FBI and Next-Gen P2P Monitoring

AHuxley writes "Can the FBI get funding to create a next-generation network monitoring and database system for P2P networks, web sites, and chat rooms? Could the FBI's Regional Information Sharing Systems (RISS) network be opened to more law enforcement agents across the USA? Will the tracking of p2p users via 'unique serial numbers' generated from a person's computer be expanded from its first use in late 2005? Is your p2p application or plug-in sending back your MAC address, firmware revision, manufacture date, GUID or other details?" Could this story submitter pose any more questions in his submission? Won't someone please think of the ... oh, never mind.

They're not slow...

[seramar (655396)]

It's not the people who are slow. Their comments are just tied up in the RISS awaiting gov approval.

Dupe?

[mrvan (973822)]

Senator Proposes to Monitor All P2P Traffic for Illegal Files [slashdot.org], it talks about the same plan by the same senator, and I don't see any new developments.

Seriously though, how difficult is it to use the slashdot search engine with the capitalized words in the title? third hit... [slashdot.org]

And whoever is doing the monitoring

[hansraj (458504)]

will wonder why all the files have Joe Biden in the filename.

Re:

[johndmann (946896)]

No one will be doing the monitoring, it will all be filtered using keywords, byte patterns, and so on - much like Echelon [wikipedia.org].

Funny that Biden is involved

[IvyKing (732111)]

Especially with his penchant for plagiarism.

Who cares?

[RiotingPacifist (1228016)]

Is your p2p application or plug in sending back your MAC address, firmware revision, manufacture date, GUID or other details?

apt-get install macchanger
sudo macchanger -r

I'm no computer scientist but isn't it fairly trivial for them to get your mac (or at least that of your router) from your network traffic anyway?

Re:

[mrvan (973822)]

I'm no computer scientist but isn't it fairly trivial for them to get your mac (or at least that of your router) from your network traffic anyway?

If I'm not mistaken, MAC never leaves the immediate network, ie your router gets your mac, the next hop that of the router, and so on, but the final destination only gets the mac of the last router in between

Re:

[by Anonymous Coward]

I'm no computer scientist but isn't it fairly trivial for them to get your mac (or at least that of your router) from your network traffic anyway?

If I'm not mistaken, MAC never leaves the immediate network, ie your router gets your mac, the next hop that of the router, and so on, but the final destination only gets the mac of the last router in between

You would be correct. A MAC (Media Access Control) address is a local identifier only. In fact it only really applies to switching, not routing. Unless a piece of software on your computer is sending it "home" then it would be rather difficult to obtain your MAC address. Also, it is by no means a unique identifier. It's a well known fact that manufacturers of network devices regularly cycle MAC addresses. It's uncommon, but not unheard of to end up with two devices on a network with the same MAC.

Re:

[CastrTroy (595695)]

It's also quite easy with most network cards to get them to use another MAC than what was originally on the card. You can basically assign whichever number you want as your MAC address.

Manufactured Evidence

[conureman (748753)]

In the olden days, when I was a kid, we happened into dealing with the F.B.I. Subsequently, I know to engage a large supply of salt anytime I read about any investigation that has been tainted by their crime lab. Think of the children and send more money. Yeah. Knowing their proclivity to abuse/disregard the law, I don't really see the upside to this.

All Fear, No Facts

[houstonbofh (602064)]

Heavy on fear, but light on facts... And with so many popular torrent programs open source, all of the sneakiness is no longer possible. No magic serial, or mac address in my torrent program. Oh, and it is encrypted.

Re:

[by Anonymous Coward]

The encryption on torrent transfers doesn't do shit as far as protection goes. Anyone connected to the same torrent will be connected to you and know what you're doing.

All the encryption really does is keep ISP's from throttling you unless they throttle all encrypted traffic (which some do).

Re:

[dgatwood (11270)]

All it takes is indirection to make it so that it does, though. Make the P2P client randomly choose whether to look locally or ask its neighbors. Make it lie randomly and say "I don't have it" at all times to mask the ability to use probability to determine whether you are serving locally-stored data or just passing on the request even with knowledge of how many peers your node has and generating hundreds of requests using a modified client. If nobody is doing that already, color me surprised....

Re:

[archeopterix (594938)]

If nobody is doing that already, color me surprised....

Paint yourself half-unsurprised then. MUTE [sourceforge.net] filesharing does something similar. A client communicates directly with a small number of peers and nobody can tell whether a request (or response) comes directly from their neighbor or is merely relayed, so you get plausible deniability. Uh, and it uses an interesting algorithm for routing, similar to one used by ants in real life.

