July 2018 - cypherpunks-legacy

Used your smartphone to log into your network?
by Rich Kulawiec 06 Jul '18

06 Jul '18

If so, this might be a good time to change passwords, and to review what other information has transited your phone. (Note: androidsecuritytest.com appears to be slashdotted at the moment.) November 16: initial reports of Carrier IQ spyware surface: CarrierIQ: Most Phones Ship With "Rootkit" http://yro.slashdot.org/story/11/11/16/1517248/carrieriq-most-phones-ship-w… The Rookit of All Evil http://www.xda-developers.com/android/the-rootkit-of-all-evil-ciq/ More on CarrierIQ http://www.xda-developers.com/android/more-on-carrier-iq/ all of which reference the research presented here: Carrier IQ http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq/ November 22: Carrier IQ threatens security researcher Trevor Eckhart: CarrierIQ Tries To Silence Security Researcher http://mobile.slashdot.org/story/11/11/23/0032233/carrieriq-tries-to-silenc… Mobile Rootkit Maker Tries to Silence Critical Android Dev http://www.wired.com/threatlevel/2011/11/rootkit-brouhaha/ November 24: Carrier IQ backs off its threats, says that it doesn't track Android users Carrier IQ Relents, Apologizes http://yro.slashdot.org/story/11/11/24/1852213/carrier-iq-relents-apologizes Carrier IQ retracts cease and desist letter sent to security researcher, says it doesn't track Android users http://www.theverge.com/2011/11/23/2583862/carrier-iq-retracts-cease-and-de… November 29: Further research by Trevor Eckhart shows Carrier IQ spyware logs ALL keystrokes Android Dev Demonstrates CarrierIQ Phone Logging Software On Video http://yro.slashdot.org/story/11/11/30/0423256/android-dev-demonstrates-car… Researcher's Video Shows Secret Software on Millions of Phones Logging Everything http://www.wired.com/threatlevel/2011/11/secret-software-logging-video The Storm Is Not Over Yet -- Lets Talk About #CIQ http://www.xda-developers.com/android/the-storm-is-not-over-yet-lets-talk-a… all of which reference this research: Carrier IQ Part 2 http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq… ---rsk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [silk] Bitcoin
by Alaric Snell-Pym 06 Jul '18

06 Jul '18

On 06/20/11 17:59, Jon Cox wrote: > Yes, the value of Bitcoins crashed from $17.50 down to $ 0.01 > in the span of about 5 minutes yesterday, and though people > were allowed to buy at $0.01, they probably won't be able to > cash out, because Bitcoin just announced a rollback. > > A rather timely illustration, wouldn't you say? ;) That wasn't Bitcoin itself, just mtgox, the biggest exchange. Somebody hacked an account and sold a heap of bitcoins at a negligble price, so the exchange froze itself before the USD were actually cashed out and is resetting to the state before the exploit... There's been a few bitcoin heists, down to the usual computer security issues; bitcoin itself has, interestingly, remained unbroken, which bodes well for its underlying security. The mtgox heist could have happened just as well with any online banking system; it's just that the bitcoin economy rather new, so there's lots of little bit players suddenly finding themselves transferring hundreds of thousands of dollars without having the expertise or capital to build the kinds of security that banks do... ABS -- Alaric Snell-Pym http://www.snell-pym.org.uk/alaric/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Used your smartphone to log into your network?
by Rich Kulawiec 06 Jul '18

