GNU Carnivore With Perl Data Lookup 161
Kallahar writes: "Inspired by the FBI's DCS1000: Carnivore is a networked art project in two parts. The first part is Carnivore Server, an application which performs packet-sniffing on a specific local area network and serves the resulting data stream via the net. The second part consists of an unlimited number of client applications which tap into this data stream and interpret it in creative ways."
Chaos theory at work (Score:2, Interesting)
Re:Chaos theory at work (Score:1)
Hello, Sen. Helms, we've been monitoring traffic from your office this evening and, well, it creates a picture of a troll, over and over again...
Re:Chaos theory at work (Score:1)
Lets Hope (Score:2, Interesting)
lets hope no one is look at naughty pictues... might give an effect which is less than random, and a bit more 18+
is an open source Carnivore more acceptable? (Score:2, Interesting)
Would an open source Carnivore be more palatable to the ISP community? The privacy implications remain, of course, but if the U.S. government adopted an open source program would ISPs be more willing to implement it?
Re:is an open source Carnivore more acceptable? (Score:2)
Re:is an open source Carnivore more acceptable? (Score:2)
I wonder how many tech-saavy parents would use it to monitor their kid's activities.
Re:is an open source Carnivore more acceptable? (Score:1)
Maybe I'm watching too many laywer shows on TV, but it seems to me a defense attorney would have a field day attacking the credibility of the evidence produced.
Re:is an open source Carnivore more acceptable? (Score:1)
Re:is an open source Carnivore more acceptable? (Score:2)
Certainly an interesting point. But then we can ask the question, does source equal binary? I think it's reasonable to say that any changes to the source code can be detected by differences in the binary output. In this type of situation I think the value of having open code is the ability to audit the system.
Of I'm with the author of this thread's parent - why exactly is an OPEN-SOURCE carnivore more acceptable..??
Re:is an open source Carnivore more acceptable? (Score:2)
The FBI could take MD5 checksums of all the binaries on the system before giving it to the ISP, then it could simply check the checksums when it gets it back.
Of course, if the ISP couldn't be trusted with the binaries, I don't think the ISP could be trusted not to tinker with the datafiles that they generate ether.
glaring security problems (Score:3, Informative)
....
.....
In other words, they found a flawed product, which can currently be easily manipulated to gather information beyond that authorized in a court order. They believe the flaws are fixable and have made recommendations as to what needs to be done, including eventually releasing the source, but not until some glaring security problems have been fixed first.............
Read on here:
http://www.lwn.net/2000/1207/security.php3 [lwn.net]
Re:glaring security problems (Score:2)
What would they need that for?
They [rhizome.org] have a GPL! [rhizome.org]
Oops. Maybe they don't...
--Blair
"The net is not secure. The net is not secure. The net is not secure."
Disappointment... (Score:3, Interesting)
Re:Disappointment... (Score:1)
Re:Disappointment... (Score:1)
Re:Disappointment... (Score:1)
That doesn't change the fact that I, personally, think this falls in the category of YARBI (Yet Another REALLY Bad Idea(TM)).
Re:Disappointment... (Score:1)
Of course, if you actually READ my post you would have gathered that.
I'm just people care that you think it's a bad idea, too. Maybe you should go spend your efforts lobbying congress instead of posting stupid comments on slashdot?
All net traffic now under Carnivore surveillance? (Score:1, Informative)
I am part-owner of one ISP, and know personally top network administrators for at least a dozen other providers, both major and minor. None of them have 'Carnivore' or other government-mandated software or hardware on their networks.
The Feds did make a one-time request of several major providers to scan their logs for email with a certain set of 'From' addresses, but there is no new ongoing traffic analysis at individual ISPs.
There is absolutely no privacy left on the Net any more. None. Keep that in mind when you rant. That's what crypto is for. Ranting on Slashdot is by it's very nature, about as public as you can get.
Re:All net traffic now under Carnivore surveillanc (Score:1)
This would offcourse hardly be any safer if you'd not audit all the code before compiling it:)
Re:All net traffic now under Carnivore surveillanc (Score:2)
Of course, you then need to build your own processor to ensure there are no hacks in the processor too...
Re:All net traffic now under Carnivore surveillanc (Score:1)
No, but you do need to use a compiler that hasn't been hacked in the manner described by your link. I submit that it is possible to do this without building the compiler myself.
Re:All net traffic now under Carnivore surveillanc (Score:1)
Yes, exactly. I don't know about you, but it's much easier for me to vet my compilers than it is for me to write them from scratch.
The process is greatly simplified by the fact that you can often use the same compiler to compile itself; yes, you have to start with a precompiled one, but simply compare the vetted one with the precompiled one to determine if the precompiled one has been compromised.
In fact, I would go so far as to claim that most people vet their compilers already. Their standards simply vary quite a bit in thoroughness from our own.
