Slashdot Mirror
Tufts Tells Judge, We Can't Tie IP To MAC Addresses
NewYorkCountryLawyer writes "Protesting that Tufts University's DHCP-based systems 'were not designed to facilitate forensic examinations,' but rather to ensure 'smooth operations and to manage capacity issues,' the IT Office at Tufts University has responded to the subpoena in an RIAA case, Zomba v. Does 1-11, by submitting a report to the judge (PDF) explaining why it cannot cross-match IP addresses and MAC addresses, or identify users accurately. The IT office explained that the system identifies machines, not users; that some MAC addresses have multiple users; that only the Address Resolution Protocol system has even the potential to match IP addresses with MAC addresses, but that system could not do so accurately. For reasons which are unclear, the IT department then suggested that the RIAA next time send them 'notices to preserve information,' in response to which they would preserve, rather than overwrite, the DHCP data, for the RIAA's forensic benefit."
Next hot network thing: RIAA approved DHCP ;)
I'm sure the ICT department were real sorry they couldnt facilitate RIAA's demands.
My -1 Troll is actually a +1 funny. And my -1 flame is actually a +1 insightfull.
I suppose in the US you have judges with clue. In the UK it's fuddy duddy old men in wigs who go "What is this 'internet'?".
http://www.theinquirer.net/en/inquirer/news/2007/05/17/judge-has-beatles-moment-over-internet
or maybe he didnt:
http://www.theinquirer.net/en/inquirer/news/2007/05/18/judge-didnt-have-beatles-moment-after-all
Apparently the original story of the judge saying 'Who are the Beatles?' might be a myth anyway...
Remember kids: Just because an IP address doesn't necessarily identify a person doesn't mean that copyright infringement is OK.
Actually, I would and have done that.
Say you are in a situation where you can't connect your laptop to a network, but you can find the MAC address for a computer that is connected to that same network.
1) Disconnect the computer that is connected;
2) Change your laptop MAC (I assume you are all using some variant of GNU/Linux, but whichever, you can find information http://www.irongeek.com/i.php?page=security/changemac which will get you started, there is also a tool available for Ubuntu (and I guess other *nix) which can randomise your MAC, choice a MAC based on a specific company etc.)
3) Connect your laptop to the network in place of the other computer.
Did I mention profit? I never did, but all I wanted to do was not be forced to use Windows and MSIE. (Of course, disconnect your laptop before reconnecting the other computer, having two machines with the same MAC could cause problems.)
So, even if you have a case of having to register your MAC before connecting to the network (which is the case in many places), because it is so easy to spoof MAC's, I don't think that you can even reliably connect MAC addresses to a computer (at least in the cases where geeks are around), let alone an IP address to a computer.
Basically, the only way that one should be trying to identify individuals is by using username/password, and even that is potentially problematic. (At my old Uni, to connect to the Wireless network you had to use your network login/password, it then didn't matter which computer you were using. Though in that case, I think the software only worked for MS Windows, the Mac and *nix software for the protocol wasn't up to scratch.)
I wank in the shower.
In both cases the retention notice arrived in such close proximity to the expiration of the ten day retention period of the DHCP data that we were unable to access the data before it was overwritten.
So they used the same excuse twice - log rotation - RIAAs new enemy.
At the dorm I used to live we had to authenticate our computers in order to gain access to the network, this was done via username/password combos. There were several that multiple people knew (mostly to get around bandwidth limits - you'd just jump on another account if you exceeded your quota).
It registered the MAC address at this point, but I doubt they were actually saved, as the quota was obviously tied to the user account and not the MAC.
People should understand that MAC address is no more permanent than IP address is.
Unfortunately they don't.
-- Reality checks don't bounce.
And with Wifi, it's even easier (useful for these Kiosk-type nets wthat present you with a login page on first access):
Well, occasionally you (or the victim) might get one or the other dropped connection, but in practice, this is extremely rare.