06 Jul '18

If so, this might be a good time to change passwords, and to review what other information has transited your phone. (Note: androidsecuritytest.com appears to be slashdotted at the moment.) November 16: initial reports of Carrier IQ spyware surface: CarrierIQ: Most Phones Ship With "Rootkit" http://yro.slashdot.org/story/11/11/16/1517248/carrieriq-most-phones-ship-w… The Rookit of All Evil http://www.xda-developers.com/android/the-rootkit-of-all-evil-ciq/ More on CarrierIQ http://www.xda-developers.com/android/more-on-carrier-iq/ all of which reference the research presented here: Carrier IQ http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq/ November 22: Carrier IQ threatens security researcher Trevor Eckhart: CarrierIQ Tries To Silence Security Researcher http://mobile.slashdot.org/story/11/11/23/0032233/carrieriq-tries-to-silenc… Mobile Rootkit Maker Tries to Silence Critical Android Dev http://www.wired.com/threatlevel/2011/11/rootkit-brouhaha/ November 24: Carrier IQ backs off its threats, says that it doesn't track Android users Carrier IQ Relents, Apologizes http://yro.slashdot.org/story/11/11/24/1852213/carrier-iq-relents-apologizes Carrier IQ retracts cease and desist letter sent to security researcher, says it doesn't track Android users http://www.theverge.com/2011/11/23/2583862/carrier-iq-retracts-cease-and-de… November 29: Further research by Trevor Eckhart shows Carrier IQ spyware logs ALL keystrokes Android Dev Demonstrates CarrierIQ Phone Logging Software On Video http://yro.slashdot.org/story/11/11/30/0423256/android-dev-demonstrates-car… Researcher's Video Shows Secret Software on Millions of Phones Logging Everything http://www.wired.com/threatlevel/2011/11/secret-software-logging-video The Storm Is Not Over Yet -- Lets Talk About #CIQ http://www.xda-developers.com/android/the-storm-is-not-over-yet-lets-talk-a… all of which reference this research: Carrier IQ Part 2 http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq… ---rsk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[liberationtech] skype & CALEA
by Eric S Johnson 06 Jul '18

06 Jul '18

The Russian newspaper Vedomosti reported yesterday (link below) that Russian experts believe Microsoft built lawful intercept capability into Skype over a year ago and has shared that capability with Russian LEAs; supposedly, the capability allows a user's Skype to be remotely triggered to establish its end-to-end encryption with a Skype server (which can then intercept) rather than with "the other end." The Russian blogosphere is chattering away about it, with some saying "but of course" and others saying "doubt it." If not a smoking gun, it might be a whiff of gunpowder, although the same article says "and earlier this week it became known that the Chinese version of Skype has a special mechanism for surveilling users"-something we've known (thanks to CitLab et al.) for years, so I'm not sure we should consider this writer likely to be contributing something substantially new. Microsoft today said "not true." http://www.vedomosti.ru/politics/news/10030771/skype_proslushivayut Best, Eric PGP <http://keyserver.pgp.com/vkd/DownloadKey.event?keyid=0xE0F58E0F1AF7E6F2> -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[cryptopolitics] Stellar Wind
by Tony Arcieri 06 Jul '18

06 Jul '18

http://en.wikipedia.org/wiki/Stellar_Wind_(code_name) Stellar Wind is the name of an NSA program to wiretap the Internet. The Internet is being wiretapped at facilities around the country, including a building I walk by every day: 611 Folsom Street where the infamous Room 641A is located: a room where they have installed beam splitters on fiber optic cables servicing massive amounts of commodity Internet traffic. >From there they are sending the captured traffic to a facility in Utah, which has been designed to store data on a "yottabyte" scale: http://en.wikipedia.org/wiki/Utah_Data_Center They plan to store the captured traffic for up to 100 years, perhaps in hopes that a successful cryptanalysis of the ciphers used to encrypt the data they've stored will allow them to decrypt it in the future. I don't know about you, but this seems bad to me. President Obama has issued an executive order that allows the NSA to spy not just on foreign nationals, but US citizens as well. In effect: the NSA has their eye on the entire world. -- Tony Arcieri _______________________________________________ cryptopolitics mailing list cryptopolitics(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptopolitics ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[>Htech] Tracking a Specific Machine Anywhere On The Net
by Eugen Leitl 06 Jul '18

