Slashdot Mirror
NSA Patents a Way To Spot Network Snoops
narramissic writes "The National Security Agency has patented a technique for figuring out whether someone is messing with your network by measuring the amount of time it takes to send different types of data and sounding an alert if something takes too long. 'The neat thing about this particular patent is that they look at the differences between the network layers,' said Tadayoshi Kohno, an assistant professor of computer science at the University of Washington. But IOActive security researcher Dan Kaminsky wasn't so impressed: 'Think of it as — if your network gets a little slower, maybe a bad guy has physically inserted a device that is intercepting and retransmitting packets. Sure, that's possible. Or perhaps you're routing through a slower path for one of a billion reasons.'"
They don't want any of US to have access to such technology when THEY slap the monitoring devices on our network.
âoeAny society that would give up a little liberty to gain a little security will deserve neither and lose both.
This is another example of the broken patent system. No government should be able to patent something--that technology was funded by the taxpayer and should thus be owned by the taxpayer, meaning that it is public and thus not patentable.
Colin Dean Go a year without DRM
Because they are going to drop all their other methods of intrusion detection for this? It seems like a reasonable cue for a warning for something that is difficult to pinpoint. Especially if that warning were to kick off an automated task that kicked off a more intensive search/monitoring process.
Also newsworthy as the NSA is an organization with theoretically no commercial interest. So they're filing for a patent for what reason?
To have the work out there for the general public to read. Remember besides patents having protections for their inventor it also provides that the inventor publish their invention or breakthrough in public view. I suggest this is the easiest way to have this work in the public domain so to speak.
So, if you slip your monitoring gear in on day 1, the only way it would be detectable is if you took it off, and the packets started going faster.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
It is not just measuring speed of network it is apparently measure differences in speeds of different network layers, or types of network traffic. Network congestion affects generally all types of packets the same. Snooping presumably may take longer to identify certain types of packets.
Oh and a passive tap will only work with certain protocols, it can't work (or not easily) with Gigabit ethernet for example.
Looking at the article, (and having skimmed but not read all of the patent), isn't AntiSniff (released by DilDog of L0pht in 1999) using this technique? (Slashdot article, Aug '99)
Original tech paper was on l0pht.com (now defunct) - looks like archive.org doesn't have a mirror, here's the best copy I could find in Google: http://servv89pn0aj.sn.sourcedns.com/~gbpprorg/l0pht/antisniff/tech-paper.html
o/~ Join us now and share the software
How come I have the sneaky feeling, that if the NSA discovered anything really spectacular ... I wouldn't be reading about it on Slashdot?
"Cracking WPA2? No problem but it is patented by the NSA and documented by the USPTO" ... so you can read about it, but you have to license it from the NSA, if you want to use it.
That business model ought to work.
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
However, if you do enough sampling over a period of time, you can make averages and see if some types/destinations of packets are possibly being messed with.
And at that point it is much too late and your data is already compromised. I mean, how much sampling would you need to be sure that the cause of the delay is snooping versus some clod bringing a hub into work.
that randomly adds delay to each packet before rebroadcasting it...making it impossible to get a good bearing on the latency in the network once it's installed.