Slashdot Log In
ISPs Using "Deep Packet Inspection" On 100,000 Users
Posted by
CmdrTaco
on Sat Apr 05, 2008 08:31 AM
from the something-to-think-about dept.
from the something-to-think-about dept.
dstates writes "The Washington Post is reporting that some Internet Service Providers (ISP) have been using deep-packet inspection to spy on the communications of more than 100,000 US customers. Deep packet inspection allows the ISP to read the content of communications including every Web page visited, every e-mail sent and every search entered, in short every click and keystroke that comes down the line. The companies involved assert that customers' privacy is protected because no personally identifying details are released, but they make money from advertisers who use the information to target their online pitches. Deep packet inspection is a significant expansion over tools like cookies in the ability to track a user. Critics liken it to a phone company listening in on conversations."
Related Stories
[+]
UK ISP Admitted to Spying on Customers 163 comments
esocid writes "BT, an ISP located in the UK, tested secret spyware on tens of thousands of its broadband customers without their knowledge, it admitted yesterday. The scandal came to light only after some customers stumbled across tell-tale signs of spying. At first, they were wrongly told a software virus was to blame. BT said it randomly chose 36,000 broadband users for a 'small-scale technical trial' in 2006 and 2007. The monitoring system, developed by U.S. software company Phorm, formerly known as 121Media, known for being deeply involved in spyware, accesses information from a computer. It then scans every website a customer visits, silently checking for keywords and building up a unique picture of their interests. Executives insisted they had not broken the law and said no 'personally identifiable information' had been shared or divulged."
[+]
Hardware: 80 Gbps Deep Packet Inspection Hardware Announced 185 comments
An anonymous reader writes to tell us that Procera Networks is launching a new weapon on the deep packet inspection (DPI) front. At $800,000 these 80 Gbps tanks aren't going to be sitting in everyone's closet, but it could mean that more traffic shaping is on the way. "The PL10000 can handle up to 5 million subscribers and can track 48 million real-time data flows. That's certainly a potent piece of hardware, but larger ISPs will need more. That's why Procera designed the new machines with full support for synchronizing traffic flows where return traffic might be routed to a different PacketLogic machine. The machine receiving the return traffic can make the machine monitoring the outbound traffic aware that it sees the other half of a TCP/IP conversation, for example, giving the devices more accuracy than those which might only have access to one side."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
So what's the status on IPSec? (Score:5, Insightful)
Re:So what's the status on IPSec? (Score:5, Insightful)
But with the revelation the other day that the Bush administration believes the Fourth Amendment (right to privacy and protection from searches without cause), this becomes just another good reason to get cracking with all traffic encrypted.
http://yro.slashdot.org/article.pl?sid=08/04/03/1219200 [slashdot.org]
Parent
Re: (Score:3, Insightful)
Also, another point about this is people have always said that users should understand that their activities on the Internet could be monitored by third parties. This, however, is different (at least to me) in that it is systematic snooping on the part of ISPs.
The situation has somewhat changed in another way, too. It used t
Why not spider the web? (Score:3, Interesting)
People already do (Score:5, Informative)
Parent
Re: (Score:3, Interesting)
The second amendment gives us all the right to the strongest encryption we can get our hands on.
Re:Why not spider the web? (Score:4, Interesting)
They knew exactly what they were writing. The frontier was subject to constant "terrorist" attacks from indians and french at the time. The British had specifically forbidden the smaller villages from maintaining arms caches to defend against attacks in the middle of the night. Instead they demanded British troops be stationed in people's homes ruled only by the crown and not by Colony or local rules. It was the right of you and your neighbors to defend yourselves without "asking permission" from any government and without reprisal for doing so. Note that Britain as basiclly out lawed self defense even in your own home today. Even if your daughter is being raped, in your home, you can be brought to charges for having any kind of weapon used to defend her if the attackers die.
Parent
Re:So what's the status on IPSec? (Score:4, Informative)
There was a time when encryption-by-default could have become the norm for Internet communications. It was largely passed by because the Clinton administration treated encryption technology as if it were chemical weapons. Even though the math to do it was a genie out of the bottle, they forbade American companies from trafficking in encryption technology if it involved overseas clients. So either it wasn't pursued, or the companies went overseas (e.g. F-Secure) but the end result is that encryption did not become a fundamental part of Internet communications.
Even weirder, one of the few to take a stand against this was John Ashcroft. Though, to his credit, he stood up to illegal wiretapping in the Dubya years as well. I don't agree with him on very much at all, but I have to give him credit for being a rare principled individual on this score.
