I'd bet by the time this post reaches the list most Cypherpunks &c will have already seen the string of information posted on Wired and other places, about AT&T's network. This is a level of detail that I strongly suspect has NSA folks shitting bricks: http://www.wired.com/news/technology/0,70908-0.html?tw=wn_index_2 Here's an interesting quote:
One of the documents appears to describe AT&T's successful efforts to tap into 16 fiber-optic >cables connecting the company's WorldNet internet backbone to other internet service providers. >The document shows AT&T technicians phasing in fiber-optic splitters throughout February 2003,
cutting them in four at a time on a weekly schedule, ending with a link to Mae West, an internet >exchange point for West Coast traffic.
Now this is REALLY interesting: http://blog.wired.com/images/nsadocs2_f.jpg OK, this means the 16 fibers mentioned above are single wavelength. From this document we can also view what the actual bandwidths are: OC-12s and OC-48s, a couple of OC-3s and no OC-192s. Now I don't see any documentation stating that there isn't more than this going into the room. The "four splitters at a time" almost certainly implies that this traffic is coming off a 4-fiber BLSR (most likely too NSA worked with the other carriers to move the traffic to protect prior to installing the splitters).* Theoretically, they could actually just backhaul all of this traffic using pretty ordinary 16 wavelength WDM from any number of vendors. Getting that cross-country is difficult, but with ULH (Ultra Long Haul) this could be done with a relative minimum of repeater/amplifier sites. If they pre-sort the traffic before backhauling it they could then actually just buy a wavelength on AT&T's backbone, which has some nice features to it (I'd bet they also have their own encryption used for the entire wavelength pipe, though I could be wrong). The pinchpoint here just might actually be the deep packet inspection. Does anyone know what kind of bandwidth the narus boxes can support? What this will do is give us an idea of how much traffic they are actually taking back. From our discussions some months ago, I have assumed (and still believe) that they can't grab EVERYTHING and pull it back, because that would require too obvious and too huge a network. My other assumption is that the narus deep packet inspection is enforcing a prioritization prior to hockeying the most "juicy" traffic into their fiber or wavelegnths. *: They would have first told the owner/carrier of one of those OC-N pipes to force a switch to protection bandwidth while they installed the splitters, and then switch back once the splitters were installed. It LOOKS like they did this ring-by-ring, diverting traffic away from the "break" and then installing splitters on all four fibers terminating across the break.
You know I really enjoyed George Orwells Popcorn. Maybe that was Redenbockers' Popcorn while reading George Orwell...hehe... Here is my dumb question for the day, but can someone show me where my logic has run aloof? The NSA's claim is not to have listened to the content, just collected it. "Assuming" their telling the truth on this, I thought they may be trying to create a bell-curve type application that scans the messages for content based on predetermined criteria (similar to content filters I assume). However, the flaw I see is similar to the idea behind changing speed limits on residential streets. Public safety sets up the electronic signs to monitor speed limits, and flashes if you travel above the posted limit. Except the data can be ruined (for lack of a better word) if the drivers sneak up on the sign and gun-it past it, repeatedly! How this applies to the NSA model: If normal citizens are polluting their data by using more vulgar or "terror driven" speech. How will they know legitimate traffic from crank-yankers? -chris Y.A.C.Y. On 17/05/06, Tyler Durden <camera_lumina@hotmail.com> wrote:
I'd bet by the time this post reaches the list most Cypherpunks &c will have already seen the string of information posted on Wired and other places, about AT&T's network. This is a level of detail that I strongly suspect has NSA folks shitting bricks:
http://www.wired.com/news/technology/0,70908-0.html?tw=wn_index_2
Here's an interesting quote:
One of the documents appears to describe AT&T's successful efforts to tap into 16 fiber-optic >cables connecting the company's WorldNet internet backbone to other internet service providers. >The document shows AT&T technicians phasing in fiber-optic splitters throughout February 2003,
cutting them in four at a time on a weekly schedule, ending with a link to Mae West, an internet >exchange point for West Coast traffic.
Now this is REALLY interesting:
http://blog.wired.com/images/nsadocs2_f.jpg
OK, this means the 16 fibers mentioned above are single wavelength. From this document we can also view what the actual bandwidths are: OC-12s and OC-48s, a couple of OC-3s and no OC-192s. Now I don't see any documentation stating that there isn't more than this going into the room. The "four splitters at a time" almost certainly implies that this traffic is coming off a 4-fiber BLSR (most likely too NSA worked with the other carriers to move the traffic to protect prior to installing the splitters).*
Theoretically, they could actually just backhaul all of this traffic using pretty ordinary 16 wavelength WDM from any number of vendors. Getting that cross-country is difficult, but with ULH (Ultra Long Haul) this could be done with a relative minimum of repeater/amplifier sites. If they pre-sort the traffic before backhauling it they could then actually just buy a wavelength on AT&T's backbone, which has some nice features to it (I'd bet they also have their own encryption used for the entire wavelength pipe, though I could be wrong).