This is almost exactly what I was thinking: aside from the difficulties and uncertainties of matching an IP to a MAC at any given time in the past, with NAT and everything adding a lot of ambiguity to whole mess, it's simply not possible to match a MAC address to any given NIC, much less to a user of the computing containing this NIC, let alone establish knowledge or intent of the alleged infringement.
MAC forgery for dummies:
1) start packet sniffer
2) start ping probe of network segment, record ARP replies
3) when you want to forge a MAC address, probe the network segment again
4) use MAC from any host that is not responding, but that you did record the MAC address for previously
5) enter MAC in advanced setting for the network card (in windows, all dummies use windows).
The only thing I can think of to prevent this, is tying the MAC address to the physical port on the router. This is, of course, not possible with a wireless network.
username/password systems won't work reliably either, passwords can be sniffed, keylogged, or brute-forced.
Nice move on Tufts' part. If they ever do receive such a "notice to preserve", they can relay it straight back to their students and staff and say "look, the RIAA is watching us with a view to screwing you, so behave yourselves" for the duration of such a notice; and if they don't, they have effectively insulated their charges from all further RIAA action. And all whilst looking extermely co-operative for the benefit of the courts...
For reasons which are unclear, the IT department then suggested that the RIAA next time send them 'notices to preserve information,' in response to which they would preserve, rather than overwrite, the DHCP data, for the RIAA's forensic benefit."
I honestly wish Tufts hadn't even suggested this to the RIAA, since we all know this will be the next thing they'll try and have legislated through Congress. One of the congressmen on the RIAA payroll will attempt to slip it into a bill undetected.
They won't limit it to colleges either - they'll probably make it a requirement of ISPs in general.
Username/password is still better then MAC or IP. Yes there are problems, but as I outline below...
Encryption much? Prevents password sniffing. The protocol that my old Uni used was, I think, something based on http://en.wikipedia.org/wiki/Extensible_Authentication_Protocol EAP. No more sharing a single password amongst everyone.
My own computer much? Prevents keylogging. (Not to mention, software keylogging is prevented on lab machines by locking them down and drawing the image down the network when you login. So even if you install keylogging software, if it works at all, it would only work for your login. Hardware keyloggers are expensive/hard to get.)
Brute-forced... Joking much? The password file is stored at the other end of the network, you can't just grab it. And good luck tapping in different passwords by hand, with an enforced three second delay.
I wank in the shower.
For reasons which are unclear, the IT department then suggested that the RIAA next time send them 'notices to preserve information,' in response to which they would preserve, rather than overwrite, the DHCP data, for the RIAA's forensic benefit.
Why? The RIAA is not a court of law or even a government agency. Surely the university would have no obligation to comply with its requests? Talking about the RIAA in these terms ("notices", "forensic") lends it unwarranted legitimacy and authority.
That's not Picasso, that's Kandinsky!
The only thing I can think of to prevent this, is tying the MAC address to the physical port on the router.
Even this wouldn't prevent it if you can physically access the cables.
And how the fuck are you going to prevent them? Hide your computers and just let them access the screen, keyboard and mouse?
Unless you put your lab machines in a safe, there is always a way to access the network cables. (Even if it involves pulling the cover away from where they go into the wall.)
I wank in the shower.
you're the reason we aren't keeping logs of this stuff.
Good people go to bed earlier.
Hardware keyloggers are expensive/hard to get.
O RLY ? http://www.blueunplugged.com/p.aspx?p=121554
Squirrel!
Yes but the proof RIAA would bring to the court is not just the IP/MAC address combination. That's just a pretext to grab a random student who's IP happens to match, seize his computer and find thousands of MP3 files in the shared folders of a P2P application. That would then constitute the actual evidence they need.
Anybody have some MAC addresses from the RIAA? That way people can use those in some semi-random rotating system and they can sue themselves.
After all if the IP can be linked to the MAC, the MAC can be linked to the user, so anybody with that MAC will be guilty.
Don't fight for your country, if your country does not fight for you.