06 Jul '18

Link: http://slashdot.org/article.pl?sid=05/03/04/1355253 Posted by: Zonk, on 2005-03-04 16:45:00 from the not-the-sandra-bullock-movie dept. An anonymous reader writes "An article on ZDNet Australia tells of a new technique developed at CAIDA that involves using the individual machine's clock skew to [1]fingerprint it anywhere on the net." Possible uses of the technique include "tracking, with some probability, a physical device as it connects to the Internet from different access points, counting the number of devices behind a NAT even when the devices use constant or random IP identifications, remotely probing a block of addresses to determine if the addresses correspond to virtual hosts (for example, as part of a virtual honeynet), and unanonymising anonymised network traces." References 1. http://www.zdnet.com.au/news/security/0,2000061744,39183346,00.htm ----- End forwarded message ----- How to track a PC anywhere it connects to the Net Renai LeMay, ZDNet Australia March 04, 2005 URL: http://www.zdnet.com.au/news/security/0,2000061744,39183346,00.htm Anonymous Internet access is now a thing of the past. A doctoral student at the University of California has conclusively fingerprinted computer hardware remotely, allowing it to be tracked wherever it is on the Internet. In a paper on his research, primary author and Ph.D. student Tadayoshi Kohno said: "There are now a number of powerful techniques for remote operating system fingerprinting, that is, remotely determining the operating systems of devices on the Internet. We push this idea further and introduce the notion of remote physical device fingerprinting ... without the fingerprinted device's known cooperation." The potential applications for Kohno's technique are impressive. For example, "tracking, with some probability, a physical device as it connects to the Internet from different access points, counting the number of devices behind a NAT even when the devices use constant or random IP identifications, remotely probing a block of addresses to determine if the addresses correspond to virtual hosts (for example, as part of a virtual honeynet), and unanonymising anonymised network traces." NAT (network address translation) is a protocol commonly used to make it appear as if machines behind a firewall all retain the same IP address on the public Internet. Kohno seems to be aware of the interest from surveillance groups that his techniques could generate, saying in his paper: "One could also use our techniques to help track laptops as they move, perhaps as part of a Carnivore-like project". Carnivore was Internet surveillance software built by the United States' Federal Bureau of Investigation. Earlier in the paper Kohno overshadowed possible forensics applications, saying that investigators could use his techniques "to argue whether a given laptop was connected to the Internet from a given access location". Another application for Kohno's technique is to "obtain information about whether two devices on the Internet, possibly shifted in time or IP addresses, are actually the same physical device." The technique works by "exploiting small, microscopic deviations in device hardware: clock skews." In practice, Kohno's paper says, his techniques "exploit the fact that most modern TCP stacks implement the TCP timestamps option from RFC 1323 whereby, for performance purposes, each party in a TCP flow includes information about its perception of time in each outgoing packet. A fingerprinter can use the information contained within the TCP headers to estimate a device's clock skew and thereby fingerprint a physical device." Kohno goes on to say: " Our techniques report consistent measurements when the measurer is thousands of miles, multiple hops, and tens of milliseconds away from the fingerprinted device, and when the fingerprinted device is connected to the Internet from different locations and via different access technologies. Further, one can apply our passive and semi-passive techniques when the fingerprinted device is behind a NAT or firewall." And the paper stresses that "For all our methods, we stress that the fingerprinter does not require any modification to or cooperation from the fingerprintee." Kohno and his team tested their techniques on many operating systems, including Windows XP and 2000, Mac OS X Panther, Red Hat and Debian Linux, FreeBSD, OpenBSD and even Windows for Pocket PCs 2002. "In all cases," the paper says, "we found that we could use at least one of our techniques to estimate clock skews on the machines and that we required only a small amount of data, although the exact data requirements depended on the operating system in question." Putting the techniques to the test with a wider test also proved fruitful for the researchers. "We also measured the clock skews of 69 (seemingly identical) Windows XP SP1 machines in one of our institution's undergraduate computing facilities. The latter experiment, which ran for 38 days, as well as other experiments, show that the clock skew estimates for any given machine are approximately constant over time, but that different machines have detectably different clock skews," said the paper. Although the paper says that "It has long been known that seemingly identical computers can have disparate clock skews," it goes on to conclude that "the main advantage of our techniques ... is that our technique can be mountable by adversaries thousands of miles and multiple hops away." Information about the technique came to light when KC Claffy, principal investigator for the Cooperative Association for Internet Data Analysis (CAIDA) forwarded information about the project to a mailing list, "in the interest of full and early disclosure". However Claffy also said in her email: "Please don't forward to any bad guys." Kohno is also associated with CAIDA. Kohno's research is due to be presented at the Institute of Electrical and Electronics Engineers Symposium on Security and Privacy to be held in California in May. Copyright ) 2005 CNET Networks, Inc. All Rights Reserved. ZDNET is a registered service mark of CNET Networks, Inc. ZDNET Logo is a service mark of CNET NETWORKS, Inc. -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