The pinchpoint here just might actually be the deep packet inspection. Does anyone know what kind of bandwidth the narus boxes can support?
What this will do is give us an idea of how much traffic they are actually taking back. From our discussions some months ago, I have assumed (and still believe) that they can't grab EVERYTHING and pull it back, because that would require too obvious and too huge a network. My other assumption is that the narus deep packet inspection is enforcing a prioritization prior to hockeying the most "juicy" traffic into their fiber or wavelegnths.
*: They would have first told the owner/carrier of one of those OC-N pipes to force a switch to protection bandwidth while they installed the splitters, and then switch back once the splitters were installed. It LOOKS like they did this ring-by-ring, diverting traffic away from the "break" and then installing splitters on all four fibers terminating across the break.
-- -G "The knack of flying is learning how to throw yourself at the ground and miss." "He felt that his whole life was some kind of dream and he sometimes wondered whose it was and whether they were enjoying it." "He inched his way up the corridor as if he would rather be yarding his way down it..." "We demand rigidly defined areas of doubt and uncertainty!" "I love deadlines. I like the whooshing sound they make as they fly by." Famous Quotes written by Douglas Adams, (British comic writer, 1952-2001) http://hitchhikers.movies.go.com/
Well, I suspect they do a lot more before inspection, and use a statistical model to trigger whether the actually grab and backhaul any piece of traffic. "Obviously", Source and destination country will matter, then within the US source and destination IP address (eg, knock into low-risk bucket if both source and destination IP correspond to Citigroup, even if one IP is within Saudi)...application is obviously going to matter, presence of crypto (and possible "crypto depth") and all the way up to L7 including key words. Clearly, this policy is going to be risk-model driven and will undergo periodic changes (implying too that NSA has their own LAN by which they download new policies remotely into the Narus boxes). It would be "nice" too if their models fill up their available backhauling bandwidth. Now that just determines what traffic gets backhauled. It's a big vacuum cleaner that grabs as much as they can within requiring that they build a completely duplicate optical network. After that the traffic gets pulled into the Beltway (most likely) where further models probably determine whether the traffic gets stored, read by humans "now", or whatever. Note that by this time having a human actually bother to "read" an email or whatever is not necessarily important, even if it's encrypted. What this means (to your point) is that merely building better crypto is only one axis to protect your privacy. If your communication gets as far as the Beltway and human examiners (or possibly gets shot down to their subterranean cracking farm) then you're already "of interest". With good enough crypto it's -possible- that you can thwart their attempts to actually read your email, and that's good because it forces them to decide whether they want to expend the big $$$ and risk exposure for a field operation. But the other axis is statistical (as you point out). It's far better to never get caught in the NSA driftnets in the first place. This means stego, this means P2P (hum...what if I had a P2P video of a document I wanted to transmit...NSA wouldn't be able to read that document, right?) this means (somehow) encouraging more crypto in more places so your traffic doesn't stick out. -TD
From: "Chris Olesch" <g13005@gmail.com> To: cypherpunks@jfet.org, "Tyler Durden" <camera_lumina@hotmail.com> Subject: Re: NS&AT&T Date: Wed, 17 May 2006 11:34:47 -0500
You know I really enjoyed George Orwells Popcorn. Maybe that was Redenbockers' Popcorn while reading George Orwell...hehe...
Here is my dumb question for the day, but can someone show me where my logic has run aloof?
The NSA's claim is not to have listened to the content, just collected it. "Assuming" their telling the truth on this, I thought they may be trying to create a bell-curve type application that scans the messages for content based on predetermined criteria (similar to content filters I assume).
However, the flaw I see is similar to the idea behind changing speed limits on residential streets. Public safety sets up the electronic signs to monitor speed limits, and flashes if you travel above the posted limit. Except the data can be ruined (for lack of a better word) if the drivers sneak up on the sign and gun-it past it, repeatedly!
How this applies to the NSA model: If normal citizens are polluting their data by using more vulgar or "terror driven" speech. How will they know legitimate traffic from crank-yankers?
-chris Y.A.C.Y.
