New Tool Promises To Passively ldentify BitTorrent Files

QuietR10t writes "A new technique has been developed for detecting and tracking illegal content transferred using the BitTorrent file-trading protocol. According to its creators, the approach can monitor networks without interrupting the flow of data and provides investigators with hard evidence of illicit file transfers. 'Our system differs in that it is completely passive, meaning that it does not change any information entering or leaving a network,' says Schrader." I wonder if it can specifically identify legal content, too.

Comments

Carrier Status?

[oahazmatt]

So, if for instance, Verizon or AT&T start using this tool, does that mean they lose common carrier status?

Re:Carrier Status?

[commodore64_love]

I wish people would stop repeating this urban legend. ISPs do NOT have common carrier status. I wish they did, but they don't.

Re:Carrier Status?

[Jane Q. Public]

They SHOULD. As long as they do not alter or supply content themselves.

The whole concept of common carrier was to account for services such as ISPs. Of course telephone systems were the first real examples, but the concept is still the same: a communications channel, where a service can carry those communications from point to point, without altering, supplying, or monitoring content.

I know of no logical reason why ISPs should not be "common carriers". They are ideal candidates to be. As long as they keep their fat fingers off the content.

And THEY should be in support of the concept, because if they cannot claim the "common carrier defense" (i.e., no responsibility for content), then they have some very heavy legal liability issues that common carriers do not have to deal with.

Re:Carrier Status?

[click2005]

How would you start lobbying congress about making it reality? Common Carrier status in exchange for Net Neutrality.

When the phone companies switch to a fully IP based network like BT is doing over here in the UK, will they lose the common carrier status?
The difference between Telco & ISP is so thin these days already that i'm surprised the law has never been updated.

I'm not asking you specifically, just anyone who might know.

Re:Carrier Status?

[Anonymous Coward]

ISPs have no interest in being considered common carriers, because they already get all the same legal protections, without needing to meet the requirements or possibly lose the protection if they fail to meet them.

Re:Carrier Status?

[Kjella]

The short story: There's more to being a common carrier than lack of liability, and ISPs don't want it. ISPs have liability protections under USC 17512 which are very strong and thus under heavy lobbying attack, but they are *not* repsponsible for content today. Read it yourself, it's surprisingly clear.

Re:Carrier Status?

[Anonymous Coward]

"...then they have some very heavy legal liability issues that common carriers do not have to deal with."

I've always wondered how Earthlink, RR, etc. can get away with all the warez, music, movies, and porn hosted on their own usenet servers, and made available to their subscribers.

Re:Carrier Status?

[Wesley Felter]

Usenet probably counts as a cache under section 512(b) of the DMCA; as long as ISPs process takedown notices correctly they have no liability. Also see ALS Scan v. Remarq. IANAL.

Re:Carrier Status?

[tonyray]

The reason ISP's are not common carriers dates back to dial-up modem Internet. The Telco's wanted to charge ISP's by the minute just like they do long-distance carriers for access to their network. The FCC got involved in this and used AOL as a model. AOL had these huge caching servers so AOL customer's web page requests rarely went out onto the Internet; instead they were served from the caches. So the FCC ruled that ISP's were delivering content and were not themselves carriers.

The Telcos are now (with broadband) satisfied with the content provider status as it saves them a lot of headaches, fees and taxes on their own Internet services. Broadband is far closer to a carrier service than a content service, but I don't see thing changing.

Re:Carrier Status?

[Gerzel]

And if they can control the content they can charge more for it not only by charging the sender and receiver but also by adding in third party content such as commercials.

Re:Carrier Status?

[Jane Q. Public]

You think I don't understand this?

If you read the content of USC 17512 yourself, you will see that it addresses exactly the same kind of protections that I stated, and that if they do alter or supply the content, they lose the protection of the law. While this does not directly pertain to actual, "official" common carrier status, this is still often referred to as the "common carrier defense", since the principal is exactly the same. Why did YOU not know that?

In any case, since that is out of the way: what are these other reasons that you assert are the cause of ISPs not wanting to be common carriers? That is more to the point.

Re:Carrier Status?

[Jane Q. Public]

This is a very good point and part of what I was saying. I see no ACTUAL difference between what were once known as "common carriers" and ISPs, EXCEPT that they seem to want to provide content.

However, here in the U.S., the government (the FCC in particular) has historically been adamant about keeping carriers and content separate, largely because of the danger of monopolistic practices on the part of a corporation that was both the content carrier and the content provider. Another concern was that if carriers (which tend to be large and centric) controlled content as well, there would be too much control over services like news, for example. And I see no logical reason that policy should change, considering that the concerns are at least as valid today as back when the policy was first formulated, decades ago.

Re:Carrier Status?

[Jurily]

Usenet probably counts as a cache under section 512(b) of the DMCA; as long as ISPs process takedown notices correctly they have no liability.

alt.binaries.takedownnotices?

Re:Carrier Status?

[Anonymous Coward]

This is an opinion, NOT legal advice; for legal advice, please see a competent attorney in your jurisdiction.

An ISP which provides access (and does not host end-user systems directly on its network) doesn't have, and has never had, "common carrier".

They do, however, have immunity for liability under monetary relief for copyright infringement under 17 USC 512(a) (Digital Millennium Copyright Act), unless they filter, modify or cache their traffic. (Cache is covered under (b), hosting under (c); note there are no required takedown provisions under (a), i.e., takedowns are not valid in that context.)

[Please note that (j)(1)(B)(i) provides that they can be made the subject of injunctions to cut the downstream off if in the US by terminating the infringing account [if identified], and (ii) that they can be ordered to take "reasonable steps specified [...] to block access, to a specific, identified, online location outside the United States". But that's it. No ex parte Orders (excepting Orders "ensuring the preservation of evidence or other orders having no material adverse effect on the operation of the service provider's communications network"). No equitable relief. No monetary relief.

Whether or not actually complying with such an Order would constitute an action which could affect your immunity under subsection (a) is, however, unclear; this may be an oversight in the drafting of the statute.

But, then, I'm not qualified in the US, so I'm leaving that question open to the ones who are.]

Re:Carrier Status?

[kegger64]

I agree with the point of your post, but telephones were not the first examples of common carriers. Things like buses, trains, and ships were common carriers long before the telephone.

Re:Carrier Status?

[HTH NE1]

alt.binaries.takedownnotices?

Such a group would require the notices to be binary-encoded. There's no compelling reason why alt.binaries.d can't be used for the same purpose which already has an exception for non-encoded content.

Re:Carrier Status?

[Dun Malg]

I wish people would stop repeating this urban legend. ISPs do NOT have common carrier status. I wish they did, but they don't.

The "safe harbor" provisions of the DMCA create a situation for ISPs that gives them common carrier status in all but name. So yes, people should stop saying "give up their common carrier status", and instead say "fail to meet the conditions of DMCA Safe Harbor".

Re:Carrier Status?

[Jane Q. Public]

But they were not in a position to supply content themselves. :o)

Re:Carrier Status?

[Jane Q. Public]

They still have liability if they supply, alter, or control the content in any way. As long as the content is supplied by others, and remains unaltered and uncensored, then there is no liability.

Oh, yes, that is another important point. Censorship or moderation of a forum is de facto control of content, which generally means that the censor has legally assumed liability (or at least some of the liability) for that content.

For example, in a libel case involving an AOL online chatroom, both the poster of the alleged libel and AOL were named as defendants. AOL tried to wiggle out of the suit by claiming immunity via the "common carrier defense", but the judge did not allow that because they moderated the chatroom, which means they actively controlled the content.

Re:Carrier Status?

[coretx]

How is this relevant ? Since the USA is supposedly a democracy, I am NOT interested in legal arguments. However, I AM interested in political arguments. Arguments that SHOULD come from us, slashdot folks.

Re:Carrier Status?

[pxlmusic]

yeah, and i bet they're all posted in yEnc, too...

Re:Carrier Status?

[fulldecent]

The problem is that no one is suing ISP's for libel, copyright infringement and trademark issues (for content they are transferring). If we were doing our jobs, ISP's would WANT to be common carrier.

Encryption?

[hansamurai]

I'm assuming this has no chance of defeating encrypted connections?

Re:Encryption?

[fuzzyfuzzyfungus]

TFA confirms it, near the end of the second page. It also only currently works at 100 megabits/second.

Re:Encryption?

[eldavojohn]

I'm assuming this has no chance of defeating encrypted connections?

The article explicitly says it cannot recognize encrypted files as the method cannot identify them with a hash. Although, I doubt anyone could think of a good way to ID files in encrypted BitTorrent.

I thought my summary submitted this morning did a better job describing this but you should note that this has some key things to overcome before it can be used:

• Has not been tested for false positives (explicitly stated by a researcher in the article). This has been known to totally render a technology unusable (face recognition, anyone?).
• Their device only works on up to one hundred megabit per second before it starts to act as a choke point which makes it usefull only on a small scale (not for police/ISPs).
• Does not work on encrypted files.

They seriously need to overcome these obstacles before illegal file sharers should worry about it being used to target people.

Re:Encryption?