RE: [p2p-hackers] p2p in some place or other
by Serguei Osokine 06 Jul '18

06 Jul '18

On Tuesday, December 13, 2005 Michael Rogers wrote: > I believe eMule allows the uploader to assign different priorities > to different files - I'd like to be able to do this in Gnutella, to > make the rarer (or better) content on my node easier to find... Tha is more like "easier to download", but I see what you're saying. Yes, at some point I used to place hight hopes on this method, basically thinking that the transfer rates for the rare content can be improved at the expense of the popular one. Popular content can be found at lots of places anyway, so penalizing it should not hurt all that much; for me the goal was to equalize the download rates for all content regardless of its popularity. So if improving the rare content download speed would make the widely distributed content transfers a bit slower (because the systemwide cumulative uplink bandwidth is a scarce resource, after all), so be it. Unfortunately the statistical research of the P2P systems (the one that I've already quoted in this thread) shows that from the uploader standpoint the prioritization of rare vs popular content does not cover a very significant percentage of all upload situations. The typical upload scenario is not only "some popular, some rare, so give the rare more bandwidth". Just as widespread is "many rare uploads from one node", in which case changing their relative priorities is pointless, and also "rare upload from a single node", in which case no matter what this node does, the speed is going to be substandard. And let me reemphasize this again - these scenarios seem to be very common. Essentially the download speed for the rare content is limited by the uplink rates of the nodes with rare content, even if all the nodes are always on and spend just a small percantage of their online time downloading. For popular content, you can have very fast downloads in such a case; you can even saturate your downlink if you wish. But for rare content, you're still stuck with whatever is the uplink rate of a single node that has this file. As the nodes start spending more time on line, this disparity becomes more and more pronounced no matter how you prioritize the uploads. And seeing this causes the user frustration on a significant percentage of all downloads (on everything that is in the long tail). Best wishes - S.Osokine. 13 Dec 2005. -----Original Message----- From: p2p-hackers-bounces(a)zgp.org [mailto:p2p-hackers-bounces@zgp.org]On Behalf Of Michael Rogers Sent: Tuesday, December 13, 2005 3:25 AM To: Peer-to-peer development. Subject: Re: [p2p-hackers] p2p in some place or other Serguei Osokine wrote: > And the reason for this is quite understandable - if most of > the content exists in just one or two copies, what good are the swarm > downloaders and other marvelous instruments of progress? This single > copy that you need might be on a single host behind the modem in > Albania, the host might go off-line at any moment, and to make it > more fun, it might be trying to upload five other files (different > files, mind you) to five other people at the same time. I believe eMule allows the uploader to assign different priorities to different files - I'd like to be able to do this in Gnutella, to make the rarer (or better) content on my node easier to find, almost like a recommendation system. Cheers, Michael _______________________________________________ p2p-hackers mailing list p2p-hackers(a)zgp.org http://zgp.org/mailman/listinfo/p2p-hackers _______________________________________________ Here is a web page listing P2P Conferences: http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences _______________________________________________ p2p-hackers mailing list p2p-hackers(a)zgp.org http://zgp.org/mailman/listinfo/p2p-hackers _______________________________________________ Here is a web page listing P2P Conferences: http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[Politech] The NYPD can take photos of you -- but you can't turn your lens on them [fs]
by Declan McCullagh 06 Jul '18