On 17/05/06, Tyler Durden <camera_lumina@hotmail.com> wrote:
I'd bet by the time this post reaches the list most Cypherpunks &c will have already seen the string of information posted on Wired and other places, about AT&T's network. This is a level of detail that I strongly suspect has NSA folks shitting bricks:
http://www.wired.com/news/technology/0,70908-0.html?tw=wn_index_2
Here's an interesting quote:
cutting them in four at a time on a weekly schedule, ending with a
One of the documents appears to describe AT&T's successful efforts to tap into 16 fiber-optic >cables connecting the company's WorldNet internet backbone to other internet service providers. >The document shows AT&T technicians phasing in fiber-optic splitters throughout February 2003, link to Mae West, an internet >exchange point for West Coast traffic.
Now this is REALLY interesting:
http://blog.wired.com/images/nsadocs2_f.jpg
OK, this means the 16 fibers mentioned above are single wavelength. From this document we can also view what the actual bandwidths are: OC-12s and OC-48s, a couple of OC-3s and no OC-192s. Now I don't see any documentation stating that there isn't more than this going into the room. The "four splitters at a time" almost certainly implies that this traffic is coming off a 4-fiber BLSR (most likely too NSA worked with the other carriers to move the traffic to protect prior to installing the splitters).*
Theoretically, they could actually just backhaul all of this traffic using pretty ordinary 16 wavelength WDM from any number of vendors. Getting that cross-country is difficult, but with ULH (Ultra Long Haul) this could be done with a relative minimum of repeater/amplifier sites. If they pre-sort the traffic before backhauling it they could then actually just buy a wavelength on AT&T's backbone, which has some nice features to it (I'd bet they also have their own encryption used for the entire wavelength pipe, though I could be wrong).
The pinchpoint here just might actually be the deep packet inspection. Does anyone know what kind of bandwidth the narus boxes can support?
What this will do is give us an idea of how much traffic they are actually taking back. From our discussions some months ago, I have assumed (and still believe) that they can't grab EVERYTHING and pull it back, because that would require too obvious and too huge a network. My other assumption is that the narus deep packet inspection is enforcing a prioritization prior to hockeying the most "juicy" traffic into their fiber or wavelegnths.
*: They would have first told the owner/carrier of one of those OC-N pipes to force a switch to protection bandwidth while they installed the splitters, and then switch back once the splitters were installed. It LOOKS like they did this ring-by-ring, diverting traffic away from the "break" and then installing splitters on all four fibers terminating across the break.
-- -G
"The knack of flying is learning how to throw yourself at the ground and miss." "He felt that his whole life was some kind of dream and he sometimes wondered whose it was and whether they were enjoying it." "He inched his way up the corridor as if he would rather be yarding his way down it..." "We demand rigidly defined areas of doubt and uncertainty!" "I love deadlines. I like the whooshing sound they make as they fly by."
Famous Quotes written by Douglas Adams, (British comic writer, 1952-2001) http://hitchhikers.movies.go.com/
On 5/17/06, Tyler Durden <camera_lumina@hotmail.com> wrote:
Well, I suspect they do a lot more before inspection, and use a statistical model to trigger whether the actually grab and backhaul any piece of traffic.
i'd love to know how much manpower is assigned to defining and tuning these filters. this is a difficult process to be sure.
Clearly, this policy is going to be risk-model driven and will undergo periodic changes (implying too that NSA has their own LAN by which they download new policies remotely into the Narus boxes).
the SunFire V880 is the Narus controller according to the docs and i bet the filter updates are pretty frequent. they might even use an IPsec VPN over the backhaul fiber via the cisco/juniper switches listed.
It would be "nice" too if their models fill up their available backhauling bandwidth.
indeed. and the StorEdge T3 could cache quite a bit during peak activity to fill up idle periods later at night. (oh crap, i hope we aren't giving them ideas! ;)
What this means (to your point) is that merely building better crypto is only one axis to protect your privacy.
yes. it keeps that layer 7 inspection guessing past layer 4. a large, reputable zero knowledge mix is what would be ideal, though the latency induced makes certain services impossible or unfriendly. i love to promote out of band distribution any chance i get, including sneaker net with DVD-R's and local wireless networks between peers. but you really need a zero knowledge configuration to be sure.
... With good enough crypto it's -possible- that you can thwart their attempts to actually read your email, and that's good because it forces them to decide whether they want to expend the big $$$ and risk exposure for a field operation.
i have faith in well designed hardware entropy sources and AES-256 in hardware when frequently rekeyed. pubkey crypto makes me nervous (long term) but will always be useful. i have much less faith in the systems around these crypto primitives, be it operating systems or protocols down to physical security and side channels. i bet the black bag jobs are almost always 100% effective.
