campus network admins
I recently violated the network user agreement (they packet-sniffed and got the username/password for my FTP server and didn't like what I was sharing with myself) and was informed by the admin that I am now 'under observation' and that they "hope I don't like privacy". Considering this admin was an NSA employee, I tend to take that threat a little seriously. Two questions: 1) I'm assuming they can legally look at anything that comes in or out of my computer, but is that the case? Can they look at my computer itself, or take me off the network for the private contents of my computer? 2) Is there some sort of service I can use to have everything I do on the network encrypted, such as a tunneling service to the internet? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This message was sent from The Tedious Path Are you ready to travel The Tedious Path? http://www.tediouspath.com http://forum.tediouspath.com
On Thu, 04 Nov 2004 02:34:46 -0500, cypher@tediouspath.com <cypher@tediouspath.com> wrote:
I recently violated the network user agreement (they packet-sniffed and got the username/password for my FTP server and didn't like what I was sharing with myself) and was informed by the admin that I am now 'under observation' and that they "hope I don't like privacy". Considering this admin was an NSA employee, I tend to take that threat a little seriously. Two questions:
Yes, it's not wise to mock the people who busted you to their faces. Scheming requires more subtlety. Kinda like doing a big smoky burnout and leaving a hundred feet of rubber on the road in front of the cop who just gave you a speeding ticket is a bad idea.
1) I'm assuming they can legally look at anything that comes in or out of my computer, but is that the case? Can they look at my computer itself, or take me off the network for the private contents of my computer?
Read the agreement and see. Are you doing something illegal? Are you doing something that exposes the network owners to risk of some sort? Is it your personal hardware or was it provided to you by the network owners. Was there a clause in your terms of service that says the network owners can monitor/audit use, yadda yadda yadda...? Depending on the perceived severity of the infraction, your local security or police officers may be coming to pay a visit and impound your machine. Depending on which political backwater or fascist/EpithetOfChoice regime you live under, they could very well be doing you a favor. Or they could be covering their butts. Whatever - you got the short end of the stick.
2) Is there some sort of service I can use to have everything I do on the network encrypted, such as a tunneling service to the internet?
In other words "I did something that got me in trouble, I know what I'm doing is wrong, or at least if I do it again, I'll get in more trouble. Please help me to do these bad things and stay out of trouble." Be honest. It's OK to say yes. Short answer: Yes. Longer answer: SSH tunnels, IPSec tunnels, ssl-ized protocols, mixmasters, freenets, onion routers, and buying your own network connection from a 3rd party are all valid options. I'm sure that if you google for things like internet privacy service, the likes of anonymizer (just the first one that came to mind) will turn up. There are plenty of very low cost solutions if you're willing to try stuff that may break your machine for a while causing you to learn stuff the hard way. :) If there's stuff I shouldn't be doing at work (like consulting), well, that's what my home net is for. Perhaps you might want to carefully consider why your administration doesn't want you doing stuff with their network in light of what it costs to have their class of network activity. Now let's run that kind of pipe to your house, and bridge in an open wireless access point. I bet it wouldn't make you very happy to find other people abusing your network connection. Pretend you've been downloading 5 gigs of movies a day over cleartext bittorrent. You get busted, so rather than not doing that, you switch to an encrypted protocol, but continue to generate 5 gigs a day with your computer, and you're still talking to a similar bunch of hosts. Traffic analysis says we suspect you of being up to your old tricks. In this case one technical countermeasure does not help because the problem is higher up the stack... at the chair-to-keyboard interface layer. This may be a bit vague - no idea who you are or where you live, so I am generalizing. Simple truths: You have pissed off The Man - assume for the next little while that he's watching (and is seeing this). There are certain technologies available which may help you, but consider the behavioural, economic, legal and political factors as well. -- GDB has a 'break' feature; why doesn't it have 'fix' too?
On Thu, 4 Nov 2004 cypher@tediouspath.com wrote:
I recently violated the network user agreement (they packet-sniffed and got the username/password for my FTP server and didn't like what I was sharing with myself) and was informed by the admin that I am now 'under observation' and that they "hope I don't like privacy". Considering this admin was an NSA employee, I tend to take that threat a little seriously.
Depending on how trivial the violation was, it may be worth checking the FTP server logs, identifying the bad ones and collecting the evidence, and eventually, preferably after consultation with a lawyer, nail the admin with hacking charges. (Alternatively just threat with the same, with a remark that you hope he likes lawyers. I suppose you're located in the Land of Lawyers.) If it is better to play a repentant sinner, or go to a confrontation, depends on many more factors unknown to us, including the exact text of the network AUPs, the personality profile of the admin (he may be just power-tripping at you, but the severity of his threats depends on the exact content of your disk which you didn't specify), and other factors like if you are an employee or a student and how much risk you want to go through. Violating AUPs with cleartext protocols isn't a good idea, especially with nazi admins. Next time you may like to prefer ssh/scp, or WebDAV over HTTPS, or a simple password-protected upload/download interface written in PHP or as a CGI script, again over HTTPS (you may like to use one-time passwords for added security). If the admin in question can have physical access to your machine, put the sensitive/objectionable data on an encrypted partition.
Two questions:
1) I'm assuming they can legally look at anything that comes in or out of my computer, but is that the case? Can they look at my computer itself, or take me off the network for the private contents of my computer?
That depends a lot. If you're in a suitable uni campus, you may try to consult with local law students. This question is something a mere technician can't reliably answer.
2) Is there some sort of service I can use to have everything I do on the network encrypted, such as a tunneling service to the internet?
Yes. Depends on what you want to do; if you want to be independent on any special software installed on the computers you're operating from, I suggest a HTTPS server, with a self-signed certificate (cheaper), and manually check its fingerprint when connecting. For upload you may use a web file upload form. Don't neglect the certificate check; the admin may like to start playing games with you and launch MITM attack at your connections. Do the fingerprint check even when the browser claims all is OK.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This message was sent from The Tedious Path Are you ready to travel The Tedious Path? http://www.tediouspath.com http://forum.tediouspath.com
participants (3)
-
Chris Kuethe -
cypher＠tediouspath.com -
Thomas Shaddack