So, to sum up, had the Clinton admin not squashed crypto so badly, we might not have to worry about mass spying on the public. They'd still be able to get around the encryption when it really mattered; they do black bag jobs and put keyloggers in mafioso computers when they need to do that, and I think that's a good balance of civil liberties and legitimate law enforcement, assuming warrants are involved.
Sadly, America has apparently decided that the First Amendment is tolerable, the Second is awesome, and fuck the rest of them. What an insult to our nation.
My favorite amendment? The Ninth: any rights not explicitly delineated in the Bill of Rights probably exist. Of course, the current Supreme Court (and conservatives in general) shit on that amendment, for some weird reason.
Parent
Encrypt everything. (Score:5, Insightful)
Re:Encrypt everything. (Score:5, Insightful)
I agree completely, but keep in mind that even with encryption, ISPs can still collect quite enough information on us to put together a truly impressive profile. Sure, they won't know exactly what you read, but if you visit Erowid, I'd call it a good bet you don't want recommendations on a cheese to go with dinner.
For targetted advertising purposes, the simple "where" counts for 90% of the "what".
Parent
Re: (Score:3, Funny)
Re:Encrypt everything. (Score:4, Informative)
Parent
Re:Encrypt everything. (Score:5, Informative)
As far as I know, IIS and Apache don't quite support TLS yet (although it's in-progress) which means every SSL-enabled website would have to be on it's own unique IP/port...making the IP 'crunch' even more of an issue.
Parent
Not necessarily (Score:3, Informative)
With ISPs starting to snoop, suddenly this has real value.
Combine this with 3rd-party SSL-enabled DNS, and you've got some reasonable countermeasures.
Your ISP will know you talked to dns.ssldnsprovider.com over an encrypted channel and then immediately carried on a series of conversations with 1.2.3.4 over port 443, but he won't know which of the thousands o
Re: (Score:3)
Re:Encrypt everything. (Score:5, Interesting)
How does the webserver know what to give you when foo.com and bar.com map to the same IP address, and the browser requests something like index.html that exists on both? This works only because when the browser makes the request it also tells the webserver which domain it was trying to access. The browser sends something like this: Now, this breaks for SSL, because SSL happens before the connection is established, so there's no way to decide which certificate to use based on the domain.
To fix to this is adding the support directly to SSL. rfc4336 contains a mechanism to do this with TLS.
Parent
Re:Encrypt everything. (Score:5, Informative)
Parent
Filesharing Responsibility? (Score:3, Insightful)
Re: (Score:3, Interesting)
time for some hactivism (Score:5, Insightful)
Re:Btw. is your ISP Knology? (Score:5, Interesting)
7. Go directly to Federal-pound-me-in-the-ass-prison for postal fraud. Do not pass go, do not collect $200.
Seriously, if the USPS, UPS or Fedex started doing this can you imagine the outrage? Yet somehow it's ok to do it with electronic communications? WTF?
Parent
Re:Btw. is your ISP Knology? (Score:5, Insightful)
Fedex and UPS open your packages to look at what you are shipping so they can sell that data to advertisers?
Did you even bother to RTFA? Wait, dumb question around here. This has nothing to do with looking for 'suspicious activity'. The ISPs in question are allowing third-party companies to build profiles of their users by spying on their traffic in order to do targeted advertising.
Parent
Good luck with that (Score:5, Insightful)
Never mind that it's a true violation of privacy.
Never mind that I block cookies pretty well and I run with NoScript most of the time and I don't see very many ads, and besides, half of the time I'm inside my employer's VPN.
But even more than that, I have seven other users in my household, half of them teenagers. If they want to sniff all of my NAT-ed packets coming out, they're going to discover that I'm a geek who has four Facebook sites, likes art and hates it, plays Runescape incessantly (the 10-year-old), likes the Wiggles, and works as a beauty consultant. So go ahead and hand me the ad for the latest XBox game (I hate games). Offer my kids server hardware, and see if you can get my wife to click on fun games to play with the Backyardigans. Oh, wait, you already do. It's called "not targeting advertising", and it's free.
So what we have is a thoroughly broken high-cost borderline-illegal absolutely-unethical service offered to advertisers in a difficult economic period. By people who we all hate a lot, and who will rapidly become targets for everything from blocking to legislative action to you name it.
I knew there would be some kind of career move for spam kings in the future. I just thought it would pay better.