[jandrese]

TFA specifially says that it doesn't work on encrypted traffic. In fact the whole thing seems to have some rather bogus qualities to it.

It uses a FPGA, but is stuck at a rather pokey 100Mbps. All it does is compare the encoded hash value in the Bittorrent header against a list of known illegal hashes. Hashes you have to program manually.

I've seen commercial boxes that you can already buy that do a lot more than this and faster. He made a big deal about it not disturbing the network, but that's a standard feature. Unless this thing is dirt cheap or something, I don't really see the application.

Re:Encryption?

[genner]

TFA confirms it, near the end of the second page. It also only currently works at 100 megabits/second.

So my oc4 line is safe!

Re:Encryption?

[El Torico]

I've seen commercial boxes that you can already buy that do a lot more than this and faster. He made a big deal about it not disturbing the network, but that's a standard feature. Unless this thing is dirt cheap or something, I don't really see the application.

I think that the manufacturer will try to pimp this as an "IP Compliance Product" to ISPs and madly lobby every politician they can bribe, err, I mean donate to.

Re:Encryption?

[Dreadneck]

They seriously need to overcome these obstacles before illegal file sharers should worry about it being used to target people.

I strongly disagree. People need to start raising hell about this Big Brother bullshit now. Technology like this operates under the assumption that ALL users are criminals until proven innocent and blatantly violates the 4th amendment(in the U.S. at least).

Furthermore, does anyone here honestly believe that this type of technology will only be used to stop copyright infringement and kiddie porn? This technology smacks of oppression and the quashing of political dissent.

Re:Encryption?

[Ender Wiggin 77]

Technology like this operates under the assumption that ALL users are criminals until proven innocent and blatantly violates the 4th amendment(in the U.S. at least).

I don't see how monitoring assumes all users are criminals. Do police speed traps assume all drivers are speeders?

Re:Encryption?

[Joce640k]

It knows every "illegal" hash on the Intertubes?

If it does that's more newsworthy than the gadget itself.

Re:Encryption?

[Gerzel]

1 The False positives problem will be ignored. Already most people and lawmakers consider bit-torrent as a whole to be file sharing and thus piracy. Now they have a way to "ID" the criminals or at least their files. The false positive might work in court but your net connection would be gone long before that case comes due.

2. This might have a chance to work, provided legislation isn't passed to counteract net neutrality. If such is passed this would easily meet any definition of "reasonable" as would any number of other abuses.

3. Why are they encrypted? Must be REALLY guilty then. Though the real problem here is you'll also have to share the keys as well Not much of a problem mind you but a bit more overhead.

Re:Encryption?

[Gerzel]

The reason we go after copyright infringement, kiddie porn(well porn in general as it is always lumped in if at all possible to kiddie porn), and things like majauana is to make as much of the general populace guilty of something that is both against the law and seen as deeply wrong with the person.

Once this is achieved the person can easily be moved to a status of lesser or non-personhood.

Example is a "Sex Offender" law. Such laws are created inevitably to protect children. However, sex offender includes any offense that is deemed sexual in nature. Public nudity, an argument with a spouse that turns violent which may indeed be an isolated incident and as much at fault with the spouse(I'm not talking about someone who regularly beats their spouse), or just pissing on the sidewalk because there is no where else to go for miles. Everyone is lumped in and assumed to behave like the worst offenders in the group, the serial rapists and violent pedophiles.

Re:Encryption?

[noidentity]

this has some key things to overcome before it can be used:

* Has not been tested for false positives (explicitly stated by a researcher in the article).

Here's my implementation. It also hasn't been tested for false-positives, but I'm hopeful:

bool is_illicit_content( /* may need parameters in the future */ ) { return true; }

Re:Encryption?

[Ironica]

I think more accurately, do license plates and the ability for police to look them up assume all drivers are breaking the law?

Re:Encryption?

[Dreadneck]

Right, because we all know that this technology couldn't possibly be used to analyze anything other than bittorrent traffic. It would be totally impossible to use it to inspect emails, right? That's just crazy science fiction - no way could it happen in the real world. Besides, we all know that only criminals use bittorrent. Who would possibly think of using it to distribute political documentaries or leaked government documents?

Re:Encryption?

[nemesisrocks]

Similar to police speed traps: red light cameras.

Both of these devices assume that you're guilty until proven innocent. There can be legitimate reasons for crossing the white line when the light is red -- for example, to move out of the way for an emergency services vehicle.

I had a friend who was booked for running a red for this exact reason. He had to take it all the way to court to have the fine (and demerit points) dismissed.

Re:Encryption?

[Dreadneck]

You're conflating a privilege - driving an automobile on public roads - with a constitutionally protected right against unwarranted search and seizure of private communications. Even so, if a cop is sitting at a speed trap checking the speed of every vehicle that passes by, then, YES, the assumption is that everyone is breaking the law until proven innocent by the radar gun.

Re:Encryption?

[cbiltcliffe]

Depends how it works.

I'm betting something like this:

$data = read_data_stream($eth)
if (get_protocol($data) == "bittorrent")
      {
      $illegal_content = 1;
} else
      {
      $illegal_content = 0;
}

In which case, encrypted or not, you're still guilty.

Re:Encryption?

[cbiltcliffe]

Sure it is. But when it seems to slow down to 100Mb, shortly, it's just network maintenance. Honest.

Re:Encryption?

[UnknowingFool]

From what I understand, the technology relies on fingerprinting and lists. It tries to match a bittorrent's 32-bit header data matches to that of a known illegal download on a list. But who gets to set this list? What about false positives? "Yes, this 'Ubuntu' is on the list. This 'WoW-Update-3.0' is also on the list. Well, we're not sure what this 'Ubuntu' is and 'WoW' is obviously a bittorrent of Windows."

Re:Encryption?

[cerberusss]

All it does is compare the encoded hash value in the Bittorrent header against a list of known illegal hashes. Hashes you have to program manually.

That sounds exactly how Snort works.

I guess if you had a bunch of hashes, you could put these in a configuration and basically have the described functionality.

I've analyzed Snort more than 6 years ago and also remembered that it couldn't operate on more than 100Mbit. Might've been a change here and there, though.

Re:Encryption?

[Ironica]

Oh, geez. Is that really Interesting? I mean, thanks for the karma, but I'm not hurting for it, and I couldn't even *remember* what I'd posted. A refinement of a car analogy? I should get modded -1 Redundant!

Re:Encryption?

[purpleraison]

I don't see how monitoring assumes all users are criminals. Do police speed traps assume all drivers are speeders?

Duh... yes! That's why you even get the old-farts who are already going 10mph below the speed-limit slamming on their brakes when they see a speed-trap... and hence the friggin name 'SPEED TRAP'...

Re:Encryption?

[Stray7Xi]

I think more accurately, do license plates and the ability for police to look them up assume all drivers are breaking the law?

It's not just the ability to, it's the automated constant use of it. More correct analogies:
-The TSA checking every passenger against a terror watchlist.
-Roadside cameras reading every license plate to find stolen cars and people with warrants on them.

It's all a matter of how accurate of signature it is.

Re:Encryption?

[Dun Malg]

Right, because we all know that this technology couldn't possibly be used to analyze anything other than bittorrent traffic.

Indeed we do. How do you (for example) spot a random "subversive" comment in an email with a tool designed to calculate the hash of a series of bittorrent blocks that make up a file and compare it to a known library of "infringing" hashes? Seriously, I would like to hear you explain how you think the tool could be adapted to a different, more sinister task.

Re:Encryption?

[Dun Malg]

You're conflating a privilege - driving an automobile on public roads - with a constitutionally protected right against unwarranted search and seizure of private communications.

The old saw "driving is a privilege, not a right" doesn't give law enforcement carte blanche to ignore the constitution entirely.

Re:Encryption?

[Dreadneck]

You're right. What was I thinking? It's utterly impossible to write additional software to conduct different analyses on the traffic. Whew! Now that we've cleared that up, I guess my concerns were overblown after all.

Re:Encryption?

[thePowerOfGrayskull]

-Roadside cameras reading every license plate to find stolen cars and people with warrants on them.

Alright, I know this won't be a popular view, but is that a Bad Idea?

I don't mean the theoretical slippery slope arguments about loss of privacy - if you're out driving, you don't have it to begin with. Who loses in this scenario? The guy who gets his car back... guess not him. The people driving legal cars? Nuh uh. The people driving who have no outstanding warrants? Nope, not them either. Seems the list of people who actually lose is pretty narrow (ie, those who have stolen or have warrants out for them).

Naturally, it can be abused - Anything designed to aid law enforcement can be abused and it would be a lie to say that such tools are /not/ ever abused. But is that enough to make it a bad idea?

Re:Encryption?

[thePowerOfGrayskull]

Hey look, that pixel at 1:37:24 of that James Bond movie got changed from red to blue! Looks like the entire hash will be completely different now.

Also meaning that a new way of validating torrents is needed -- since any client checksum of that segment would fail. Or creating many torrents of the same thing, but that would seem to defeat the purpose.

Re:Encryption?

[thePowerOfGrayskull]

Say... that raises an interesting (to me) question.