But the other axis is statistical (as you point out). It's far better to never get caught in the NSA driftnets in the first place. This means stego, this means P2P (hum...what if I had a P2P video of a document I wanted to transmit...NSA wouldn't be able to read that document, right?) this means (somehow) encouraging more crypto in more places so your traffic doesn't stick out.
100,000,000 peers running a zero knowledge mix off their broadband connection. i don't think stego would be effective; if there was an unbreakable stego system the overhead would be significant. (there was a design a fellow at DC13 described using inodes on valid file systems for storage, but this doesn't give you much space compared to the physical storage capacity used overall) but lots of crypto everywhere would certainly help make the presence of encryption alone less interesting. (as has been rumored on this list and elsewhere that merely using encryption makes you interesting)
Oh yeah....
i'd love to know how much manpower is assigned to defining and tuning these filters. this is a difficult process to be sure.
They'll have a team of SAS and demographics experts somewhere. Given the financial services industry, this could be anywhere from half a dozen to several dozen people.
the SunFire V880 is the Narus controller according to the docs and i bet the filter updates are pretty frequent. they might even use an IPsec VPN over the backhaul fiber via the cisco/juniper switches listed.
Yes...it's VERY interesting to consider how they are transmitting those policy updates. Clearly they have a LAN. Does it use dedicated bandwdith? (eg, it's own GbE, for instance) are they in-band with other traffic? (ie, a tunneled VPN inside a big GbE?) or are they leveraging some of the unused SONET DCC-ish overhead bytes? The next obvious question could actually cause a knock on the door so I won't ask it.
On 5/17/06, Tyler Durden <camera_lumina@hotmail.com> wrote:
The next obvious question could actually cause a knock on the door so I won't ask it.
I doubt the NSA cares about this list anymore (assuming they ever did). Back to the topic at hand, I'm sure they do policy updates via whatever channel they are recieving data. It's very common to just have a single out of band reporting/management link. And I'd be surpised if these servers had any type of internal/external storage, such as the suggested Storedge. They most likely boot off the network, so if the servers are grabbed, there is only the contents of ram to worry about, and I'm sure there are rather explosive safeguards against that. A side benefit of having the filesystem living on an nfs server somewhere is that the above mentioned policy updates could be as simple as changing a single file on the storage server, and having all the sniffing servers immediately updated. I'm sure there are customized local policies for each region, but there would be a set of shared common policy. Mike
On 5/17/06, Mike Owen <kyphros@gmail.com> wrote:
... I doubt the NSA cares about this list anymore (assuming they ever did).
hmm, i recall amusing conversations about honey tokens and baiting TLA's. *grin*
Back to the topic at hand, I'm sure they do policy updates via whatever channel they are recieving data. It's very common to just have a single out of band reporting/management link.
true, this is probably how it is done. would IPsec or some NSA built auth & privacy at layer 2 be more likely?
And I'd be surpised if these servers had any type of internal/external storage, such as the suggested Storedge. They most likely boot off the network, so if the servers are grabbed, there is only the contents of ram to worry about, and I'm sure there are rather explosive safeguards against that.
consider this vicious rumor but a little birdie informed me that physical security at these locations is well covered. strategically placed cages, reinforced and locked, armed guards. all this on top of the usually very tight security at these facilities. (though it sounded like the guards were a recent introduction. someone getting nervous about legitimate employees poking around?) so in this case i think there is probably useful data on the disks (the filters and controlling software for the narus / other equipment), caching might be implemented (the T3's on fibre channel have some nice throughput, although this configuration is years old at this point), and i very much doubt any destructive countermeasures.
A side benefit of having the filesystem living on an nfs server somewhere is that the above mentioned policy updates could be as simple as changing a single file on the storage server, and having all the sniffing servers immediately updated.
network file systems introduce reliability concerns. intermittent link outages would mean a bit of caching in the local case, but might cause monitoring / capture failure in a network file system scenario. maybe we'll find out in the near future. :)
Back to the topic at hand, I'm sure they do policy updates via whatever channel they are recieving data. It's very common to just have a single out of band reporting/management link.
true, this is probably how it is done. would IPsec or some NSA built auth & privacy at layer 2 be more likely?