06 Jul '18

What thuggish behavior. Kudos to the Village Voice for publicizing this. I've been accosted (though not arrested) for taking photos on public sidewalks/streets in Washington, DC. The two times that come to mind were before 9/11. Photos of the Feds in question: http://www.mccullagh.org/image/d30-5/capitol-police.html http://www.mccullagh.org/image/d30-5/pennsylvania-ave-setup-cop.html -Declan -------- Original Message -------- Subject: Politech Submission: The NYPD wants to take your picturebbut beware of turning your lens on the cops Date: Fri, 14 Apr 2006 10:43:35 -0400 From: John Albino <jalbino(a)jwalbino.com> To: declan(a)well.com >From the Village Voice of April 10: "Watching the Detectives "The NYPD wants to take your pictureB-but beware of turning your lens on the cops" <http://www.villagevoice.com/news/0615,ferguson,72804,5.html> "But police evidently aren't so keen on surveillance when the cameras are turned on themB-particularly when those cameras show them abusing free-street-parking privileges. "On March 27, two volunteers from the advocacy group Transportation Alternatives were detained for taking pictures of police officers' private cars, which were parked on the sidewalk outside the Fifth Precinct in Chinatown. The volunteers say they were held and questioned at the precinct for about 20 minutes and instructed to erase the pictures. ""It was intimidating. I was afraid they were going to arrest me," says Brian Hoberman, 37, who works as a researcher for the city's Rent Guidelines Board." -- John Albino mailto:jalbino(AT)jwalbino.com _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [tor-talk] blocked exit node IP because of spam
by grarpamp 06 Jul '18

06 Jul '18

> anonymously donate Well, very few places take cash or money order in the mail. Call them stupid to not take the money. Then there's AML with bitcoin, etc. > a persistent nym Building a persistent nym is handy if you wish to establish such a personage for compartemented tasks, etc. However, there are linkable nyms and unlinkable ones. Advocating that users or sites evolve to support only linkable nyms is not a good idea. For example, the 'invite' or 'cell number' type nym systems are an example of terrible privacy policy. People need the ability to create new, unlinked, taint free, accounts whenever they want. They many need more than one persona, or to come back as a fresh incarnation of themselves when up against unwarranted/irrational dislike. > But no practical software infrastructure exists for [nym tech]. Linkable nyms are worthless for some people and purposes, so I've no problem with that lack. If I ran a system, I would allow signups from anywhere, no 'recovery' email, no name, no cell, no geoip. Nothing but username, password, and a few strong captchas to keep out the bots. Maybe even a time delay (n days) to calm down the impulse users. AND definitely... a policy that allows me to nuke misbehaving accounts at will. Because let's be honest, if you've got the helpdesk cycles to learn all about VPN's, scrape proxy lists, scrape Tor, sink ip's etc... you've surely got it to sink accounts on verifiable abuse reports. Come on people, hitting 'delete' just isn't all that hard, especially when your policy permits it. Do NOT penalize those who need multiple random unlinked accounts by blocking ip's, making up nym systems, etc. Penalize the accounts that act up. They are the bad ones, not the former. > This isn't something the Tor Project needs to fix except through > continued marketing and education. I would actually donate much more to Tor/EFF project if I could earmark it for a formal emissary to talk with some of the sites I've seen implementing bad policy. And hopefully report back to me with the positive results ... > I'd suggest emailing the administrator of the forums you're having > trouble with ... and explain what Tor is ... ... because when I do (under a separate unlinkable nym of course), I end up ignored as the expendable small guy. > Tor is more of a hack to give back some privacy. To bring things > more in line with the romantic image of the Internet. Because > people want to see the Internet as a nice place where people go > to share ideas Exactly! And when I can't use these sites in perfectly good, responsible, creative and nice ways... because they have implemented crap blocking policies... it pisses me the fuck off. Anonymous != evil. That is what we need to be teaching. _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[>Htech] Tracking a Specific Machine Anywhere On The Net
by Eugen Leitl 06 Jul '18