How do they get those known illegal hash values in the first place? Sounds like somebody had to visit pirate bay and run a torrent download to completion in order to determine the hash... given the nature of most bittorrent clients, and the flimsy evidence used to present such cases, that means these people have been Making Available! Burn them!

Re:Encryption?

[mochan_s]

I was wondering, would this defeat this scheme?

Let bittorrent deliberately make errors in the data transmitted. Hashing is very sensitive to small changes.

Also, transmit it with error correcting codes so that it can be put back together by the receiver but the hasher gets garbage.

Finally, so that the hasher doesn't do the error correcting themselves, send the parity encrypted with the keys exchanged beforehand.

I suppose it's still open to man in the middle attack though.

Re:Encryption?

[CoderJoe]

The more logical way to go about it would be using the "info hash" value, which you can compute with nothing more than the .torrent file. It is the hash value the client reports to the tracker, and the hash value that clients tell each other during the connection handshake in order to agree that they are talking about the same torrent.

Now, there is the problem of hash collisions, as the bittorrent protocol takes an arbitrary length of mostly arbitrary data and hashes it down to 20 bytes. What happens when you have a linux iso download that happens to have the same info hash as Star Wars XXIII or a kiddie porn pack?

Re:Encryption?

[thePowerOfGrayskull]

That makes sense, thanks. If they're actually relying on that 20 byte hash, I would say this tool is even more useless than it first seems (which is impressive) - except possibly as a tool to encourage 'settlements' with people who don't know better.

Re:Encryption?

[BitZtream]

Yes, your 'oc4' is probably safe. (I'm assuming that why you are marked as 'funny', can't imagine a time when THAT could be considered funny, but whatever).

But saying 'it only works at 100mb/sec' is silly. Perhaps thats all one physical device can monitor, but clustering isn't exactly new something new or hard to work out for these situations.

So it takes 2 machines to handle what comes through a OC3, or 7 to deal with an OC12, but pretending it can't be done at high speeds would be ignorant at best.

Re:Encryption?

[BitZtream]

Paranoia much?

Re:Encryption?

[BitZtream]

Dude, its a slightly modified tcpdump designed to run on one of those Atmel AVR + FPGAs on a chip. He hasn't optimized it for the AVR processor yet, and he needs to get the chip with 40k gates instead of 10k, but then he'll get it above 200MB!

I joke, but it really wouldn't surprise me if it were true. Someone should tell them that pretty much any modern PC can do what he's claiming, and do it faster.

It REALLY does sound like a very simple application since your not really doing anything different than what the client is doing. Watch the data, generate hashs, check against known hashes, signal if match. So you need a lot of ram, a good data structure to make searching quick enough and some custom code.

I donno, should take a good hax0rs what, 2 days to produce something with a GUI on a Linux or BSD box using OSS that would do what they are claiming?

Or better still, isn't this right up the ally of IDS software? I know your not really doing 'intrusion detection' in this case, but its all just pattern matching, which is what IDSes were made for.

Re:Encryption?

[shogun]

I don't see how monitoring assumes all users are criminals. Do police speed traps assume all drivers are speeders?

Wrong analogy, this is more like searching every car on the road as its leaving or entering a driveway.

Re:Encryption?

[Danse]

Not exactly dissent, but it's certainly something that the government doesn't like seeing released.

Re:Encryption?

[Dreadneck]

Question authority much?

Re:Encryption?

[EdIII]

Even so, if a cop is sitting at a speed trap checking the speed of every vehicle that passes by, then, YES, the assumption is that everyone is breaking the law until proven innocent by the radar gun.

Look, I am a *BIG* supporter of the 4th amendment, privacy, anonymity, and good ol' fashion freedom. That being said, your statement is Grade A Bullshit, no offense.

As you stated, we are driving on public roads. Driving is also a privilege and not a right. Cops are supposed to be on the roads making sure that motorists are complying with traffic laws. Until a cop is reasonably certain you are in violation of a traffic law, they CANNOT stop you. Pacing you to determine your speed is not violating your constitutional rights and cannot possibly be construed as "guilty before innocent". It's not harassment either, and motorist does not need to be concerned or feel persecuted by the presence of a police officer driving next to them. A radar gun does make a difference either and is not an invasion of privacy.

If you were guilty until proven innocent by the information provided by a radar gun then a cop could stop you AT ANY TIME and issue a ticket based on the presumption of guilt. Well that is obviously not the way it happens is it?

Re:Encryption?

[andy.ruddock]

The police in the UK have a system fitted to some cars which reads the plates on all oncoming vehicles and automatically checks them against various criminal databases.

Re:Encryption?

[FTWinston]

All it does is compare the encoded hash value in the Bittorrent header against a list of known illegal hashes. Hashes you have to program manually.

So in fact, to know whether you're downloading something illegally or not, they'll first have to download EVERY ILLEGAL FILE OUT THERE :O
We've got them!

Re:Encryption?

[L4t3r4lu5]

How difficult is it to make a hash of the text "subvert the government"?

Re:Encryption?

[mihkelh]

this has some key things to overcome before it can be used:

* Has not been tested for false positives (explicitly stated by a researcher in the article).

Here's my implementation. It also hasn't been tested for false-positives, but I'm hopeful:

bool is_illicit_content( /* may need parameters in the future */ ) { return true; }

I suspect that overall success rate when tesing your implementation on real bittorrent traffic could still be impressive.

Re:Encryption?

[Stray7Xi]

That was my point, it's a reasonable idea when you can expect no false positives. I used the terror watchlist as a counter example of how it can be bad when you do have significant false positives.

Evil Bit

[Lord Byron II]

For the record, I have a rule in my iptables that specifically turns off the "evil bit" in any of outgoing packets. Thank God for Linux! =)

Re:Evil Bit

[VValdo]

wut

It's all detailed in RFC3514.

W

Re:Evil Bit

[pitterpatter]

Moderators, this is a textbook example of a "funny" post. On that basis, I think it deserves a 4 or 5. But it isn't otherwise that interesting, IMHO.

Re:Evil Bit

[DiegoBravo]

> Slashdot does not reward karma for "funny" mods

Yes, and this is one of the silliest things in /. The most informed and insightful teachers I had at school and university were also funny most of the time when delivering lectures, and of course this applies for comments too.

Re:Evil Bit

[Bryansix]

I actually have an iptable rule that does this. It is below:

iptables -I FORWARD -i eth0 -o eth1 -m iprange ! --src-range 192.168.1.251-192.168.1.253 -p tcp --dport 25 -j DROP

That is where my exchange servers sit within the 192.168.1.251-192.168.1.253 IP range.

Encrypted traffic...

[bleh-of-the-huns]

Till they come up with a good way to figure out whats going across the network encrypted, they will just be wasting their time.

Re:Encrypted traffic...

[azgard]

In theory, they could attack encryption with man-in-the-middle during the key exchange. If the protocol is known, the middle man can simulate the other end node for both nodes, and give each one a different key, so they can still see the traffic.

Re:Encrypted traffic...

[Kjella]

And if they did that, we could start having the tracker negotiate SSL keys for us. If they tried going after the tracker traffic, we could make that HTTPS. If they started faking the certs, we could move to OpenDNS or install a "trusted" torrent root cert. That is a battle they could not win.

Re:Encrypted traffic...

[azgard]

Well, eventually, people would have to exchange the trusted torrent root certificates directly (i.e. not over the network). And they could be filtered by the network.

I think the scheme is in principle possible, but probably very much impractical. You could perhaps create an order of magnitude more music, movies and videogames for the sheer cost of the setup required to negotiate all the encryption keys in the central government server.

Re:Encrypted traffic...

[Shakrai]

In theory, they could attack encryption with man-in-the-middle during the key exchange

In theory, isn't this (or shouldn't this) all be illegal under wiretapping laws anyway?

As a private citizen I don't have the right to start monitoring my neighbors phone calls (even if those calls are broadcast into my house without encryption) just because I suspect she is dealing drugs. What gives my ISP the right to start monitoring my packets just because they suspect I'm pirating something?

Re:Encrypted traffic...

[headbulb]

He was talking about using a man in the middle attack. Both parties think they are talking to eachother.

It doesn't matter if the tracker sends us a SSL key for us if a man in the middle attack can be used. The only way to be sure the key isn't altered is to get that key directly from the source. How you do that is up to you.

There isn't much that is open about "OpenDNS". OpenDNS is a bad solution for a non-issue problem. Please stop advertising for them.

What we should be fighting for is for isp's to be common carriers. Then there really isn't a market for this type of monitoring hardware. Other then for some company firewall.

Re:Encrypted traffic...

[iminplaya]

What gives my ISP the right to start monitoring my packets just because they suspect I'm pirating something?

The government. You know, those crazy baldheads that keep getting reelected all the time? You gotta vote for the right lizard.

Re:Encrypted traffic...

[Shakrai]

New York State Penal Law:

250.05 Eavesdropping.
A person is guilty of eavesdropping when he unlawfully engages in wiretapping, mechanical overhearing of a conversation, or intercepting or accessing of an electronic communication.
Eavesdropping is a class E felony.

Re:Encrypted traffic...

[Sloppy]

That's a lot of "we could"s. How about just using the global OpenPGP WoT, and stopping the problem in its tracks?