Re:All Fear, No Facts

[Robocoastie (777066)]

It's just the typical Democratic party cry wolf "we gotta do something!!!!" syndrome again. In this case it's also putting Sen. Biden back in the spotlight after his poor performance in the Iowa caucus. Political moves aside though let's think about what they are really asking. What is child porn? The government even lacks a definition of "porn" much less child. I have a serious problem believing that "child porn" is an epidemic requireing the black helecoptors so to speak. What likely is popular though is teen-fascination which psychiatry has an entirely different definition for. Our society in fact is geared toward that even between cheerleaders and dancers being just short of being nude, Disney channel turning tweens into glamored up pop stars, and shows like Dawson's Creek, Gossip Girls and the like having more adult themes than Desperate Housewives. This is nothing new though; in fact society used to marry their women off between 14 and 17 anyway. My point is I really wonder if real child porn actually is as bad as the fear mongers claim or if people's collective conscious is simply equating teen-fascination with it when they hear of those cases (which has increasingly been from female teacher - male student lately). The result of which is the "we gotta do something!!!" panic which then grants the government sweeping powers to do all kinds of spying with a fictional and ultimately false pretense.

Re:

[PPH (736903)]

It's just the typical Democratic party cry wolf "we gotta do something!!!!" syndrome again.

I thought the Democrats were all out producing the child porn and the GOP trying to stop it. Or prevent a child from being irreversibly harmed by seeing Janet Jackson's tit.

The Democrats want to track your financial transactions. Whatever the current administration puts in place now will be directed next year against that extra lunch you put on your expense account.

Re:All Fear, No Facts

[hairyfeet (841228)]

Let's face it, we all need to publicize this as what it is: a witch hunt and a power grab. Folks see the words "child porn" and automatically think of the sick bastard that rapes an 8 year old. What they don't realize and what we need to be telling our friends, relatives, and coworkers at every opportunity is they are using these laws in truly insane ways. Like who in their right mind would have thought they would charge a 15 year old and 16 year old for taking pics of THEIR OWN BODIES and sending it to each other? That is truly f*cking insane.

And IMHO we need to go back to the way it was when I was a kid when we had two distinct groups-Jailbait and sick bastards. Jailbait was anyone consenting between the ages of 14-17 and sick bastards was an adult having sex with anyone under 14. But sticking an 18 year old as a child molester for having sex with a 16 year old is just too insane for words.

And of course the more important thing for the FBI is the power to "monitor" everything going across the net. How long do you think it will be after this that the feds are kicking down doors for those "illegal terrorist pirates"? The way they are trying to link copyright infringement with terrorism makes me think it will be a year or two at the most. This is a damn scary time to be an American, and sad to say I don't see anything coming that will change the path we are on. The corruption is just too deep for something like voting or reforms to fix. But that is my 02c,YMMV.

P.S. As someone who was hit on VERY hard by a cop pretending to be a 14 year old in a WINDOWS REPAIR chat room I used to run, I can tell you they WILL use entrapment and will do WHATEVER it takes to make an arrest, legal or not. I finally had to say "leave me the hell alone I don't mess with jailbait. Stop or I will ban your I.P." Before "she" came clean and told me who he was and what he was doing there. So of course I banned the I.P. range for his police department. ;-)

Re:

[I(rispee_I(reme (310391)]

"It only takes one to raise a stink about it.", goes the popular reasoning.

Free Software is teh Al Qaeda!!!

[Travoltus (110240)]

"And it hampers Corporate America's Gawd Given right to a profit!"

Hear that clapping sound in Congress? That clapping sound is the sound of freedom dying... with thunderous applause?

I beg your pardon...

[r_jensen11 (598210)]

Can the FBI get funding to create a next-generation network monitoring and database system for P2P networks, web sites, and chat rooms?

I beg your pardon, but chat rooms? People still use those? I thought those phased out about 10 years ago....

Re:I beg your pardon...

[jollyreaper (513215)]

I beg your pardon, but chat rooms? People still use those? I thought those phased out about 10 years ago....

At this point I bet it's nothing but feds posing as kids trying to catch other feds posing as peds. Not a single person in the room isn't drawing a federal paycheck.

Re:

[UnrealisticWhample (972663)]

I beg your pardon, but chat rooms? People still use those? I thought those phased out about 10 years ago....

At this point I bet it's nothing but feds posing as kids trying to catch other feds posing as peds. Not a single person in the room isn't drawing a federal paycheck.

In the interest of accuracy I submit that there are also bots pitching webcam sex shows.So: Feds posing as kids, Feds posing as peds and Bots posing as hotties pitching sex shows. Sound about right?