06 Jul '18

Link: http://slashdot.org/article.pl?sid=05/03/04/1355253 Posted by: Zonk, on 2005-03-04 16:45:00 from the not-the-sandra-bullock-movie dept. An anonymous reader writes "An article on ZDNet Australia tells of a new technique developed at CAIDA that involves using the individual machine's clock skew to [1]fingerprint it anywhere on the net." Possible uses of the technique include "tracking, with some probability, a physical device as it connects to the Internet from different access points, counting the number of devices behind a NAT even when the devices use constant or random IP identifications, remotely probing a block of addresses to determine if the addresses correspond to virtual hosts (for example, as part of a virtual honeynet), and unanonymising anonymised network traces." References 1. http://www.zdnet.com.au/news/security/0,2000061744,39183346,00.htm ----- End forwarded message ----- How to track a PC anywhere it connects to the Net Renai LeMay, ZDNet Australia March 04, 2005 URL: http://www.zdnet.com.au/news/security/0,2000061744,39183346,00.htm Anonymous Internet access is now a thing of the past. A doctoral student at the University of California has conclusively fingerprinted computer hardware remotely, allowing it to be tracked wherever it is on the Internet. In a paper on his research, primary author and Ph.D. student Tadayoshi Kohno said: "There are now a number of powerful techniques for remote operating system fingerprinting, that is, remotely determining the operating systems of devices on the Internet. We push this idea further and introduce the notion of remote physical device fingerprinting ... without the fingerprinted device's known cooperation." The potential applications for Kohno's technique are impressive. For example, "tracking, with some probability, a physical device as it connects to the Internet from different access points, counting the number of devices behind a NAT even when the devices use constant or random IP identifications, remotely probing a block of addresses to determine if the addresses correspond to virtual hosts (for example, as part of a virtual honeynet), and unanonymising anonymised network traces." NAT (network address translation) is a protocol commonly used to make it appear as if machines behind a firewall all retain the same IP address on the public Internet. Kohno seems to be aware of the interest from surveillance groups that his techniques could generate, saying in his paper: "One could also use our techniques to help track laptops as they move, perhaps as part of a Carnivore-like project". Carnivore was Internet surveillance software built by the United States' Federal Bureau of Investigation. Earlier in the paper Kohno overshadowed possible forensics applications, saying that investigators could use his techniques "to argue whether a given laptop was connected to the Internet from a given access location". Another application for Kohno's technique is to "obtain information about whether two devices on the Internet, possibly shifted in time or IP addresses, are actually the same physical device." The technique works by "exploiting small, microscopic deviations in device hardware: clock skews." In practice, Kohno's paper says, his techniques "exploit the fact that most modern TCP stacks implement the TCP timestamps option from RFC 1323 whereby, for performance purposes, each party in a TCP flow includes information about its perception of time in each outgoing packet. A fingerprinter can use the information contained within the TCP headers to estimate a device's clock skew and thereby fingerprint a physical device." Kohno goes on to say: " Our techniques report consistent measurements when the measurer is thousands of miles, multiple hops, and tens of milliseconds away from the fingerprinted device, and when the fingerprinted device is connected to the Internet from different locations and via different access technologies. Further, one can apply our passive and semi-passive techniques when the fingerprinted device is behind a NAT or firewall." And the paper stresses that "For all our methods, we stress that the fingerprinter does not require any modification to or cooperation from the fingerprintee." Kohno and his team tested their techniques on many operating systems, including Windows XP and 2000, Mac OS X Panther, Red Hat and Debian Linux, FreeBSD, OpenBSD and even Windows for Pocket PCs 2002. "In all cases," the paper says, "we found that we could use at least one of our techniques to estimate clock skews on the machines and that we required only a small amount of data, although the exact data requirements depended on the operating system in question." Putting the techniques to the test with a wider test also proved fruitful for the researchers. "We also measured the clock skews of 69 (seemingly identical) Windows XP SP1 machines in one of our institution's undergraduate computing facilities. The latter experiment, which ran for 38 days, as well as other experiments, show that the clock skew estimates for any given machine are approximately constant over time, but that different machines have detectably different clock skews," said the paper. Although the paper says that "It has long been known that seemingly identical computers can have disparate clock skews," it goes on to conclude that "the main advantage of our techniques ... is that our technique can be mountable by adversaries thousands of miles and multiple hops away." Information about the technique came to light when KC Claffy, principal investigator for the Cooperative Association for Internet Data Analysis (CAIDA) forwarded information about the project to a mailing list, "in the interest of full and early disclosure". However Claffy also said in her email: "Please don't forward to any bad guys." Kohno is also associated with CAIDA. Kohno's research is due to be presented at the Institute of Electrical and Electronics Engineers Symposium on Security and Privacy to be held in California in May. Copyright ) 2005 CNET Networks, Inc. All Rights Reserved. ZDNET is a registered service mark of CNET Networks, Inc. ZDNET Logo is a service mark of CNET NETWORKS, Inc. -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0