Well, how out of band? Do you mean the management VPN (or whatever) doesn't travel with the actual grabbed traffic? (Frankly, this would be my first candidate.) Of course, they could do it via SONET overhead bytes, thus avoiding the flakiness and vunerability that routers and switches still seem to have. One wonders too if they do anything with SS7. Of course, they could have a dedicated fiber for their management LAN, but due to latency issues &c I would suspect that can't be a LAN all the way across the country...they've got to Long-Haul the management traffic somehow, which implies packing it into a 100BaseT or whatever and then shipping that out either packed in SONET or with other circuit-switched traffic. Or of course, they might just have their management on something like STS-3C POS, and the rest of their OC-48/192 carries real traffic. Anyone know what telecom vendor NSA uses? -TD -TD
On 5/17/06, Tyler Durden <camera_lumina@hotmail.com> wrote:
... Well, how out of band? Do you mean the management VPN (or whatever) doesn't travel with the actual grabbed traffic? (Frankly, this would be my first candidate.)
i was thinking three scenarios: 1. backhaul is a dedicated link (SONET?*) with encryption at this layer and control/management out of band. 2. backhaul and control/mgmt on the dedicated link (SONET?*) with encryption at this layer, no IPsec. 3. backhaul and control/mgmt on the dedicated link using IPsec for both. (least likely perhaps) the nature of SONET would make encryption at this layer tricky i think (L2/L3?) although the NSA is fond of authentication and privacy at the link layer. if a desire to leverage commercial solutions (narus, cisco, juniper, etc) won out would a strongly keyed IPsec be sufficient? no ISAKMP/IKE here, heh.
Of course, they could do it via SONET overhead bytes, thus avoiding the flakiness and vunerability that routers and switches still seem to have.
covert channels for backhaul? nah, that would still be too visible. especially if/when a customer puts link testing equipment on the line and sees something funny. SONET doesn't give you a lot of play room.
One wonders too if they do anything with SS7.
not for this. capturing SS7 would be useful and is surely performed though...
Of course, they could have a dedicated fiber for their management LAN, but due to latency issues &c I would suspect that can't be a LAN all the way across the country...
why not? most of these SONET/[D]WDM links are long haul anyway. it's not a single repeated fiber, but hops along backbone peering points like everything else. also casts an interesting light on the new super NSA warehouse planned for Denver, CO doesn't it. nice place to position tap aggregation...
Anyone know what telecom vendor NSA uses?
AT&T, Verizon and Sprint for sure. probably lease fiber (through some obfuscated shell company / other agency configuration?) from all of them to some degree, including the transoceanic cable oligopolies. one way to find out: - perform your own non-interruptive tap on the fibers exiting $telco via infiltration of outside plant conduit. (so easy, lol) - using test equipment see what SONET link(s) are full of blackened traffic. you could use AS no's or BGP/SS7 characteristics to identify legitimate circuits and highlight the blackened ones via elimination. - ask Sean Gorman or GeoTEL MetroFiber which provider sold out that particular circuit/fiber/route. something tells me this is beyond the means of your average hacker. FOIA requests it is then... *grin* for the record: i'm not advocating illegal intrusions; this is a mental exercise. :) [ i'm not too paranoid about visits from MIB's but mapping critical information infrastructure is definitely one way to attract attention. maybe i'll talk more about that later... ]
Coderman wrote...
Of course, they could do it via SONET overhead bytes, thus avoiding the flakiness and vunerability that routers and switches still seem to have.
covert channels for backhaul? nah, that would still be too visible. especially if/when a customer puts link testing equipment on the line and sees something funny. SONET doesn't give you a lot of play room.
There are plenty of unused bytes in the SONET overhead, particularly at OC-48 and OC-192 (in fact, most of the line and section overhead is empty because the overhead bytes are only defined for the first STS-1! Not a lot of people know that). The problem, however, is that Line and Section layer overhead will be terminated pretty much every time they pass through a SONET box. There's the possibility of using the POH for control and management traffic, because that -should- stay with the payload. In terms of visibility they could of course encrypt those packets, possibly even using off-the-shelf VPN of they run a short stack management channel (though 7-layer/OSI is not impossible, given the old fondness for it in standards groups for so long). On the other hand they could possibly just go in-band and send the management info with their backhauled traffic, but I'm still a little doubtful about that. -TD
On Wed, 17 May 2006, Tyler Durden wrote:
Anyone know what telecom vendor NSA uses?