.. Hey, RIAA, you guys must be pretty stupid if you don't realize that a MAC address can be changed with trivial ease. Therefore, even if we could dredge up the DHCP logs, the IP address to MAC address mapping you are so interested in wouldn't tell you anything anyway.
They don't care. They just want to have someone to sue.
Ray Beckerman +5 Insightful
One of the IS guys at work came by, checked the number on my ethernet port, then asked if I was the f*cker that changed my MAC address to DE:AD:BE:EF:CA:FE. Yes I was. B00B1E5.
Yes, but once the computer is assigned an IP address, ARP ties the MAC address to the IP address. You could then, in principle, log the mappings by dumping the router's ARP table at regular intervals.
All I want is a secure system where it's easy to do anything I want. Is that too much to ask ~~ Randall Munroe
Still impossible to tie it to a MAC address with any certainty that that MAC address corresponds to the same person now as it did then. For instance, say CompOnwer 1 owns Comp A with MAC 1 uploads a bunch of crap on kazaa. RIAA gets to requesting the info but lags. In the mean time, Comp A is sold to another person on the same campus, becoming CompOwner 2 owning Comp A with MAC 1. The way DHCP works, they are likely to end up with the same IP and same MAC address but its a totally different person.
Crackin' Wise - Blogging about whatever we want
And, of course, nobody has *ever* spoofed a MAC Address ....
Invaders must die
The RIAA and the courts will eventually figure out that any computer forensic logs can be faked, and will not be a reliable means of identifying computer users.
Trying to pin criminal or civil liability on someone based on DHCP logs or ARP tables is sheer stupidity. These records could easily identify multiple users - we aren't talking about DNA evidence here.
The justice system is slow - intentionally. It will take a while before judges get the technical details of this and realize that these identification methods are unreliable.
What worries me is that the RIAA/MPAA will buy enough of congress to legislate unique tokens for computer users and mandatory log retention. It is possible that congress will make all of us (network admins) do the dirty work for private industry. It happened in banking, and it will probably happen again.
I think I need to make another donation to the EFF and to the ACLU. Those organizations might be our only hope.
-ted
Spoofed? It can be changed!
http://linuxhelp.blogspot.com/2005/09/how-to-change-mac-address-of-your.html
"Ignorance more frequently begets confidence than does knowledge"
- Charles Darwin
Out of curiosity, what did you perceive as the difference?
Dewey, what part of this looks like authorities should be involved?
I wonder how hard it would be to find out what the MAC addres of the provost's pc is? Let the spoofing hilarity begin!
I Am My Own Worst Enemy
Why don't you go a step further and just assume that everyone does their illegal sharing in a virtual machine? Hell, you could change the MAC every day. The possibilities for error by tying an IP to a MAC are pretty boundless.
"For reasons which are unclear, the IT department then suggested that the RIAA next time send them 'notices to preserve information..."
So based on the university IT department's willingness to accommodate, I should maybe send Natalie Portman a "Notice That I'd Like A Date", and I could have a reasonable expectation of spending an evening in geek ecstasy?
If all it takes to persuade a major university that it should bend over and drop trou is a freakin' notice, there MUST be hope for me.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
True, but I bet that most CIS and IS students know that you CAN do it. Then it becomes a simple matter of googling. The key here is that anyone who has taken a bAIX networking course has enough knowledge to dispute evidence crucial to the RIAA's case. The fact the RIAA is able to continually present this evidence in a court room tells me that
1. Judges and juries do not know enough about the technology that they are ruling on.
2. The RIAA's experts are deliberately misleading the judges and juries. This is not ethical and should have consequence.
It's not like every student would have to be going around spoofing MAC addresses. You could have ten kids going around sniffing MAC addresses, then spoofing a different MAC every day to do their file sharing. You could certainly be vulnerable to this without knowing how it works.
Spot on. The lack of clue within the RIAA is mindnumbing.