Once you have a distributed authentication system (which is what lets you exchange keys safely), email is just one of the applications you can build on it. Sounds like you guys have another. Whatever. The more things it's used for (the more people who connect to the WoT) the better it works for everyone.

Quit building a redundant but also specialized infrastructure, and instead, join the original.

Re:Encrypted traffic...

[Kjella]

It doesn't matter if the tracker sends us a SSL key for us if a man in the middle attack can be used. The only way to be sure the key isn't altered is to get that key directly from the source. How you do that is up to you.

Wrong, wrong, wrong. Or well, if you don't trust the tracker then true but then the whole setup doesn't make any sense. If we both have a secure conneciton to the tracker then the tracker can swap keys for us and there's nothing a man-in-the-middle could do to prevent us from creating a secure peer connection. And if they tried attacking our connection to the tracker, we could use HTTPS and certificates to prevent that. It's you that don't understand.

Re:Encrypted traffic...

[Anonymous Coward]

The word "unlawfully" means that it all depends on who is holding the money.

Re:Encrypted traffic...

[headbulb]

It's funny you just proved my point.

The internet is in an insecure network. How does anyone know if they have a secure connection? Sure they can know this once a private/public key pair has been exchanged. But how do we know that the public key given to us is good if there is man in the middle to intercept the keys between the "trusted groups"

I should have been more descriptive. Without physically exchanging the keys with the other parties there isn't a way for an automated system to know; Without testing, but then the middle man can make it so those tests pass. (A smart human could check)

You're assumption of there being a secure path over an unsecure network is what's wrong. If the keys/certificates can be exchanged in a way of knowing that they havn't been (all) intercepted and then altered Then the encryption would work.

But since there is so much information traversing the network all that I just talked about is theoretical and isn't very probable. Encryption is hairy stuff, since you have to cover all points of possible exploitation.

Do you see what I see? Back to my original point we need our isp's to take on true common carrier status.

Re:Encrypted traffic...

[iminplaya]

You're funny

Re:Encrypted traffic...

[LonghornXtreme]

I am not a lawyer.

The 4th amendment only applies to government actors, or private citizens who are acting in such a capacity that they are deemed the equivalent of a government actor.

The 4th does NOT regulate private citizens' conduct. They could very well bust in to your place and hand over evidence to the police. It would not be a search nor a seizure if a nosy neighbor did it.

You would have to go after the person under some sort of tort action, and then try to convince the police (who they just greatly helped out) to prosecute them.

Regardless, the police have the evidence they need without any Constitutional violation.

I am not a lawyer

Re:Encrypted traffic...

[Shakrai]

The 4th amendment only applies to government actors, or private citizens who are acting in such a capacity that they are deemed the equivalent of a government actor.

Who said anything about the 4th amendment? I said there are generally laws on the books (here is New York's law) that make it illegal for private actors to intercept communications. If I take my alligator clips and jack into the neighbors phone line I don't think I'm going to get away with it by pointing out that the 4th amendment only applies to government actors.

I am not a lawyer

Obviously ;)

Re:Encrypted traffic...

[greenbird]

What gives my ISP the right to start monitoring my packets just because they suspect I'm pirating something?

It's for the children. We must protect the children. Are you one of those evil child porn supporters? If your against this you're a child pornographer.

All you have to do is add this and all politicians will support it and no publication will speak out against it. Haven't you read Mein Kampf?

Re:Encrypted traffic...

[DMUTPeregrine]

If the public key is altered, your secure connection will fail. The private key need not be transmitted. So no, I don't see your point. Unless, of course, they redirect traffic to a fake tracker with its own public key, but that's not a MITM attack anymore.

Re:Encrypted traffic...

[ChrisA90278]

What gives my ISP the right to start monitoring my packets just because they suspect I'm pirating something?

Likely the contract you signed gives then permission to look at any data going over the wire. Did you actually read all of it?

Re:Encrypted traffic...

[headbulb]

Don't really need a fake tracker. Just a way of intercepting the traffic.

If I can get the trackers traffic and clients traffic to be redirected to me first then any traffic after that can be altered and appear to be from the two hosts. If I replace the keys with my own then my host will look like the host the two hosts are expecting but using my public key instead.

What you're assuming is the secure connection was brought up in a secure way. If it isn't then you can't really be sure the connection is secure.

Re:Encrypted traffic...

[BitZtream]

Uhm, one of the design points of PGP is to not allow it to depend on any infrastructure so that infrastructur can not be used to damage its security.

That same lack of infrastructure is why PGP is still hardly used anywhere.

Why not use a system that was intended to have an infrastructure from the start instead of trying to pretend PGP was intended to work that way.

And for the record, your WoT could be infiltrated pretty easily, making it utterly worthless as it can't be trusted. So much for stopping the problem in its tracks eh?

Theres a little more to using encryption than just encrypting the data.

Quit trying to use software for something it wasn't intended for while at the same time bitch about being redundant. The original is flawed. Not that it can be cracked, but that its just not worth using. There are 'better' ways to accomplish the same effective security, so you use the original, the rest of us will use the one that fits the situation.

Re:Encrypted traffic...

[Shakrai]

Likely the contract you signed gives then permission to look at any data going over the wire

Contracts don't give them the right to violate the law. If the law makes wiretapping a crime then a contract doesn't negate that crime. If you sign a contract that states "Shakrai can have sex with me anytime he wants" that doesn't give me a get out of jail free card when I rape you.

Re:Encrypted traffic...

[_avs_007]

What certificate are you going to present to the client? If you forged the public key, the cert won't validate, because the client will detect it when it tries to validate the cert chain, as the client won't trust your root cert.

Re:Encrypted traffic...

[headbulb]

If all the traffic is going through the man in the middle then another cert can be inserted.

It's possible but not probable. The reason being that since packets will go to their destinations taking different paths.

So yes if the client already has the cert. But if it has to traverse a compromised network then the cert can be man in the middled too.

This is assuming a perfect setup for doing this man in the middle.

Re:Encrypted traffic...

[LonghornXtreme]

I am not a lawyer.

The 4th amendment matters unless that NY law requires law enforcement to exclude the illegally intercepted communications. If the law doesn't require exclusion of the evidence, then law enforcement can still use it to prosecute you--so what if it was acquired illegally? All that matters is the government didn't acquire the information illegally.

I think my comment was directly on point.

I am not a lawyer.

Re:Encrypted traffic...

[_avs_007]

Uh no, another cert can't be inserted. If another cert is inserted it won't validate.

Re:Encrypted traffic...

[headbulb]

You're not getting it. If ALL the traffic is going through the middle man the middle man can fake everything! Including the cert.

The only way is to get something around the middle man; this may mean giving your public key in person to the other person you want to talk to. Only than can you know that the middle man is there. Since your keys wouldn't match at that point.

The cert is there to make it unreasonably hard to do a man in the middle attack with ssl. It won't do anything with a perfectly executed attack.

Everything I have talked about is possible but extremely unlikely. With the resources used to do such an attack it may be easier to just break down the users door who is using the encryption and torture them for the password.

Don't be fooled into thinking the system is perfect it isn't.

Re:Encrypted traffic...

[Shakrai]

I think my comment was directly on point.

No, you've wandered off onto a completely unrelated tangent. I was talking about laws that make wiretapping a crime. Hence, I'd really like to hear how it is that my ISP can get away with monitoring my packets. I never even mentioned law enforcement so I'm a little bit confused as to why you brought it up.

then law enforcement can still use it to prosecute you--so what if it was acquired illegally? All that matters is the government didn't acquire the information illegally

And your point is? This doesn't make it anymore legal for me to break into the neighbors house to prove she's selling drugs. Yeah, they might be able to use the evidence I collect against her -- but I'm still guilty of breaking and entering and will probably be charged for doing so.

Re:Encrypted traffic...

[_avs_007]

Sounds like you have no idea how certs actually work. Even if you man in the middle the cert, YOU STILL DO NOT HAVE THE CORRECT PRIVATE KEYS TO SIGN THE CERT. When you pass that cert to the client, its cert chain will fail validation, because your certs chain of trust is not trusted by the client.

When you man in the middle a cert, usually you use a self-signed cert, and hope the client doesn't notice.

High level example... If the client trusts the Cert Authority A, and has a cert chain saying A, B, C. Then when it recieves a cert from you, it will expect your cert D, to be signed by C, wwhich will be signed by B, which will be signed by A. If you man in the middle your own cert F, how the hell are you going to manage to get your cert chain signed by A, B, and C?

A man in the middle attack will result in your cert F, usually being signed by F, or some other authority G. Neither of which will validate against A, B, and C, so the client will reject your cert.

Re:Encrypted traffic...

[_avs_007]

If you have a compromised client that's a different story.

However, just because you obtained the software from the internet doesn't necessarily make it vulnerable to man in the middle in and of itself. If you downloaded it from some random place that you never heard of, that's different.

But lets say you get it from uTorrent. If they made it such that you have to go into a secured page on their page, then they would present you with a uTorrent cert, that is signed by a trusted root, lets say Verisign... Your browser ships with this trusted root straight from CD/DVD, OEM, etc, that you bought straight from the store.