Lucent (now French, I believe?) -- Yours, J.A. Terranson sysadmin@mfn.org 0xBD4A95BF 'The right of self defence is the first law of nature: in most governments it has been the study of rulers to confine this right within the narrowest limits possible. Wherever standing armies are kept up, and the right of the people to keep and bear arms is, under any colour or pretext whatsoever, prohibited, liberty, if not already annihilated, is on the brink of destruction.' St. George Tucker
Yes...I think using US vendors whenever possible was always part of their policy. Let me look at the latest Lucent gear. Actually, of all the documents I've seen until now, the only real smoking gun is the use of the optical splitters themselves...if everything was above board they should have been able to drop-and-continue copies of the traffic "legally" using the transport equipment itself. Also, the fact that AT&T tryed to surpress the documentation says a lot too. They could have played it cool: "Nothing to see here, see? We were just testing traffic like we always do..." -TD
From: "J.A. Terranson" <measl@mfn.org> To: Tyler Durden <camera_lumina@hotmail.com> CC: coderman@gmail.com, kyphros@gmail.com, cypherpunks@jfet.org Subject: Re: NS&AT&T Date: Mon, 22 May 2006 13:23:48 -0500 (CDT)
On Wed, 17 May 2006, Tyler Durden wrote:
Anyone know what telecom vendor NSA uses?
Lucent (now French, I believe?)
-- Yours,
J.A. Terranson sysadmin@mfn.org 0xBD4A95BF
'The right of self defence is the first law of nature: in most governments it has been the study of rulers to confine this right within the narrowest limits possible. Wherever standing armies are kept up, and the right of the people to keep and bear arms is, under any colour or pretext whatsoever, prohibited, liberty, if not already annihilated, is on the brink of destruction.'
St. George Tucker
From: "Mike Owen" <kyphros@gmail.com> To: cypherpunks@jfet.org Subject: Re: NS&AT&T Date: Wed, 17 May 2006 15:33:20 -0700
On 5/17/06, Tyler Durden <camera_lumina@hotmail.com> wrote:
The next obvious question could actually cause a knock on the door so I won't ask it.
I doubt the NSA cares about this list anymore (assuming they ever did).
Well, just think about the $$$ that have flowed into NSA and the War on TERROR! and how few actual terrorists there are. You can be damned sure someone's monitoring this list, most probably as their full time job. Fuck, they probably post occasionally just out of boredom. True? -TD
There were once cpunk subscribers from NSA's National Computer Security Center (ncsc.mil; 144.51.x.x) in the 90s and a slew of .mils, .govs and others interested in crypto before it became a porkbelly commodity. Learning from cpunks, a daily bot from ncsc came to JYA.com (predecessor of Cryptome) when it set up in 1996, and took anything new: http://jya.com/nsa-bot.htm There are still occasional visits from several ncsc machines but not a daily bot, at least not by that couture label. Here's a list of 2,821 machine addresses at ncsc in 2001: http://cryptome.org/nsa-2821.htm Never a hit from nsa.gov, which appears to be only public tool like fbi.gov not used for lazy gandering and fucking off. NSANET and www.nsa (no extension) are hard to crack but once gave good comsec, maybe still do: https://www.advancement.cnet.navy.mil/courses/StudentFunctions/enrollment/Se cSources.asp
On 5/17/06, Tyler Durden <camera_lumina@hotmail.com> wrote:
... Well, just think about the $$$ that have flowed into NSA and the War on TERROR! and how few actual terrorists there are. You can be damned sure someone's monitoring this list, most probably as their full time job.
they subscribe via narus feed of course :)
At 06:21 PM 5/17/2006, Tyler Durden wrote:
Well, just think about the $$$ that have flowed into NSA and the War on TERROR! and how few actual terrorists there are. You can be damned sure someone's monitoring this list, most probably as their full time job. Fuck, they probably post occasionally just out of boredom. True?
Nah, they stopped monitoring us years ago, when Tim May had been gone long enough that we stopped talking about him :-)
At 10:54 PM -0700 5/17/06, Bill Stewart wrote:
Nah, they stopped monitoring us years ago, when Tim May had been gone long enough that we stopped talking about him :-)
"When I was your age we didn't have Tim May! We had to be paranoid on our own! And we were grateful!" --Alan Olsen -- ----------------- R. A. Hettinga <mailto: rah@ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "...our claim to be left in the unmolested enjoyment of vast and splendid possessions, mainly acquired by violence, largely maintained by force, often seems less reasonable to others than to us." -- Winston Churchill, January 1914
On Wed, May 17, 2006 at 06:06:21PM -0400, Tyler Durden wrote:
The next obvious question could actually cause a knock on the door so I won't ask it.
