[IP] EFF: Secret Surveillance Evidence Unsealed in AT&T Spying Cas
Tyler Durden
camera_lumina at hotmail.com
Thu Jun 14 10:09:43 PDT 2007
Shee-IT. Layer 4 packet inspection at OC-192 is kinda surprising, but Layer
7 at OC-48 is for me the more difficult thing to swallow.
This has interesting implications in terms of where they place one of these
boxes.
Another thing worth thinking about is the control channels they must use to
update the policies to one of these boxes. It's obviously in-band. One
wonders if one could tap one of the fibers and find the packet stream they
use to program one of these things.
-TD
>From: Eugen Leitl <eugen at leitl.org>
>To: Tyler Durden <camera_lumina at hotmail.com>, cypherpunks at jfet.org
>Subject: Re: [IP] EFF: Secret Surveillance Evidence Unsealed in AT&T
>Spying Cas
>Date: Thu, 14 Jun 2007 12:33:56 +0200
>
>On Thu, Jun 14, 2007 at 06:03:18AM -0400, Tyler Durden wrote:
>
> > So what can that Narus box do? Layer 3/4 seems obvious. Layer 7? Can it
> > detect the presence of encryption? Can it detect the type and strength
>of
> > encryption? Can it detect the existence of jpegs, mpegs, mp3s and so on?
> > Does it support routing protocols? So, could it handle an instruction
>like:
> >
> > If the source of the packet is located in Brooklyn
> >
> > If the destination is a cave in Aghanistan
> > If encryption = YES,
> > Then route to NSA...
> >
> > If destination is Kebab King in Jackson Heights
> > If encryption=NO,
> > then route to Local Storage
> >
> > etc...
>
>http://en.wikipedia.org/wiki/Narus
>
>...
>
>NarusInsight
>
>The capabilities of the NarusInsight system are alarming to many privacy
>advocates.
>
>[edit] System specification
>
> >From the Key Features list of NarusInsight:
>
> * Universal data collection from links, routers, soft switches,
>IDS/IPS, databases, etc. provides total network view across the world's
>largest IP networks.
> * Normalization, Correlation, Aggregation and Analysis provide a
>comprehensive and detailed model of user, element, protocol, application
>and network behaviors, in real-time.
> * Seven 9s reliability from data collection to data processing and
>analysis.
> * Industry-leading packet processing performance that supports network
>speeds of up to OC-192 at layer 4 and OC-48 at layer 7, enabling carriers
>to monitor traffic at either the edge of the network or at the core.
> * Scalability to support the world's largest, most complex IP
>networks.
> * Flexibility -- NarusInsight's functionality can easily be configured
>to meet any specific customer requirement (Narus SDK).
> * Extensibility -- NarusInsight's functionality can easily be
>configured to feed a particular activity or IP service such as security,
>lawful intercept or even Skype detection and blocking.
>
>OC-192 carries about 10 gigabit per second. Ten billion bits per second,
>monitored in real-time. Technically, this is an extremely powerful
>supercomputer.
>
>[edit] System capabilities
>
> * Packet-mode data intercepts for Service Providers and Carriers.
> * Wireline to wireless and Wi-Fi or dialup to broadband.
> * "Instant Compliance" with CALEA and ETSI for simple, fast and
>hands-free compliance.
> * Carrier-grade speeds, performance and scalability.
> * Supports all of your services, out-of-the-box.
> * Securely manages resources while simplifying audits and reporting.
> * Network and vendor agnostic.
> * Enables additional application for revenue generation or revenue
>protection.
>
>This data flows right into NarusInsight Intercept Suite, which enables
>packet-level, flow-level, and application-level usage information is
>captured and analyzed as well as raw user session packets for forensic
>analysis, surveillance or in satisfying regulatory compliance for lawful
>intercept.
>
>The Lawful Intercept module offers carriers and service providers
>compliance with regulatory requirements regarding lawful intercept. The
>Lawful Intercept module provides an end-to-end solution consisting of
>Administration, Access and Delivery functions. The Lawful Intercept module
>is compliant with CALEA and ETSI standards. It can be seamlessly integrated
>with third party products for testing/validation or as a complete law
>enforcement solution.
>
>The Directed Analysis module seamlessly integrates with NarusInsight Secure
>Suite or other DDoS, intrusion or anomaly detection systems, securely
>providing analysts with real-time, surgical targeting of suspect
>information (from flow to application to full packets). The Directed
>Analysis module provides industry standard formats and offers tools for
>archival and integration with third party investigative tools.
>
>These capabilities include playback of streaming media (i.e. VoIP),
>rendering of web pages, examination of e-mail and the ability to analyze
>the payload/attachments of e-mail or file transfer protocols. Narus partner
>products offer the ability to quickly analyze information collected by the
>Directed Analysis or Lawful Intercept modules. When Narus partners'
>powerful analytic tools are combined with the surgical targeting and
>real-time collection capabilities of Directed Analysis and Lawful Intercept
>modules, analysts or law enforcement agents are provided capabilities that
>have been unavailable thus far.