Man in the middle may be able to fake the uTorrent site, but they wouldn't be able to fake a cert for uTorrent that is signed by one of the pre-installed trusted roots in your browser.

Now lets say they did manage to fool cert validation... All it would take is for somebody to realize this, then that "bad" cert would get added to the certificate revocation list, and the bad cert will get black listed and get flushed out the next time it tries to validate the cert.

Now I"m not trying to argue this system is perfect, I'm just saying that you make it sound like it's worthless so there is no point in using it. If the user is being a tool and just ignores any and all cert warnings, or doesn't even bother to look at the cert, that is their own fault. No different than writing their password on a piece of paper and taping it to their monitor.

Used _correctly_, this mechanism is quite secure. But if the user is a tool, or the author of said app is a tool, than all bets are off...

Re:Encrypted traffic...

[_avs_007]

That's how you are supposed to use certificates. It's only as secure as your weakest link. In this case, how you provision your root of trust. That's why every client implementation ships with a handful of preinstalled root of trust.

That way when you need to install another trusted chain, you have something to bootstrap it with... That way if you do business with say, "uTorrent", you don't have to physically swap anything with uTorrent directly, you both can choose to bootstrap trust with one of the preinstalled trusted roots, such as Verisign. Then once you install other certs in this fashion, you can start using these new certs to bootstrap other relationships etc...

This is how its supposed to work. You can think of it as an external channel, but the original poster was making a different argument. One of the original replies to the poster mentioned trusted roots, which is exactly this system, but the original poster claimed even that was vulnerable to man in the middle, and only talked about needing to physically exchange keys with the intended recipient. When it became obvious that person didn't seem to understand how certs actually work, I simply explained how the trusted root system works.

Re:Encrypted traffic...

[badkarmadayaccount]

Yes, but this is the Evil Internets (tm)! We cannot sit by and let out children suffer! Illegal child pornography and viruses could be spread by online predators and malware hackers using this black market in pirated Intellectual Property.

How can you be so naive? We must act now before it is too late!

Quoting parent for better visibility.

Re:Encrypted traffic...

[LonghornXtreme]

Again... you're missing the point.

If you have contraband in your house and your neighbor breaks in, takes it, and gives it to the police, the police can still use it to prosecute you.

There is no 4th amendment protection even if the neighbor broke the law. Sure, you could sue your neighbor or press charges or whatever, but that doesn't change the fact that YOU are going to be prosecuted based on that contraband the neighbor found.

You're arguing a technicality that doesn't keep you out of jail.

I am not a lawyer. This is not legal advice. Always consult a licensed attorney in your jurisdiction for legal advice and legal services. This conversation does not create attorney-client privilege.

Not yet

[SciBrad]

According to the article the method is currently too slow to be implemented and fails for encrypted traffic. So not quite the BT killer yet.

Re:Not yet

[Rary]

According to the article the method is currently too slow to be implemented and fails for encrypted traffic. So not quite the BT killer yet.

Which article did you read? The one linked in the summary says the method is fast, and it makes no mention of encryption.

Nevertheless, it sounds like encryption would do the trick here. All it's doing is looking for torrented files and comparing the hashes to a database of known "illegal" content. If it's a match, then it logs the IP address.

Re:Not yet

[myVarNamesAreTooLon]

No, previous methods are too slow because they examine the contents of each file, whereas the new system is completely passive and only looks at the hash.

A handful of network-monitoring tools can identify specific BitTorrent files, but the process is generally slow, since the contents of each file have to be examined. The time that this takes also increases exponentially as the number of files that need to be scanned grows. "Our system differs in that it is completely passive, meaning that it does not change any information entering or leaving a network,"

Re:Not yet

[blueg3]

He probably read page 2 of the article,.

Re:Not yet

[rts008]

Which article did you read? The one linked in the summary says the method is fast, and it makes no mention of encryption.

Well, this article claims that it is too slow @100Mb/s for ISP and law enforcement use. And it is defeated by encryption.(yes, that is the same article that is linked in the summary!)
FTA:

Even if the legal framework were to allow the technology, it is not quite ready to go. Tests of the system, details of which will be published later this year in a book called Advances in Digital Forensics V, showed that it was effective at detecting 99 percent of illicit files, but only at speeds of 100 megabits per second.

That's too slow for commercial or law-enforcement purposes, according to Anderson. Schulze agrees: "One gigabit per second or ten gigabits per second are required today to monitor a network." He also says that it is unclear whether the system might produce false positives, incorrectly labeling legitimate files as illegal.

Another drawback is that the system cannot cope with encrypted files. "Today, about 25 percent of BitTorrent traffic is encrypted," says Schulze. If such a tool became widely used, then anyone with something to hide would almost certainly switch to using encryption, he says.

[emphasis mine]

Admittedly, this was all on the second page of TFA, but it is there.

Re:Not yet

[Rary]

He probably read page 2 of the article,.

Ouch! Wow, do I feel like a retread.

Oh well. Allow me to turn this around and make it the website's fault instead of mine: who the hell decided that such a short article needed to be split into two pages? This isn't a print medium. Have they never heard of the scrollbar?

I'll go away now.

Re:Not yet

[pipatron]

who the hell decided that such a short article needed to be split into two pages?

The guy who wants to get a lot of ad revenue by making you see more ads.

Re:Not yet

[Rary]

who the hell decided that such a short article needed to be split into two pages?

The guy who wants to get a lot of ad revenue by making you see more ads.

Someone should point out to that guy that he put the same ads on both pages.

Re:Not yet

[baKanale]

Ouch! Wow, do I feel like a retread.

Hey, it can always be worse than a retread tire. You could feel like a bald tire, or maybe one illegally dumped in the woods somewhere.

Re:Not yet

[Moryath]

Yes but by splitting to two pages he made sure he "served" the ads twice, so gets paid for twice as many "pageviews..."

Re:Not yet

[redJag]

Actually, most ad services I've seen don't give you an impression for the same visitor on the same ad on different pages if they are within a certain window of viewing. A lot of ad providers don't even pay for impressions anymore since advertisers are finding less value in internet ad impressions as time goes on. Sometimes you will find a startup ad provider that pays per thousand impressions, but as they go on that value decreases towards zero. Places like Google AdSense only give you the "estimated cash per thousand" which at this point just tells you the same thing as your click thru rating since nearly all revenue is generated on clicks. Click or go home.

Re:Not yet

[HadouKen24]

From TFA: "Tests of the system... showed that it was effective at detecting 99 percent of illicit files, but only at speeds of 100 megabits per second." While it wouldn't slow down the data transfers themselves, the percentage of illicit files that it can successfully identify will drop significantly when more than 100 Mb/s goes through.

Re:Not yet

[meringuoid]

The guy who wants to get a lot of ad revenue by making you see more ads.

Once upon a time this would have been obvious. Now, it would actually never have occurred to me, because, well, what ads?

Once again I'm grateful for the little red octagon in the corner of my screen. Thank you Wladimir Palant!

Re:Not yet

[adolf]

"Today, about 25 percent of BitTorrent traffic is encrypted," says Schulze.

So. What he really means to say is this: By allowing ONLY encrypted traffic with your BitTorrent client, you'll still be able to accomplish connections with at least about 25% of available peers.

This is, I'd guess, quite good enough. I think I'll go adjust Azureus now.

Thanks for the tip!

It's called Port Mirroring

[alta]

And my $200 24 port gigabit switch from Dell will do it. And that's a cheap piece of crap. For the 3 of you who don't already know, You specify one port on the switch to receive a copy of all traffic on the entire switch, a vlan or a specific port. Then you can hook etherial to that port and monitor all of the traffic without modifying the original. OOOOhhhh, magic eh?

Anyway, even after I RTFA, I still didn't see anything that this thing does that my cheap port and a P2 running etherial couldn't do.

Re:It's called Port Mirroring

[Pentium100]

While I have no use for that switch, it still puzzles me - how do you cram all traffic that's going though the switch (up to 22gbps) to a single 1gbps port?

Anyway, this idea is older than that 1gbps switch. 10 and 100mbps hubs also have that feature :).

Re:It's called Port Mirroring

[tijsvd]

Two points.

One: the mirror port (aka span port) on your switch does not buffer the traffic, and will drop packets in any spike. That's true even for expensive Cisco switches. To get all traffic, you need a network tap on a line.

Two: getting the traffic isn't hard. It's basic sniffing. Analysing the traffic in realtime is what matters.

Re:It's called Port Mirroring

[alta]

What I said is POSSIBLE, I didn't say it was practical ;) Although, I have done this in the past, and there are 3 options.

1. Live with the fact that most of the time each port is underutilized. If the dropped packets aren't of life and death importance, this works out ok.

2. We had to track down something that was saturating our network, we needed every packet. We set every port to 100MB except for the monitor.

3. A waste of ports, and expensive but you don't loose anything... For each port in use, have one port be it's mirror. Set up your scanner with a bunch of network cards. This is very wasteful, so combine with #2 to cut back.

Anyway, I was just taking issue that both the summary and TFA were both acting like someone had invented something miraculous.

hmm

[Anonymous Coward]

More restrictions on content? More encryption.