Re:

[Kjella (173770)]

At this point I bet it's nothing but feds posing as kids trying to catch other feds posing as peds. Not a single person in the room isn't drawing a federal paycheck.

Chat rooms are from what I've understood fairly active. When I grew up (god, I sound like an old fart already) the chatrooms were full of us nerdy boys. These days pretty much everyone is on some IM, though I gather it's mostly by contact lists I'm sure the chat rooms are doing fine. In fact, due to the change in demographics I'd guess the ratio of feds as opposed to real girls has gone down. Plus back then webcams and digicams didn't exist, were horribly bad or hidiously expensive plus you didn't have the

Re:

[MulluskO (305219)]

It's been covered on Slashdot, http://yro.slashdot.org/article.pl?sid=07/10/16/1918204&from=rss [slashdot.org] : people still use NNTP to pirate material, IRC too.

It wouldn't surprise me if someone out there is using Gopher to pirate material.

Let's hope so

[77Punker (673758)]

Maybe if they do start monitoring all that traffic, people will get a clue and start using Tor for all their internet traffic. Especially their plaintext passwords. Dangerous business, letting the FBI know where those plaintext passwords are going. Better encrypt them with Tor!

Anyone wonder how many exit nodes the NSA already runs? That'd be a far better(easier?) approach than monitoring "normal" traffic since I suppose the interesting stuff is already going through Tor, though in a typical hour-long scan I can't find any really "interesting" unencrypted web traffic at my exit node.

Folks surfing porn? Plenty. Plenty of Chinese blogs with plaintext passwords, too. But even those Chinese blogs are benign and not something that would be censored by their gov't (I think). Based on the pictures and my basic proficiency with Chinese, it's either folks just fooling around with Tor or it's steganographic.

Answers

[gEvil (beta) (945888)]

AHuxley:
Yes
Yes
Yes
Yes

CmdrTaco:
Yes

Hope that helps everyone.

This is why OSS is important!

[mich.linux.guy (1271564)]

Is your p2p application or plug in sending back your MAC address, firmware revision, manufacture date, GUID or other details?"

This is exactly why Open Source Software is so important. Even though the average user may not have the skill to examine the code for breaches of trust, there are many in the community that can and do. These breaches are fixed or made public and public opinion will decide whether or not the P2P application is trustworthy.
Closed source applications from companies like M$ can't be trusted in this way.

Re:

[pwizard2 (920421)]

Packet sniffing would also be a way to find out.

FBI Sofware Projects are Notorious for Failures

[CodeBuster (516420)]

The last time the FBI tried to build a large piece of custom software, a case-file management system [cnn.com], they ended up spending 170 MILLION dollars over 3+ years for software which basically did nothing useful (a complete failure). The only way that this will work is if the FBI contracts someone else to build it for them and even then the chances of failure are high unless they are willing to deal with criminals (i.e. Russian hackers who write the software for worms and spammers) to get it done which will happen about the same time that hell freezes over. The one good thing about governments when it comes to controlling the populace is that they are inefficient. If the government spent our tax money efficiently and effectively on surveillence and authoritarian enforcement actions then we would already be living in 1984 [wikipedia.org].

Re:

[daigu (111684)]

Reminds me of that t-shirt quote:

Heaven: where the police are British, the cooks French, the mechanics German, the lovers Italian, and it is all organized and run by the Swiss. Hell: where the police are German, the cooks British, the mechanics French, the lovers Swiss, and it is all organized and run by the Italians.

Reality: where the police are Italian, the cooks German, the mechanics Swiss, the lovers British and it is all organized and run by the French.

Re:

[houstonbofh (602064)]

Then again, a few public failures would be a very good way to hide some surveillance successes from the public. Always be wary of an incompetent police agency, or a friendly lawyer.

Re:

[iminplaya (723125)]

...unless they are willing to deal with criminals...

The authorities use criminals all the time to catch other criminals. Most snitches are criminals themselves looking for a way to stay out of prison. It shouldn't surprise you at all if they employ Russian/Chinese hackers. And I consider their surveillance and authoritarian enforcement actions to be pretty efficient. If you want to break them down, you need to get the authoritarians to go after each other. Use the same methods that work so well on us.

Re:

[CastrTroy (595695)]

You think that's bad? The Canadian gun registry [wikipedia.org] cost $2 BILLION. All for a database to track who owns a gun. You could probably put together a similar application in a matter of weeks.

Another 60 million per year.

[Animats (122034)]

Here's the actual bill. [loc.gov] $60 million per year. 15 cosponsors.

This is another piece of Bush Administration "security theater". Write to your representatives in Congress and your Senators to get them to put this money into fighting spam and computer crime.

Jurisdictional issues?