Why would you fear it? It would be a badge of honor. But no fear, they won't -- it would be giving away capabilities. Many have claimed LEOs were reading the list in the past, but I presume by a direct subscription. I don't think human eyes see much of this traffic, but no doubt all of it goes into storage. As all low-volume traffic (I don't think anybody bothers with video, and maybe audio). How would you trace back large scale purchases of hard drives and computer clusters to a TLA? They have to use contractors for that. -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]
Eugene Leitl said...
How would you trace back large scale purchases of hard drives and computer clusters to a TLA? They have to use contractors for that.
Ah...I think that's a very interesting question, particularly in the larger sense. Public companies have to (and are well motivated to) report on their sales. A nice deep, statistical dive could probably reveal what equipment they're buying, at least as $$$/sale-->oo. Hell, a lot of these are even annouced as "Lucent signed a $1.5B contract to supplies equipment and services to the government today..." Too bad there are no other superpowers around these days. Then again, I suspect the Soviets were always too fucked up to bother with something like that. -TD
Maybe its just me, but my brother-in-law and I used to wonder why most of AT&T's cable traffic routed thru the east coast before going out west (or asia). This would have been well within the range they decided to setup camp. early 2002 thru 2003 (maybe 2004). On the MOT backbone traffic was routed normally, yet at-home it took extra routes. Tracert after tracert from within att's net, would mention long routes. It would bounce 3 or 4 times go out the chicago trunk then end up on some cia, or other federal line, then go back (but this time around chicago) and end in cali. If our destination was Japan, or Siberia, the chat latency was unbearable. I was glad when comcast took over, but then again maybe all this humdrum was removed from the line (tracesrt's). Him and I were aware of the echelon systems way before the public had, and of course were riduled as being paranoids or were those arkanoids...lol...Heck for fun were had carnivore installed on everything, though my favorite plugin was "Carnivore is sorry!" Everytime, him and I are talking with friends or associates who bring up the nsa this, or the fbi is spying, we just laugh, because we look at them and say, "and this suprises you how? hmm, funny I seem to remember mentioning this a long time ago, and you thought I was a crackpot!" Then we just look at them, deny what they are saying..."I'm sure I don't know what you are talking about." or "Maybe you should see a doctor about your recent flares of paranoia's, the US government doesn't get involved in domestic espionage, especially since we do our best to vote in all these fantastic "TOP" officials" If you ask me, someone is laughing all the way down the data pipe, and maybe maniacally too...hehe -- -G "The knack of flying is learning how to throw yourself at the ground and miss." "He felt that his whole life was some kind of dream and he sometimes wondered whose it was and whether they were enjoying it." "He inched his way up the corridor as if he would rather be yarding his way down it..." "We demand rigidly defined areas of doubt and uncertainty!" "I love deadlines. I like the whooshing sound they make as they fly by." Famous Quotes written by Douglas Adams, (British comic writer, 1952-2001) http://hitchhikers.movies.go.com/
On 2006-05-17T15:42:41-0400, Tyler Durden wrote:
But the other axis is statistical (as you point out). It's far better to never get caught in the NSA driftnets in the first place. This means stego, this means P2P (hum...what if I had a P2P video of a document I wanted to transmit...NSA wouldn't be able to read that document, right?) this means (somehow) encouraging more crypto in more places so your traffic doesn't stick out.
I suspect that anyone caught by narus sending any sort of unusual encrypted traffic (i.e. not skype or ssl on port 443), particularly traffic to a published tor node or to a known mix node, is automatically put in the "somewhat interesting" bucket. Thus, the kind of people who can avoid being caught in the dragnet by using stego have already been caught due to earlier experimentation. If the NSA has access to ISP subscription records, which current news reports suggest they do, even changing IPs or ISPs is not enough. You have to create a completely new identity, or you have to abuse an open net connection somewhere. And open connections like wireless hotspots are probably already flagged due to interesting traffic coming from them in the past. -- The six phases of a project: I. Enthusiasm. IV. Search for the Guilty. II. Disillusionment. V. Punishment of the Innocent. III. Panic. VI. Praise & Honor for the Nonparticipants.
You would think that if they wanted to lure customers into their spiderweb, they would simply offer free internet access, and burry a 'we have the right to spy on your' clause somewhere in the agreement. I'm sure the sheeply would be more than happy to surrender their souls for that....hehe On 18/05/06, Justin <justin-cypherpunks@soze.net> wrote:
On 2006-05-17T15:42:41-0400, Tyler Durden wrote:
But the other axis is statistical (as you point out). It's far better to never get caught in the NSA driftnets in the first place. This means stego, this means P2P (hum...what if I had a P2P video of a document I wanted to transmit...NSA wouldn't be able to read that document, right?) this means (somehow) encouraging more crypto in more places so your traffic doesn't stick out.