Better cracking techniques? Better encryption.

Tyrannical government? Revolution.

Re:hmm

[OSDever]

I believe that falls under "Tyrannical government? Revolution."

Re:hmm

[Jesus_666]

Tyrannical government? Wii.

FTFY

Completely Biased and Worthless

[RingDev]

Another drawback is that the system cannot cope with encrypted files. "Today, about 25 percent of BitTorrent traffic is encrypted," says Schulze. If such a tool became widely used, then anyone with something to hide would almost certainly switch to using encryption, he says.

If you make breathing illegal, only criminals with breath.

-Rick

Re:Completely Biased and Worthless

[azgard]

Or, everybody will become a criminal.

Re:Completely Biased and Worthless

[Capt.DrumkenBum]

I'll die before I become criminal scum.

Re:Completely Biased and Worthless

[Anonymous Coward]

Logic Fail. If everyone becomes a criminal, then it is still true that the only people who are breathing will be criminals.

Re:Completely Biased and Worthless

[mooingyak]

Figured that out on your own, did you?

Re:Completely Biased and Worthless

[Anonymous Coward]

I think you mean breathe.

Re:Completely Biased and Worthless

[gEvil (beta)]

If you make breathing illegal, only criminals with breath.

I think you mean breathe.

And what will they do with breathe?

Re:Completely Biased and Worthless

[noidentity]

Another drawback is that the system cannot cope with encrypted files. "Today, about 25 percent of BitTorrent traffic is encrypted," says Schulze. If such a tool became widely used, then anyone with something to hide would almost certainly switch to using encryption, he says.

Drawback? Sounds like a feature. Gentlemen, prepare to enable encryption in 3...2...1...

If you make breathing illegal, only criminals with breath will breathe.

Finished the sentence for you.

Re:Completely Biased and Worthless

[duckInferno]

Financial leader standing on dam: "I promise to not to open the flood gates to foreign investment!"

Douchebag: "It's funny because he's on a dam and dams have flood gates"

Re:Completely Biased and Worthless

[Anonymous Coward]

You are a retard.

Re:Completely Biased and Worthless

[moonbender]

Hey, he didn't say xor.

Yawn

[happyemoticon]

From the article:

Then the system looks at the files' hash, a unique identifying code used to coordinate the simultaneous download of hundreds of file fragments by different users. If a hash matches any stored in a database of prohibited hashes, then the system will make a record of the transfer and store the network addresses involved.

I mean, you could easily scrape some torrent sites for hashes, but it seems like this system would be fairly easy to circumvent. All you'd have to do is come of with some system for changing the hash on a peer-specific basis.

Re:Yawn

[blueg3]

If I read the article correctly, what they're really doing is looking at the BitTorrent infohash, which is used when communicating with the tracker and other peers to identify the torrent. (The infohash uniquely identifies the torrent.) Having a different infohash for each peer would require significant BitTorrent reengineering, I would think.

However, it's defeated by encryption, cannot legally be used in the U.S. or Europe by ISPs, and relies on a blacklist of illicit torrents.

Re:Yawn

[jandrese]

Changing the hash on peer basis would mess the protocol up pretty badly. It's a lot easier just to turn on the encryption stuff.

Re:Yawn

[BuckaBooBob]

They should just use simple RoT13 or something else thats lame make it part of the protocol and copywrite it. then slap anyone that comes up with this type of technology with a DMCA Takedown/Cease and desist for circumventing the Packet inspection protection.

Re:Yawn

[Carlosos]

Don't private trackers already use different infohash for each user to track the stats of the users?
This would mean that looking at the infohash will only work for public trackers (which are slow most of the time anyways) and to get around that you would only need to use Tor for communication to the public tracker which is already supported by a few bittorrent clients.

Re:Yawn

[blueg3]

As it's a passive tool, all you'd need to do is encrypt the communication with the tracker.

Re:Yawn

[DMoylan]

>cannot legally be used in the U.S. or Europe

when has that ever stopped anybody?

Re:Yawn

[steelfood]

In a word (or two):

Hash chains.

Re:Yawn

[Washii]

I thought there was just a special hash in the announce string.

Re:Yawn

[blueg3]

Example

Bonus second example

Real answer: ask a lawyer how relevant the legality of a search is.

Re:Yawn

[CoderJoe]

The infohash is the SHA1 hash of the "info" section of the .torrent file, in BEncoded form (the form it is stored as in the .torrent file). Private trackers add a parameter to the announce url to uniquely identify users. The announce urls are held outside the info section of the .torrent file, so changing them will not change the infohash. There are some private trackers that have tracked users by IP address rather than announce url, but they tend to not work as well.

Re:Yawn

[Ashriel]

Nah. If Bittorrent becomes overly problematic, P2P protocols will simply evolve.

Wait, wait, slow down there...

[fuzzyfuzzyfungus]

So, you're telling me that, given a set of hashes corresponding to "Prohibited content" and access to all the packets moving across a network, you can detect prohibited content? Why, it's a miracle of science!

Seriously, this is news? It has been possible, with the complicity of the router or physical access to the wire, to unobtrusively and undetectably tap a network since forever. That isn't news. And being able to identifiy files whose hashes you have ahead of time? Also not news, especially since bittorrent uses hashes extensively itself, and was never designed for subtlety or concealment.

I realize that Technology Review lost interest in technology years ago, and now spends most of its time fellating venture capitalists; but this is pathetic.

Can't even be Used?

[collywally]

Great. An article about a technology that can't be used not only for legal reasons but because of technological ones as well.

By the time this is fast enough to detect things at the speeds it needs to today, we'll be transferring stuff way faster... will it ever be able to catch up? And that's not even taking into account encryption.

Re:Developed by the Air Force

[jandrese]

For those of you who are wondering, my guess is Cee Pee is Child Porn.

Re:Does it detect what's within?

[MrEricSir]

Presumably, Ubuntu CDs wouldn't be one of the hashes in their database of pirated stuff.

So...

[Adrian Lopez]

So... they invented packet sniffing?

Re:So...

[Chelloveck]

Yeah, but this is completely passive packet sniffing! It doesn't get the packets all sticky like the other tools do.

Re:So...

[DigitAl56K]

So... they invented packet sniffing?

I once sniffed a sequence of illegal hash packets and it was like.. Ethereal man. Suddenly I could see cyberspace unfolding before me and it wasn't until later that I totally realized that you have to use a filter or your sniffer just captures way too much to handle in one session. Dude, being in promiscuous mode is quite an experience. Yeah. .. what?

peace.

New Technology?

[usman_ismail]

They use packet sniffing and maintain a database of hashes of "bad" files. Does this qualify as new technology? So this is where the air force (Air Force Institute of Technology) spends their R&D budget.

Fantastic!

[Anonymous Coward]

I can hardly wait for this software to hit Demoniod!

That's it

[dvh.tosomja]

We're all doomed

Re:Does it detect what's within?

[doti]

Worse yet.

Remember, kids: when you're downloading Free software, you're downloading communism!

Legal content? No such thing!

[chainLynx]

At least, I'm sure that's what the copyright holding associations would argue / propagandize.

Re:Developed by the Air Force

[Jah-Wren Ryel]

For those of you who are wondering, my guess is Cee Pee is Child Porn.

Who knew that 3-CP0 was secretly a child pornographer, we need to outlaw shiny metal droids for the safety of the children!

Re:Does it detect what's within?

[smchris]

Does it matter? A free and open broadcast medium isn't something most governments will embrace gleefully, so you can pretty well figure business will get whatever it wants.

Obsolete from the start

[EdIII]

It also means that it's impossible for users to tell if a network is being monitored

"Our system differs in that it is completely passive, meaning that it does not change any information entering or leaving a network,"

This is nothing new and it's just meaningless marketing drivel. It's impossible to tell that *any* network is being monitored. It's not like you could buy an electronic device in a spy shop that can detect network monitoring. Throttling and "traffic management" are different since that is changing the network traffic.

There is only one type of network that can prevent a 3rd party from being able to copy the network traffic. Quantum communications provides that type of infrastructure by making it *impossible* to read the traffic without destroying it.

It's not like network monitoring is really a problem anyways. If you want privacy then just use encryption.

"Our system does not modify traffic in any way, nor does it interfere in the delivery of traffic either in or out of a network,"

Ohhh, you mean it's useless right? Everyone involved knows that a large amount of torrent traffic is infringing on various copyrights. The goal of the ISPs is to protect their profit margins. They sell unlimited but expect limited. They don't care whether traffic is illicit or not, just that it does not interfere with their business models. The MAFIAA is interested in the contents of the traffic and could care less about network congestion and bandwidth issues. Until the ISPs actually start caring about content, the goals of these two groups are not the same.

Enter Net Neutrality. Only when it is in the financial interests of ISPs to care about content will they start to listen to the MAFIAA. Obviously they could not reach an agreement since the MAFIAA is going to the whores in various legislatures to trade our freedoms for the protection of a few group's business models.

Note, that I don't support piracy on principle. However, I will not give up my rights to privacy and anonymity to protect someone else's copyrights either.