I predict a less than stellar outcome for these idiots, and they deserve every painful moment.
Re:Good luck with that (Score:5, Interesting)
Any data at all on user trends more than their competitors will help advertising companies make money.
Parent
Re:Good luck with that (Score:5, Informative)
They don't have a common-carrier status to lose.
Parent
Re:Good luck with that (Score:5, Insightful)
>going to discover that I'm a geek who has four Facebook sites, likes
> art and hates it, plays....
Silly person, they are much smarter than that. Each of those PCs can be identified, see previous slashdot articles on the subject. Especially since each PC in a network serving a diverse family as you are describing will probably have obvious differences in OS and browser versions. Then there is detailed packet header inspection (DEEP INSPECTION, remember?) to seperate out OS subtle version differences, etc. And each PC/account will offerup different cookies to the same websites like Google.
NAT won't stop them. SSL won't stop them. Laws might. This sort of snooping isn't 'like' listening in on phone conversations. It IS listening in on conversations.
Parent
ssh tunnelling + squid (Score:5, Interesting)
ssh -f -N -L 1234:localhost:1234 -p 5678 my.squid.server.com
Configure firefox to use a proxy to localhost:1234 and all traffic is encrypted to the squid server.
Of course, I could just use Tor, which is great, but can be slow. In fact, you could run a tor server on your colo machine and have all tor traffic bounce off of the server, which would be pretty fast if you leave tor running as a daemon and dedicate a decent amount of bandwidth to the tor network.
Re: (Score:3, Insightful)
> the hardware) from a company with a decent AUP. I put linux on
> the server and run squid.....
And you are a fool with more money and tech knowledge than you have the brains to use wisely.
Exactly what are you hoping to accomplish by going to all of that bother? Your last mile ISP can't monitor you but the hosting company and THEIR ISP can so you have just shifted the point of attack.
And the government (which is what you are afraid
Re: (Score:3, Informative)
My example is a case where if the AUP of the colo company explicitly states that they do not monitor traffic, and your ISP for the last mile does, you can avoid your ISP's deep packet sniffing.
There should be a law (Score:5, Interesting)
And if I hear one libertarian say we need less laws, I'll puke. It's as if they though they had a magic wand and all the troubles of the world would disappear by removing government. Unfortunately, the world hasn't worked that way since we left the caves 12,000 years ago.
Re:There should be a law (Score:5, Insightful)
The law to protect your right to privacy already exists, it just needs to be enforced. Creating more laws doesn't help with lack of enforcement of what is already there.
Parent
Re: (Score:3, Insightful)
How are they to deliver targeted advertising? (Score:5, Insightful)
If these are the ISPs (as opposed to the visited web sites) doing the spying, then how are the advertising companies involved supposed to deliver the content? Are they going to use the same "deep packet" method to inject the advertising? If the advertising delivery is away from that deep packet inspection, then how do they identify which user was interested in penis enlargement products vs. which user was interested in replica watches? Or are the ISPs going to lock-in the IP address, now?
Regular postal mail... (Score:4, Insightful)
Search for info on heartburn... get some post cards advertising the latest antacid. Search for info about Lasik eye surgery... gee handy flyers about your local providers appear.
You get the idea. If I were selling a service and an ISP offered to sell me names and addresses based on keyword searches, why wouldn't I buy that list?
Parent
Re: (Score:3, Informative)
> the spying, then how are the advertising companies involved supposed
> to deliver the content?
Because the visited web sites already aren't the ones delivering the advertising. You go to CNN.com and view a page. The ads come from an outside site. That site partners with your ISP. They toss a packet with the IP and perhaps other info (like browser info so the ISP can determine which PC behind the home NAT is making the request a
Listening in? Um, yeah. (Score:5, Insightful)
Up to 2 years imprisonment (Score:5, Interesting)
Re:Up to 2 years imprisonment (Score:5, Informative)
I've already sent a letter to my service provider (virgin media) informing them I want no part of Phorm and if they implement it (which they are considering) I will be prosecuting them under the Data Protection Act. I suggest all BT, Talk Talk and Virgin Media users do the same.
The Data Protection Act in the UK is the best defense against this sort of thing, it defines how companies my handle personal data, the right a person has to that data and what responsibilities the organisations have with it. The biggest problem with it tends to be phone operators who've never read it trying to tell you the section you read to them is wrong.
