Slashdot Mirror
Tool To Allow ISPs To Scan Every File You Transmit
timdogg writes "Brilliant Digital Entertainment, an Australian software company, has grabbed the attention of the NY attorney general's office with a tool they have designed that can scan every file that passes between an ISP and its customers. The tool can 'check every file passing through an Internet provider's network — every image, every movie, every document attached to an e-mail or found in a Web search — to see if it matches a list of illegal images.' As with the removal of the alt.binary newgroups, this is being promoted under the guise of preventing child porn. The privacy implications of this tool are staggering."
TFA says they're going to use hash values. This will take a stateful packet inspection filter to catch, but the amount of state is only enough do the hash, and they can throw it away if it doesn't match anything on the blacklist.
While hashing seems easy enough to get around, I think the real thing they're looking for is a repeated pattern of someone sending blacklisted images. If you send/receive thousands of images, there's a good chance that you'll screw up and maybe a dozen of them won't get resampled (or use some other trick) to change the hash value. you'll pop up on a screen someplace, they'll get a search warrant, and you are busted.
They claim they can scan Gnutella and BitTorrent.
Gnutella I don't know, but BitTorrent, almost certainly.
The common forms of BitTorrent encryption uses a "shared secret". The shared secret for BitTorrent is a 20-byte key known as the "infohash". This infohash is ALSO used as the unique hash to uniquely identify a given set of files. So its ALWAYS given to the tracker, and if the tracker isn't using SSL, that means its in the clear.
Making the encryption in BitTorrent almost laughably insecure. It's good enough to block non-stateful packet filters. It's not good enough to prevent people from listening in.
As for getting a file hash with BitTorrent, that's even easier.
It does it for them.
The ".torrent" file contains a list of hashes. They don't even need to look at the file contents.
I dunno about other P2P systems, but BitTorrent is definitely not safe from this.
Even better... What happens if you send traffic to a user with one of the "bad files" in it? They don't need to have a connection open in order for you to send a jpeg to them. Even if the user's computer simply drops the unknown data, the ISP will pick it up in their scan. If all the software does is scan the hash values of images transferred over common protocols, I seriously doubt that it goes and checks to see if the user actually REQUESTED it before crying foul.
One step further: make a file that has the same hash value of a "bad" file. This is trivial, especially if the file doesn't need to be valid for any application. If all that is checked is a hash of the traffic, then the actual contents of the file are meaningless.
So, this software will allow law enforcement to ruin your life (any implication crime involving sex and/or kids will do that, guilty or not), by simply seeing an unknown party send you a block of unintelligible data that happens to have the same hash as "pr0n." Great.
Anyone up for making an automated hash-spoofing packet forger? I'm sure something similar has already been done. With the speed of current connections, one could probably get the entire human race indicted for child pornography in under a week.
Encrypted files on the peer-to-peer network could not be decrypted by CopyRouter, but the company claims it can fool the sender's computer into believing that the recipient was requesting an unencrypted and uncompressed file.
So basically what they do, is if your bittorrent client requests the files in encrypted format, they intercept that and instead request them unencrypted. They aren't decrypting the file, they are just asking for an unencrypted transmission of the file. If the file is in an encrypted zip file, then there is no way that they could see the actual files being transmitted.
I was about to bring up that point. KaZaA was linked to BDE (maybe a parent company or something). I'm not too sure of the exact relationship, but there definitely was one there.
Now correct me if I'm wrong, but wasn't one of the defenses in the KaZaA court case the fact that they couldn't tell what files users were sharing, therefore they claim they weren't responsible for the distribution of copyrighted material? If this was the case, BDE's new "we can tell what you're sending/receiving" crap could land an A-Bomb worth of trouble in someone's lap.
You moved your mouse. Please restart Windows for changes to take effect.