Schulze adds that the approach relies on having an up-to-date list of illegal files. "The system has to update a huge list of file hashes frequently," he says. "Somebody has to qualify the hashes as copyright infringements or other criminal content."

That sounds really easy doesn't? Of course there are only a few dozen really popular public trackers out there they can scrape the thousands and thousands of new torrents each day to update their tables. Don't forget about all the private trackers either that add a file or two that changes the hash to be different from the public torrents containing some of the same files.

Yep. This should be really easy. I can't possibly see how this task could not be reasonably accomplished with just a few salaried personnel on daily basis.

From a legal standpoint, Schulze says that privacy may be a more significant problem. "Neither the U.S. nor any European country would allow [anyone] to install a device that inspects the traffic of every user just to stop Internet piracy," he says. "In this approach, every user is considered to be suspicious."

I laughed so hard I almost peed myself at this point. Legal viewpoints change more frequently than the weather. If there is enough pressure from private interests in the U.S and abroad I don't think a little thing like privacy will stop them.

Even if the legal framework were to allow the technology, it is not quite ready to go. Tests of the system, details of which will be published later this year in a book called Advances in Digital Forensics V, showed that it was effective at detecting 99 percent of illicit files, but only at speeds of 100 megabits per second.

I just knew there was a p

Re:Here's a novel idea, DONT FUCKING STEAL SHIT

[Shakrai]

Who says I steal anything? I'm a law-abiding citizen who happens to be outraged at the prospect of having my private communications searched through without a court order.

Unclear wording

[Rix]

This doesn't identify someone downloading a file via bittorrent, it identifies someone downloading a *.bittorrent file (presumably via http).

This is a non-issue. If anyone actually starts using this, trackers will just start using shttp for their torrent files. They're small and (relatively) low traffic, so it would be a negligible performance issue.

The only notable thing about this article is that it points out how clueless tech journalists really are.

Re:Unclear wording

[svank]

This doesn't identify someone downloading a file via bittorrent, it identifies someone downloading a *.bittorrent file (presumably via http).

I've always distributed my *.bittorrent files over bittorrent. Looks like I'm safe. Phew!

hashes are not the threat

[Khopesh]

All you'd have to do is come of with some system for changing the hash on a peer-specific basis.

The hash is how data is verified. You can't just change the hashing mechanism on a peer-specific basis because you're sharing the same data with thousands of different peers. That would require every single peer to host a specific hash for each other peer, or worse, convert between hashes on the fly.

The flaw in this method is the hashes themselves; the only way to detect the so-called illicit content is by knowing the specific encoding. This stops camcorder films and screener rips because they are encoded by well-seeded individuals. This does NOT stop your standard DVD or TV rip. For example: Joe and Bob go and buy a DVD, splitting the cost. Each of them have the exact same model of computer and even the same versions of all their software. Joe encodes the DVD to a nice 700mb h264 MP4 file, then gives it to Bob. Bob encodes the DVD in the exact same manner before giving it to somebody else. Despite this, Joe and Bob's resulting files have different hashes. They're damn close to the same data (bit for bit!), but there is an ever-so-slight difference which makes the hash differ. You can't tell they're similar (by the hashes) at all.

The only way to automate such policing would be to combine this simple method with a more complex one, such as participating in the p2p, downloading the media, and comparing it to a massive archive. This sort of thing is already available; check out Shazam, a free iPhone (et al) audio fingerprinting service, for example. Note it would need a longer sample time to account for fair use, and it would need some video equivalent to effectively detect movies (which is almost certainly being developed for YouTube). In fact, it's this use of that concept that scares me so much of it ... it's only a matter of time.

(also: why is every post I reply to these days titled "Yawn" ? can't we be more creative?)

They've never heard of salting?

[Anonymous Coward]

There's a well-known technique for dealing with dictionaries of hashes - add some meaningless bits to the content before computing the hash, so that the number of possible hashes increases. This is cheap for everyone except a person trying to keep a dictionary of all possible hashes.

This is useless

[s_p_oneil]

"Another drawback is that the system cannot cope with encrypted files."

Even the article mentions that anyone doing something they want to hide is more likely to check the "encrypted only" checkbox. I work on NetSpective WebFilter, which has been passively identifying encrypted protocols that try to hide themselves like encrypted BitTorrent (both standard and Azureus), Skype, and UltraSurf for years. It also lets you choose to block any of these protocols you don't want on your network.

"If a hash matches any stored in a database of prohibited hashes, then the system will make a record of the transfer and store the network addresses involved."

Maintaining a list of hashes is not a new idea, as they seem to claim. It was abandoned because the list is insanely painful to manage, and it is insanely easy to get around. These guys aren't even trying to provide a list, which might be worth something (until the hackers put in the time to work around it). They're just sniffing/logging the hashes, which is child's play and worth almost nothing.

Re:This is useless

[BitZtream]

Ahh, spoken like someone who missed the point or doesn't understand the point due to professional blinders.

They don't want to stop them, or slow them down, or bother the transfers in any way. They just want to know they are happening and that 'illegal' content has been transfered (which they can't actually prove using hashes of any sort that result in data loss).

Your company makes software to make networks less useful, annoy people, and generally get in the way. That makes it fairly obvious when it triggers, which means you have something you are aware of to work around and generally its pretty easy to test against. So you have to look at the way the protocol works in general and try to infer things from larger patterns of seemingly useless data (like the fact that 20 people on your network have connections to the same server (the tracker) and they also are the only ones on your network with 200 open connections to random places all over the planet) and patterns that show up.

They don't need to do that. They want to just sniff for days before anyone notices, the longer the better, just watching and logging matches. If someone figures it out, they go arrest the people they can, and wait for a patch to detect the files in a new way.

While I agree, in principle that what they are doing is useless as proper encryption really does stop anything they can do as far as seeing the actual content transfered anyway. However, the points you bring up indicate that you really don't understand a whole lot about security since you seem to think your company is the same as his only better. They aren't, different target markets. Both of you are pretty much complete scumbags, but you aren't equals.

They aren't.

They are just trying to catch people doing it, someone else will stop them.

Their goal is different than yours. Your company makes software to make networks less useful and to be a general pain in end users ass (thanks btw, really), the article on the other hand is about trying to put people in jail.

Its much harder to work around something when you aren't aware that you need to work around it, or how its working in the first place.

Cute

[Dunbal]

I like the way the summary tries to equate torrent with illicit. Interesting, on a site full of linux people who have probably torrented more than one distro in their lives.

      Anyway - good luck with that.

maybe not

[ApproachingLinux]

for each packet, the server would prepend or append something like the date/time (like the 32 bit value used on unix) - that's enough to change the hash and to be unique for every packet for every user. the client would toss those bytes away after verifying the hash. this should be less costly than encryption (or could be added to encryption).

i was thinking that the definition of a hash pretty much guarantees that a false positive is possible. but, then again, if you receive a hundred hashes that all match packets from the same file, then you're pretty well screwed ...

Re:Here's a novel idea, DONT FUCKING STEAL SHIT

[Dragonslicer]

Yeah, what gives me the right to use BitTorrent to steal Ubuntu discs

the REAL story...

[Jettra]

So the US military wants all our ISP's to install a chip to monitor all network traffic and then store all those connection locations so it can later analyze this data. All under the guise of protecting our beloved copyrighted content.

Anyone see the possibility of other uses/motivations here?

I believe that this US agency may be attempting to disprove their working theory that file sharing correlates to terrorism. ... Na... even they cant stomach that sort of crap anymore.

FYI: Yes I DID READ the article.

Well that's a dumb question...

[cyberfunkr]

I wonder if it can specifically identify legal content, too.

Ask any government official or *IAA lawyer... NONE of it is legal. EVAR.

Gotta love these articles.

[Anachragnome]

I am thoroughly amused by articles like this that essential start out as:

"Hey, look we got! Yackkity, yakkity, yak, yak..." ...And end with something along the lines of...

"...Well, its pretty damn useless considering xxxxx and xxxx are already in use and defeat it completely."

Why do people even bother printing such useless information, much less invest millions of dollars into such a product?

legal, schmegal ...

[jc42]

I wonder if it can specifically identify legal content, too.

So why would the likes of the RIAA and MPAA want to do that?

They're interested in finding criminals, not showing that people are innocent.

Re:legal, schmegal ...

[moonbender]

Hmm. White list known-good traffic instead of blacklisting P2P? At least that'd be an interesting new countermeasure to get around. They could start by banning HTTPS and other encrypted connections unless the server host is whitelisted (big banking instituion or whatever). Drop the other connections if their entropy is too high.

uh, isn't that called wireshark?

[DragonTHC]

isn't it a packet sniffer? Isn't that illegal tech for these purposes?

Re:uh, isn't that called wireshark?

[DragonTHC]

oh wait, http://www.vnunet.com/vnunet/news/2236292/stimulus-bill-nixed-net

Feinstein just introduced this amendment, http://www.publicknowledge.org/pdf/GRA09175_xml.pdf into the stimulus bill.

guess it's not going to be so illegal after all.

Why do they hate us so much?

Re:Here's a novel idea, DONT FUCKING STEAL SHIT

[MobileTatsu-NJG]

Here's a novel idea, DONT FUCKING STEAL SHIT

Then you won't have any problems whatsoever!!