I suspect that anyone caught by narus sending any sort of unusual encrypted traffic (i.e. not skype or ssl on port 443), particularly traffic to a published tor node or to a known mix node, is automatically put in the "somewhat interesting" bucket.
Thus, the kind of people who can avoid being caught in the dragnet by using stego have already been caught due to earlier experimentation.
If the NSA has access to ISP subscription records, which current news reports suggest they do, even changing IPs or ISPs is not enough. You have to create a completely new identity, or you have to abuse an open net connection somewhere. And open connections like wireless hotspots are probably already flagged due to interesting traffic coming from them in the past.
-- The six phases of a project: I. Enthusiasm. IV. Search for the Guilty. II. Disillusionment. V. Punishment of the Innocent. III. Panic. VI. Praise & Honor for the Nonparticipants.
-- -G "The knack of flying is learning how to throw yourself at the ground and miss." "He felt that his whole life was some kind of dream and he sometimes wondered whose it was and whether they were enjoying it." "He inched his way up the corridor as if he would rather be yarding his way down it..." "We demand rigidly defined areas of doubt and uncertainty!" "I love deadlines. I like the whooshing sound they make as they fly by." Famous Quotes written by Douglas Adams, (British comic writer, 1952-2001) http://hitchhikers.movies.go.com/
Ironically, At 3:12 AM -0500 5/19/06, Chris Olesch <g13005@gmail.com> wrote:
You would think that if they wanted to lure customers into their spiderweb, they would simply offer free internet access, and burry a 'we have the right to spy on your' clause somewhere in the agreement.
There's a name for something like that. It's called "Google". ;-) Cheers, RAH -- ----------------- R. A. Hettinga <mailto: rah@ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
On 5/17/06, Tyler Durden <camera_lumina@hotmail.com> wrote:
... Theoretically, they could actually just backhaul all of this traffic using pretty ordinary 16 wavelength WDM from any number of vendors. Getting that cross-country is difficult, but with ULH (Ultra Long Haul) this could be done with a relative minimum of repeater/amplifier sites. If they pre-sort the traffic before backhauling it they could then actually just buy a wavelength on AT&T's backbone, which has some nice features to it (I'd bet they also have their own encryption used for the entire wavelength pipe, though I could be wrong).
this would be my assumption. filter and backhaul the interesting content on leased fiber. (and pay for rack room + leased fiber, $$$) i'd love to have Sean Gorman's fiber map about now...
The pinchpoint here just might actually be the deep packet inspection. Does anyone know what kind of bandwidth the narus boxes can support?
4 x OC3 = 622,080 kbp/s 8 x OC12 = 4,976,640 kbp/s 4 x OC48 = 9,953,280 kbp/s == 15.552 Gbp/s (is half of this mostly idle protect?) given FPGA matching which can support at least a few hundred snort style rules per chip at 10GigE line speed i don't think the Narus is the bottleneck / limiting factor. this type of deep inspection scales linearly and is well within budget (though still expensive). the Narus Insight can troll 10GigE/OC-192 links at L4 and OC-48 at L7. this might explain why the circuits top out at OC-48 into the tap panel. if you had a culling ratio of 25:1 you could backhaul all the interesting traffic for this 15Gbps feed on an OC12. assuming half these links are idle protect that would drop the necessary culling in half.
4 x OC3 = 622,080 kbp/s 8 x OC12 = 4,976,640 kbp/s 4 x OC48 = 9,953,280 kbp/s == 15.552 Gbp/s (is half of this mostly idle protect?)
Most likely no. From the context of the circuit order it seemed pretty clear that this was all active traffic. These were the fibers that were opticall tapped. Also, BLSRs (Bidirectional Line Switched Rings) support "extra traffic" that gets bumped during a protection switching event, so the protect bandwdith wouldn't even be idle (though the routers would probably throttle down when they sensed less bandwidth). Interestingly, though, from your chart above it looks like they probably have a router and an OC-192.The odds of all of these pipes being full of packets at the same time is probably very small, so maybe they can indeed grab everything. -TD
participants (10)
-
Bill Stewart -
Chris Olesch -
coderman -
Eugen Leitl -
J.A. Terranson -
John Young -
Justin -
Mike Owen -
R.A. Hettinga -
Tyler Durden