I believe someone is trying to prosecute Facebook because they were unable to remove their information from Facebook (when you leave a service you have a right to have all information on a companies database to be deleted) If I were to go into a police station and demand all the CCTV footage they have on me they would have to supply it (my right to see) finally if I don't agree that companies can share my information with 3rd parties then they aren't allowed to share it full stop if they do you can prosecute.
121Media argue phorm doesn't violate the Data Protection Act because you are visiting public websites (it being akin to walking along a public highway and so no right to privacy) Hopefully the Information Commisson won't see it that way and will enforce the view that sending unencrypted http packets through port 80 is the same as making a phone call and so falls under the same protections.
Parent
"Customer revolt" (Score:5, Insightful)
Ever get the feeling the the Internet just isn't worth it anymore?
Enough! (Score:4, Informative)
Encrypt everything! (Score:4, Interesting)
This was their goal, but hostility and forking ensued when most people really wanted to just have an IPsec implementation on Linux. OE is still a good idea, though, and that's what they're focusing on now.
The obvious design win would be if Linksys and Netgear built OE into their consumer grade firewall/routers. Then everyone would have it, not even know it, and when large site operators started deploying it on their network edges, massive amounts of crypto would start traversing the Internet, and no one would be bothered by it.
That's really the key to good system design: add complexity, but don't bother the end user -- it's not his problem.
NebuAd info, and a request for info (Score:4, Interesting)
I just checked NebuAd's Privacy policy [nebuad.com]:
NebuAd products do collect and use the following kinds of anonymous information:
Now that's way out of line for an ISP to collect, let alone send to an ad agency.
We may be able to do something about this.
We run SiteTruth AdRater [sitetruth.com], which rates advertisers. We have a Firefox extension which displays a rating icon for each ad served. When an ad link goes by, and it's not in the browser cache, the extension contacts our server for a rating of the advertiser. So we collect, over time, a list of advertisers for various ad systems. We're not collecting data about users; we're interested in advertiser behavior. (You can read the source code for the plug-in, so there's no mystery about what we're doing.)
We're not currently tracking NebuAd, Front Porch, or Phorm ads; we've been focusing on the bigger players. It looks like we need to be tracking this behavior. If anyone can find ad links from those services, please post the ad link here, or mail it to "info@sitetruth.com". We need some examples so we can modify the plug-in to recognize them.
If we can collect sufficient information about this class of advertisers, we may publish their customer list, which would be useful for boycott purposes. Thanks.
Deep Packet Inspection Not For Ads (Score:5, Interesting)
It was, and is, always about the network profile. If they find out that 10% of the traffic on the network is VoIP traffic, they want to design the network shift this traffic to have lower latency.** If they find out that 50% of the traffic is BitTorrent, they may put rules in place around such services. In my opinion, the service providers that I have dealt with do not have the technology in place to target down to the user. Also, they do not appear to be developing this technology.
**Some can argue that providers are instinctively evil and want to destroy this traffic, but I'm not going to fight this here.
Who wins? (Score:3, Insightful)
Only have more questions (Score:3, Interesting)
It'd be nice at least to know who's actually participating in this so we could know who to avoid.
What's the difference (Score:5, Insightful)
In this case, the data is explicitly mined, by a company interested in building a profile of each user. It doesn't say it is limited to web traffic only, only that "Nor does NebuAd record a user's visits to pornography or gaming sites or a user's interests in sensitive subjects -- such as bankruptcy or a medical condition such as AIDS.", which I doubt both on technical grounds and because it is a market and someone will want to take advantage and "The company said it processes but does not look into packets of information that include e-mail or pictures." which I think is in contradiction with other parts of the article and even if they didn't, it's a matter of time before they do.
Basically, it's the intent that counts. The ISP can intercept everything they want because they're in the middle. When they start doing so for reasons that are not part of maintaining the communications as specified (like forwarding, maybe firewalling and proxying depending on the conditions), alarms should go off.
Parent
Re: (Score:3, Informative)
Available for Pidgin (aka GAIM), Adium X, mICQ, Kopete, Miranda, Trillian and as a proxy for people that use other clients. Works on any IM network.
(I've been using it on GAIM for some time and I recommend it)
Re:So? Use https, ... (Score:4, Insightful)
Parent
Re: (Score:3, Interesting)
Doesn't that violate the copyright on the page held by
Re:Slashbot hypocrisy once again (Score:5, Insightful)
No one authorized ISPs to inspect packets for any purpose.
However if they provided their service at the same price google offers gmail in exchange for authorization to inspect packets, I'm sure there would be lots of people willing to take the deal. And I think whoever modded you insightful was on crack.
Parent