I suspect the RIAA knows EXACTLY what the technical facts are. But if they can still sue w/o having those get in their way, so much the better! (For them)
Remember this is law, not logic.
Before you design for reuse, make sure to design it for use.
The "Clone MAC Address" feature is there because some ISP's (Cox comes to mind) will grab the mac addy. of the first device you hook up and refuse to provide service to anything else. So when you plug your laptop straight in to check if they've turned up the line it works. Plug in your router and it's dead.
Tech support swears they don't do this, so you have two choices: call/hold/bitch at tech support till they reset your account (locking you into your current router's MAC so you start over if you get another router) or just clone the MAC and start moving packets.
They can tie an IP address to a MAC address, although with less than total certainty. But, depending on how the network is wired, there is also no total certainty in tying a MAC address to a specific ethernet controller (and hence to a student). If their network is ethernet technology based, a MAC address can "float" from one port to another, even if there is a time delay in that from a switch flushing its cache.
All someone has to do is know the MAC addresses of other computers in the LAN. This can be known by sending IP packets to each of the addresses in the subnet, and checking what MAC addresses respond (and seen in the local ARP table). By scanning this network periodically, they can discover which computers get turned off or unplugged. As soon as that happens, the MAC address of the computer no longer responding is fed over to another computer which has an ethernet controller which allows substituting the MAC address by software. That other computer then assumes the MAC address and its associated IP address. Most ethernet switches will eventually associate that MAC address with a new port. Usually I see that happening within 3 to 10 seconds (the computer on the new port has to be sending ethernet frames with that MAC address as the source, plus some other computer trying to send ethernet frames to that MAC address). In the worst case I've seen it took 2 minutes for the switch to figure out where the MAC address "moved" to.
Once the switch associates the MAC address with a new port, the computer there can do whatever they want and there and it will be known under the original MAC and IP addresses.
There are means to prevent this. But would these means be implemented and deployed? One is for the switch to be configured to disallow a MAC address to move to another port. But that can make life difficult for students in dorms, where students with laptops, and even students with towers, are known to gather in one room, or a commons area, to work on things together with multiple computers (whether it is class work or otherwise). Another possibility is for the switch itself to log any port changes. That would at least reveal which dorm room a given MAC was "stolen" from. A more secure network would force all communications through an encrypted tunnel within the ethernet infrastructure, but this would be costly, impact performance, and require special drivers and/or proxies.
Imagine a plot of degree of security vs. cost. As you get close to 100% security, the cost begins to rise dramatically. At some point the cost of more security exceeds the potential loss due to that security not being 100%. Of course the **AA's would like to see their own losses figured into that, and without them having to pay for the extra security. The reality is, most schools will not achieve 100% security on their networks, and aside from the issue of piracy, will not be concerned with it. It's the same as the issue of how well do you secure your home from burglars. For most people it's just not worth tens of thousands of dollars in security equipment to protect tens of thousands of dollars of property. People like Bill Gates would certainly have a lot more security at home. But he's the exception. I'd expect the restricted areas of government intelligence agencies to have far more network security than any college or university.
So what it comes down to is, even the one and only student named as the user of a given MAC/IP combination, and even if their own computer was kept perfectly secure, may be just as much a victim of someone else doing the piracy, as the content owners are. And we know from history, the **AA's don't really care about making sure they have the true pirate.
If they would like to see the schools achieve 100% total security, maybe they should pay for it. Of course they don't want to. They want someone else to pay for maintaining their profit margins, even if that means raising taxes and/or tuition.
now we need to go OSS in diesel cars
You do understand all you have to do is cycle the cable modems power and it will grab the new MAC address, yes I used to do this daily. There is no need to "call/hold/bitch" to anyone.
Sorry, teleporters just kill you and then make a copy. A perfect, soul-less copy.
I have this vision of the RIAA lawyers as a group of seals clapping their fins and barking, "arp, arp, arp, arp". not sure why.
I think of them more as hyenas, vultures, or wild dogs.
Ray Beckerman +5 Insightful