>
>[edit] Usage
>
>It is useful to examine the OSI model of seven layers which underpins all
>communication on the Internet. NarusInsight focuses on two layers: number
>four, the transport layer, built on standards like TCP and UDP, the
>physical building blocks of Internet data traffic, and number seven, the
>application layer, built on standards like HTTP and FTP, which are
>dependent on the application using them, i.e. Internet Explorer, Kazaa,
>Skype, etc. NarusInsight monitors 10 billion bits per second at level four
>and 2500 million bits per second at level seven. For reference, a 256K DSL
>line equals 0.25 million bits per second (Mbit/s), and a normal modem
>around 0.05 Mbit/s. So a single NarusInsight machine can monitor traffic
>equal to the maximum capacity of around 39,000 DSL lines or 195,000 modems.
>In practical terms 10 Gbit/s equals the combined traffic of millions of
>broadband users, so the number of subscribers monitored by one installation
>is several millions. It can also perform sem!
> antic analysis of the same traffic as it is happening, in other words
>analyze the content, meaning, structure and significance of this entire
>traffic, as it is happening.
>
>The exact use of this data is not fully documented. A starting point is the
>Internet Protocol Detail Record, used to record information about usage
>activity within the telecom infrastructure (such as a call completion).
>NDM-U stands for "Network Data Management - Usage". It refers to a
>functional operation within the Telecom Management Forum's Telecom
>Operations Map. The NDM function collects data from devices and services in
>a service providers network. Usage refers to the type of data which is the
>focus of this document. These standards were built into Narus' systems.
>
> "IPDR.org has been in existence since 1999 and more than a dozen
>vendors have actual IPDR implementations "etched in code". Their systems
>are actually able to talk to each other and interoperate. Version 2.5 and
>up of the NDM-U represents a stable basis for development. IPDR.org's
>Interoperability Pavilion is a working demonstration of multiple companies
>exchanging service usage data in that format."
>
>Service usage data. That would be data on the actual usage of the Internet.
>And what kind of data would this be? Way back in 1999, this article stated:
>
> "In an effort to provide more complex network traffic analysis, Narus
>is introducing its semantic network traffic service. The company cites
>research which predicts the fast-growing ISP sector will become stagnant
>without the ability to offer differentiated services. In order to gain
>significant revenues from these services, a technology was necessary to
>allow usage based pricing.
> "We realized that, at the heart of the data that is needed to
>accurately measure usage and enable 'pay-as-you-go' business models for
>Internet service providers, is what we call the 'semantics' of network
>traffic," said Ori Cohen, Narus' founder and chief executive officer.
> "In short, by seeing the 'semantics' of network traffic, service
>providers can see 'inside' the data, providing much more detailed insight
>about the use of the Internet and the perceived value of specific
>applications than existing technologies allow."
> "Semantic Traffic Analysis uses network technology to consistently
>capture and analyze all IP data streams on heavily trafficked networks
>remotely and non-invasively. In addition, the semantics of the data stream
>are determined also, as well as the protocol used and the application
>taking place. A variety of other data is available as well."
>
>In this context, semantics is not just the data, but rather the meaning of
>the data. It looks at the data in a more comprehensive way than looking for
>keywords. Each NarusInsight machine does this at 2500 million bits per
>second, in real-time.
>
>One website calls this "the biggest invasion of privacy in history by
>several orders of magnitude."
>
> >From Narus' Lawful Intercept and Regulatory Compliance page:
>
> "Explosive Internet growth in recent years has transformed worldwide
>communications, yielding tremendous efficiencies and benefits, as well as
>many risks."
> "For example, terrorist attacks around the globe have been carefully
>orchestrated through Internet-based forms of communications such as e-mail,
>messaging, hidden Web pages and now VoIP, forcing governmental
>organizations and law enforcement agencies to re-evaluate how they are
>providing public security as it becomes so much easier and faster to
>communicate electronically."
> "Recent mandates and the resulting standards referenced under CALEA in
>the United States and ETSI in Western Europe aim to preserve the right of
>law enforcement agencies to conduct authorized electronic surveillance in
>an effort to protect the public and its right to privacy. However, these
>mandates create IT headaches for carriers as they struggle to meet the
>requirements."
> "With a suite of products targeted at meeting lawful intercept
>requirements, Narus simplifies lawful intercept tasks helping carriers and
>agencies meet requirements without experiencing any degradation in service
>quality."
>
>
>
>
>--
>Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org
>______________________________________________________________
>ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org
>8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE
_________________________________________________________________
Make every IM count. Download Messenger and join the im Initiative now.
Its free. http://im.live.com/messenger/im/home/?source=TAGHM_June07
More information about the cypherpunks-legacy
mailing list