Slashdot Mirror
NSA Patents a Way To Spot Network Snoops
narramissic writes "The National Security Agency has patented a technique for figuring out whether someone is messing with your network by measuring the amount of time it takes to send different types of data and sounding an alert if something takes too long. 'The neat thing about this particular patent is that they look at the differences between the network layers,' said Tadayoshi Kohno, an assistant professor of computer science at the University of Washington. But IOActive security researcher Dan Kaminsky wasn't so impressed: 'Think of it as — if your network gets a little slower, maybe a bad guy has physically inserted a device that is intercepting and retransmitting packets. Sure, that's possible. Or perhaps you're routing through a slower path for one of a billion reasons.'"
Or perhaps you're routing through a slower path for one of a billion reasons.
I knew taking that left turn at Albuquerque was a bad idea...
They don't want any of US to have access to such technology when THEY slap the monitoring devices on our network.
âoeAny society that would give up a little liberty to gain a little security will deserve neither and lose both.
Of course there can be a billion reasons as to why some packets will take longer than others to reach their destinations.
However, if you do enough sampling over a period of time, you can make averages and see if some types/destinations of packets are possibly being messed with.
It's not perfect, but neither are averages in general, etc.
What makes it newsworthy is that such a simple idea was granted a patent.
This is another example of the broken patent system. No government should be able to patent something--that technology was funded by the taxpayer and should thus be owned by the taxpayer, meaning that it is public and thus not patentable.
Colin Dean Go a year without DRM
Uh oh, someone stole the plans for the NSA Tape Dispenser, it is missing from their Domestic Technology Transfer Program website! http://www.nsa.gov/techtrans/techt00075.cfm
these false positives really begin to add up. Couple this will all the lame-brained terrorist detection schemes that create millions of false positives and we can see the plan to get America out of recession is to have every single citizen working for the government hunting snipe.
Because they are going to drop all their other methods of intrusion detection for this? It seems like a reasonable cue for a warning for something that is difficult to pinpoint. Especially if that warning were to kick off an automated task that kicked off a more intensive search/monitoring process.
The patent was filed May 24, 2005. Googling for 'computer slow spyware 2004' gives 127,000 hits.
A pizza of radius z and thickness a has a volume of pi z z a
It is not just measuring speed of network it is apparently measure differences in speeds of different network layers, or types of network traffic. Network congestion affects generally all types of packets the same. Snooping presumably may take longer to identify certain types of packets.
Oh and a passive tap will only work with certain protocols, it can't work (or not easily) with Gigabit ethernet for example.
"NSAapp: Latency change detected in segment AA23. No idea what it might mean. Send the intern."
Looking at the article, (and having skimmed but not read all of the patent), isn't AntiSniff (released by DilDog of L0pht in 1999) using this technique? (Slashdot article, Aug '99)
Original tech paper was on l0pht.com (now defunct) - looks like archive.org doesn't have a mirror, here's the best copy I could find in Google: http://servv89pn0aj.sn.sourcedns.com/~gbpprorg/l0pht/antisniff/tech-paper.html
o/~ Join us now and share the software
How come I have the sneaky feeling, that if the NSA discovered anything really spectacular ... I wouldn't be reading about it on Slashdot?
"Cracking WPA2? No problem but it is patented by the NSA and documented by the USPTO" ... so you can read about it, but you have to license it from the NSA, if you want to use it.
That business model ought to work.
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
i remember a while back a firend of mine that workd for a college was tasked with trying to find a person who was sniffing peoples logins on the campus wifi.. what he ended up doing was sending out garbled truncated packets - turns out that windows boxes running things like etheral would get the truncated packet and then request the rest of the packet even though it wasn't addressed to them.. very clever way of finding the stupid ones.. luckly the person they where after was stupid
'...if only "Jumping to a Conclusion" was an event in the Olympics.'
that randomly adds delay to each packet before rebroadcasting it...making it impossible to get a good bearing on the latency in the network once it's installed.
siphoning off date...
What? They could hack a government agency but they couldn't figure out NTP? I call shenanigans.