[yuna49 (905461)]

I didn't see anything in either article about the question of offshore trackers and peers.

Can the FBI legitimately scan, say, The Pirate Bay, to discover the IP addresses of supposed child-porn torrenters? Obviously if the person is downloading the material to a computer in the US is liable under Federal laws, but was the evidence obtained legally if it's based on scanning a foreign tracker?

Giving the FBI unfettered access to monitor the entire global Internet raises profound questions about the meaning of

Re:

[yuna49 (905461)]

Maybe; maybe not.

The FBI's jurisdiction ends at the water's edge. Scanning an offshore tracker might be considered as gathering "foreign intelligence." That's been the bailiwick of the CIA and NSA, and off-limits to the FBI for decades. It's true that the reorganization of functions after the establishment of the Department of Homeland Security has made these distinctions less clear.

What makes it more complex is the absence of any prior evidence of guilt before the scanning occurs. If the purpose is to d

Re:

[arminw (717974)]

...it's "perfectly" legal....

Anything is perfectly legal if you can get away with it. The FBI and other government agencies are more likely to get away with something than an individual.

Add one more question:

[nurb432 (527695)]

Is anyone else worried?

False Positives

[Deliveranc3 (629997)]

I don't think freedom advocates have even begun to fight on this front, the major battle begins when people start creating false positives (with reprecussions).

Flaws like the flash vulnerability mean that even without the complicity of GNU or Microsoft the majority of communications are open to inspection.

I'm curious to see what would happen if there was a decentralized push for better communication security.

Re:

[zappepcs (820751)]

Yes, and that whole show included numbers about how much the child porn industry is worth... WTF? If they already know how much it's worth, why do they need to monitor it even more?

I am seriously hoping that anonymous begins to get rather political toward November. It would just make me happy to see masked people picketing courthouses with signs that tell everyone how senator so-and-so can't count, or has close ties with felons, or whatever... just some signs showing the sins of those who would have our vot

Re:

[jamstar7 (694492)]

This is one hell of a slippery slope, my friends.

Considering we're speeding toward the bottom at Warp 9, there's not a lot further to go. I'm thinking, we all might as well line up at the prisons now and serve our time for whatever the government decides is a crime tomorrow and get it over with.

Re:Does F/OSS help?

[26199 (577806)]

I think any of those would be quite hard to inject into open source code.

After all, in a p2p app the traffic is the most important thing ... and is going to be watched very closely. Patches that modify what go over the wire will be under considerable scrutiny.

And how are you going to collect those details once they're transmitted? By their nature p2p apps are hard to keep track of.

Not to say it couldn't happen. But I don't think it's much of a risk compared to the simple fact that your IP address is very visible when using a p2p app...

Re:

[AHuxley (892839)]

You would need OS independence.
Unique file id's passing out in "real time".
Unique user id.
The user would have to feel safe and happy about the above.

I would suggest a something like a helpful new anti junk file database/plug in?

Re:Are MAC addresses globally unique?

[mrvan (973822)]

I think they are globally unique, and since they are 6 bytes long the supply is practically infinite (256^6 = 216x10^12, ie every person can have something like 30,000 mac addresses)

Come to think of it, it's a bit silly that they used 4 bytes for the address that has to be globally unique and 6 bytes for the one that only has to be locally unique...

Re:

[vertinox (846076)]

I think they are globally unique, and since they are 6 bytes long the supply is practically infinite (256^6 = 216x10^12, ie every person can have something like 30,000 mac addresses)

Considering how trivial it is to defeat MAC address security for wireless, it wouldn't be hard to spoof it at random or just use someone else's you got while war driving.

Re:

[SRA8 (859587)]

Try using that as a defence. It will go way over the typical jury's head.

Re:

[TheThiefMaster (992038)]

Which is of course why we're trying to change to using 16-byte globally-unique addresses.

Re:

[fizzup (788545)]

It makes sense that the MAC address space should be bigger than the IP address space, because you need one IP address at a time, but once a NIC is made the MAC address should be unique forever just in case it's resurrected out of a junk box and added to an ethernet 20 years on.

Re:

[nurb432 (527695)]

I have seen a duplicate from the same manufacturer, on totally different models ( even generation ) of boards. Really made for a head scratcher on the network. By then NICs were cheap so i just broke it and tossed the 2nd one in the trash. But it was still weird. ( i think it was SMC )

Besides, you can change the MAC on most current NICs, or just emulate a different one using a VM. ( this gets around serialized motherboards, or CPUs even )

Now, embedded serials in your TPM chip, that might be harder to get ar

Re:

[CastrTroy (595695)]

Except that the mounties specifically said that they weren't going to target file sharers, because they have much more important things to worry about.