent file happens using the BitTorrent protocol).
> A lot of terms bandied about in common parlance regarding Internet services are very vague, and I'm glad to hear of judges demanding that they be defined clearly and unambiguously when in court.
And I'm hoping they get the right definitions, so that they don't come to ridiculous conclusions from reasoning carefully about some of the absurd misinformation they've been given by the RIAA :-(
Does tying them together like that defeat the following: but some motherboard BIOS's let you change the MAC Address of an embed NIC, thus tricking the booting OS into believing the software encoded MAC Address is the hardware encoded one.
Just because you say so, Mr. I-Decide-What-The-Hell-Words-Must-Mean? So I guess that all these years I've been wrong to think that all those Geocities accounts were separate websites, when in fact, they are all the same site!
Come to think of it, actually, I once got a Geocities account on the basis of representations, made by Geocities, that such an account constituted a "website." Can I now sue Geocities for misrepresentations, or can they be otherwise penalized by making such misrepresentations to customers?
The term "website" has no more of a definite sense than "book." Is the Bible one book, many books, or both? Is the OED one book, or many books? What about a one-volume edition of the collected works of Shakespeare?
Are you adequate?
There is a common intellectual fallacy, that we ultimately inherit from the ancient Greeks, that there is such a thing as the definite classification of all the kinds of things that exist in the world, according to their essences. One example that's in the news a lot in recent years is the (pseudo-)question as to whether Pluto is a planet or not; too much of the debate about it presupposes that there is some essential sense in which Pluto really is or not a planet.
We should all reject that kind of thinking, because rejecting it clears the intellectual muddle that I think you're suffering here. The problem isn't that clear demarcations cannot be made; the problem is that clear demarcations can only be made for equally clear purposes, and that the demarcations made for one purpose may not be applicable for other purposes.
In the case of cars and vehicles, the relevant context is provided by the law in which the terms appear. In the case of court cases about "web sites," then the correct distinctions to apply for that case will depend on the body of law that the judge decides to apply to the case.
I suspect, however, that in a lot of cases, a good judge will have to conclude that the cases brought before them don't hinge on the meaning of the term "web site." I bet you most cases really hinge over who has what control over the content that is shown to other parties over the Internet, and what responsibilities are implied by that control. In a typical blog, for example, the blog's admins have the power to publish and retract entries, and to decide how user comments are handled. Readers may or may not have the power to cause comments to be added to blog entries right away. The admins have the power to delete comments after the fact, and may have legal obligations to delete some such comments within a reasonable time after coming to learn of them.
Are you adequate?
Maybe he didn't like that you changed it to a multicast address?
Cable modems equipped to also provide VoIP service have battery backup built in so that your phone still works when the power goes out (assuming of course that the upstream router's power didn't also go out). I was told this battery holds enough charge for two hours of standby (less if you're actually on the phone), though I have never tested it.
Mal-2
How is the Riemann zeta function like Trump rallies? Both have an endless number of trivial zeros.
You can change your MAC in windows too, for most cards. The option is in the device properties for the hardware device.
Well if you like your 2nd Amendment Rights to be protected there is always the NRA to pick up the slack...
That said is the one or two incidents where they piss you off erase the rest of the good that they actually do?
09F911029D74E35BD84156C5635688C0
+2 Troll is Slashdot's way of saying groupthink is confused