Answers sure do come easy to those who don't know what the fuck they're talking about.

Inherent issue

[Demonantis]

Someone mentioned be before that the technology hasn't been tested for false positives. I would like to indicate that their system will inherently generate false positives. A hash is derived from an irreversible function performed on the file that is being transfered. This is often used to test the integrity of transfered data. This would protect against corruption that occurs in the data stream. The major issue with hashing is that the hash is not a continuous function. Continuous means that for every input there is one output. This means that there could easily be a false positive when a duplicate hash occurs. The fact the team developing this technology mentions it means they understand there might be false positives means that they understand this limitation and this technology is only a proof of concept.

Re:ATTN !! Is this a good thing or a bad thing?

[Lucky75]

Can someone please explain to me how they plan to view the files of encrypted traffic without it being illegal?

One would think that if they happen to decrypt anything with copyright protection that it would then violate the DCMA, as per various ridiculous recent rulings of the sort.

...or, you know, just be plain illegal due to attempting to access people's personal files.

HOW IS THIS NEWS IN ANY WAY SHAPE OR FORM

[wintermute000]

Newsflash: revolutionary new tech allows a network probe.... to classify traffic by matching TCP/IP profile and protocol inspection

How is this different to, er, any sniffer or monitoring tool out there. Or any Cisco router with NBAR turned on. Solarwinds, statseeker, ntop, you name it (network monitoring suite) and they ALL have features that allow probes (or use netflow or both) to gather traffic info including by protocol.

Slashdot's standards are slipping greatly, esp. anything NOT to do with servers, dev and/or coding, apparently all the real network techs have gone on holidays or something

Re:Here's a novel idea, DONT FUCKING STEAL SHIT

[Bryansix]

Actually you will because Comtastic people abound in this world and they will make your life suck because people around you are breaking the law even if you don't.

Irrelevent

[cdrguru]

Music is free for the taking and there is nothing that can stop that. If you don't understand that, you are missing one of the essential points of the 21st Century.

Movies are just about as free. Nobody is going to pay unless they believe the wrapper in the DVD case is work $20. Or they are worried about missing out on all those ads for previously upcoming movies. Download as much as you want, there is no way the tap can be turned off now.

Software? Well, count how many pirated copies of Photoshop and Office there are and then come back and tell mw how it is viable to build a new consumer-oriented software product today. If there are not specific platform prohibitions against "sharing", it is going to be "shared". In the 1980s it was assumed that an Apple product would sell two copies, one on the East coast and one on the West coast. We are pretty much there today except for a relatively few niche products. Some companies try to avoid the avalanche of pirated software and a few get burned by the BSA. But at home sales are pretty low and usage pretty high.

Block BitTorrent? Sure. It will take a week to have a completely new protocol that will sweep across the planet which will once again make everything freely downloadable.

It is a matter of ethics, responsibility and morality. We have taught an entire generation that on the Internet there is no need for quaint concepts like these and we are seeing the results. Things like teenage girls being tricked into assisting with their own rape. Things like lossing in the millions due to scams and cons. Sorry, but this is indeed the result. Actions on the Internet do not have consequences. That is taught to people online every day - I think it is working.

Re:Irrelevent

[triffid_98]

Oh I don't know, maybe the real answer is that if you price your software at $400 a seat most people will opt to pirate it instead? Its not like most of these can truly be considered lost sales. Or is your point that there is no market for software fitting somewhere between Gimp and Photoshop CS3 in functionality?

Software? Well, count how many pirated copies of Photoshop and Office there are and then come back and tell mw how it is viable to build a new consumer-oriented software product today.

Re:False Evidence attack, DoS attack

[LilGuy]

I had a hard time understanding how they thought this would be admissible in court as well. Picking out the first 32 bits from a frame header and trying to identify a file's hash out of it, does in no way necessitate that the user is downloading the entire file. Wouldn't you have to download the entire movie/game/program in order for it to be considered piracy? AFAIK you can't download 1/2 a movie/game/application and have it still work... and in most cases just missing a few bits can make all the other bits useless.

So is it illegal to begin a download of pirated bits?

Re:ATTN !! Is this a good thing or a bad thing?

[Ashriel]

If you read the article, you know the answer to these questions.

They plan to sniff for the hash, of course, and compare it to a list of hashes for "forbidden files".

It's not new technology - the same approach is used in China (according to the article).

And no, I don't think this is legal in the EU (not yet at least), and certainly not in the U.S., as it requires sniffing through everybody's stuff, regardless of what they're downloading.

Re:Here's a novel idea, DONT FUCKING STEAL SHIT

[BitZtream]

If that is the biggest concern in your life, you really don't have shit to bitch about, do you?

Re:"completely passive"

[BitZtream]

or ... they just hash the original.

<FBI Employee> Hmmm, download the torrent and get the hashs for this Windows 7 iso or should I just generate the hashes from the original iso that MS gave us? Its so hard for me to figure it out, I'm sure someone on slashdot will have a brilliant idea!

Is that you kdawson?

President Madagascar has the answer!

[The Master Control P]

encrypt... Absolutely... EVERYTHING!

Stuff like this...

[nicodoggie]

...makes me glad I live in a technologically backward country.

I have a cheaper tool..

[plasmacutter]

Azureus (and many other bit torrent clients), have this magical tool called "view peers"

Oh my god! I just identified dozens of people to sue, and if I put a logger into the client, which is open source, i can identify practically everyone!

In other news, there are millions of torrent files and a couple p2p snitch firms. I guess its time to take a paddle and start trying to beat back the ocean.

And from the other side...

[ekhben]

Fewer criminals? More restrictions!
More encryption? Better cracking techniques!
Better encryption? Tyranny!
Revolution? Martial law!

Ahh, the gubbiment, always one step ahead, except when it comes to economic crises.

disclaimer: I do not believe the gubbiment is organised enough to blow a gay hooker in a bathroom safely, let alone run a conspiracy

This is already possible at 10Gig and beyond

[DarkRecluse]

There is nothing new about this to anyone with any familiarity with the BitTorrent protocol. The hash is available whenever peers negotiate connections for a torrent. Snort rules have existed for this forever. Encryption is only a problem if you don't know the encrypted hash...which SURPRISE is available as long as the torrent is still being served from the tracker. Peers use the same encrypted hash to communicate.

Using packet sampling and Snort you can do this on over 150 1gig links TODAY. What do these people think a copysense appliance does with a 100Mbit mirror port? 1Gbit isn't even that difficult with today's commodity hardware.

Nothing pisses me off more then a bogus "new development". Should expect it from Slashdot I guess.

Re:ATTN !! Is this a good thing or a bad thing?

[Migity]

From TFA

Another drawback is that the system cannot cope with encrypted files. "Today, about 25 percent of BitTorrent traffic is encrypted," says Schulze. If such a tool became widely used, then anyone with something to hide would almost certainly switch to using encryption, he says.

/ducks for reading TFA

Re:ATTN !! Is this a good thing or a bad thing?

[Zero_DgZ]

I encrypt everything I can as a matter of course, weather I "need" to or not. Largely because I can, but also because it's good policy in general to preemptively defeat stupid crap like this.

Kicking off the start to the more widespread use of encryption also has to begin someplace, so I figure I may as well encrypt everything I can. All current Bittorent clients support encryption, and in most (like uTorrent and Deluge) it's simply a matter of checking a single checkbox to make it happen.

Ain't nobody's business what comes and goes from my computer or yours, regardless of its legality.

And if the data stream is encrypted?

[master_p]

What would they do? force us to decrypt it? that's a violation of human rights.

Re:And if the data stream is encrypted?

[shentino]

Encryption manifests an expectation of privacy and therefore necessitates a warrant.

Re:B.S.

[shentino]

Actually, the RIAA would be better off using this than what they currently do.

The status quo is slipshod blitzkriegs against dozens of does based on shared folders.

This could help them weed out innocent people. They shouldn't have a problem with it, since it would be worth their while to get evidence damning enough to not settle for relative chump change. Then they could, maybe, leave the innocent ppl alone?

At least if they stick with evidence of transfer, rather than merely "making available", their lawsuits would trade in quantity for quality, and they'd be netting a much lower false positive rate.

Personally, I'd like to see the REAL pirates get nailed red handed than be able to hide among the innocent "shared folder" folks and try to stink up the place by faking defenses that real innocents legitimately use. Real pirates are no less scum than the RIAA in my book, since they have no scruples about ripping people off.

The RIAA has a valid business mission to stop piracy. It's only because of their devil-may-care attitude when they mistarget innocent people that they have such a bad rap with me. Were the RIAA to have perfect aim and only nail guilty offenders, then I'd have no problem with them.

And yes, I'm serious. The RIAA needs to stop being an incompetent reckless lawsuit factory and start using hard evidence like this to nail the RIGHT people.

If a good bigger chunk of the RIAA's defendants were actually guilty, and smoking guns were plentiful, I'm sure their public image would get at least a bit of repair.

Of course, my faith in the RIAA not exploiting the "protection racket" gravy train they get by making it prohibitively expensive for even an obviously innocent defendant to not settle...don't make me laugh.