Re:All net traffic now under Carnivore surveillanc (Score:2, Interesting)
Re:All net traffic now under Carnivore surveillanc (Score:2)
PGP, GnuPG, or whatever public key crypto you use, enables you to sign, verify, encrypt or decrypt documents. That's it. It's not an anonymizer. You can use them to keep your personal communications private, but they're useless for public posts on Slashdot. What good's a post on Slashdot that no one can read?
Now a PGP based mailing list would be a very Good Thing(tm). Encrypt your messages to the list server, which then sends it out encrypted for each subscriber.
Ha! (Score:2)
Re:All net traffic now under Carnivore surveillanc (Score:1)
lasdkasldAlaskd;sdkHasl;djasAdakls! Casd;AsaNlk alsYlaksdfOalskdfsdfUasdflj jklRlkjaEajksAalskjDasdklj alskdjTadslkjHlasdjIalsdjSladjs?lasdj
--- END PI-GUY ENCRYPTED MESSAGE ---
HINT: Look at the caps...
Re:All net traffic now under Carnivore surveillanc (Score:2)
Re:All net traffic now under Carnivore surveillanc (Score:1)
DMCA (Score:1)
Computer Art or Programmer Art? (Score:1)
Carnivore server? (Score:3, Funny)
You know, sadly, this is probably far more sophisticated than the actual Carnivore system.
Good grief.
Re:Carnivore server? (Score:1)
I recall hearing Larry once allude that he did some work for the "Iowa Farm Boys", before (or sometime during?) his stint at JPL.
But that was also before Perl, at least as we know it, I guess.
Otoh, maybe he taught 'em a few tricks. :-)
Re:Carnivore server? (Score:1)
More Info (Score:1)
So the FBI couldn't get ISPs to Install Carnivore (Score:2)
And this is a good thing because
???
Probably needs hardware (Score:1)
Would need to be some kind of no-hop-added router, I guess. (I know IPF can do this, but parsing packet content is a bigger job than just reading headers, especially at the major nodes)
Like others have wisely said, if your unsure, encrypt with your own keys. Everyone sniffs around these days, run ipmon for fun!
Wireless networks are very vulnerable to this (Score:2)
Imagine setting up a dual-homed, 802.11b equipped laptop near a major business, then using this art project to broadcast what you hear to the world.
Scary!
Want to cause havoc with their monitoring? (Score:2, Interesting)
Start secret message:
s^O(^S^XltkA@[1^Z;
end secret message
Re:Want to cause havoc with their monitoring? (Score:2)
Re:Want to cause havoc with their monitoring? (Score:3, Informative)
"Prisoner" style jamming would be stuff like secretly passing (real) grocery lists, abruptly changing your well known hobbies, getting a post office box that you only use for two of your four magazine subscriptions, etc. Makes the warders think you're up so something so they expend effort trying to figure it out.
So what would "Carnivore" style jamming be? It can't be just randomness, and it has to be at least semi-legitimate. Posting signed and encrypted random streams won't count, because it's not real. And it can't get you in real trouble. One idea: create a PGP key for "Anonymous Coward", and sign all of your AC posts to Slashdot with it. Another: always use a signature tag composed of 26 randomly selected letters, all lowercase.
The key to getting jamming to work is for all the jammers to respond appopriately to other jammers. When one jammer sends you a PGP signed grocery list, send him or her your chocolate cheesecake recipe.
Re:Want to cause havoc with their monitoring? (Score:2, Interesting)
This happened to me about four years ago. I posted a message to Usenet (my first post to alt.discordia, among other groups), with a .sig containing "Filter bait: He will assassinate the president, but needs the password." followed by RC4 in 3 lines of Perl. The secret service obtained my (unlisted) home phone number, probably from my university, (probably not entirely legal, but I'm not pushing it,) and called me up at the ungodly hour of 9AM to question me about my website. They were referring to this post, which they had found using Dejanews.
My point being, I'm a bit afraid of the run of the mill agents having access to technical anti-privacy nukes that they don't quite know how to use.
Re:Want to cause havoc with their monitoring? (Score:1)
Re:Want to cause havoc with their monitoring? (Score:1)
> cheesecake recipe.
Hmm, I'm not sure. *My* chocolate cheesecake would be considered as a terrorist weapon in many countries...
Slashdot should have checked the info. (Score:1)
So there's no public domain software.
Re:Nothing to Worry About (Score:1)
As for the next release, IIRC, the debian package has been updated about 5 times since I installed woody back in February, including minor version changes (i.e., it's not all package-tweaking noise).
artistic security hole (Score:1)
Free spyware!! (Score:2, Interesting)
Of course that was always the case, but in the past it's been similar to the "school of fish" mode of defense. By schooling, fish reduce their chance of being singled out by predators. In a group of a million fish, the chance of any particular one of them getting eaten by a shark is small. One could liken this scenario to the millions of Internet users. But now, with tools like Carnivore, you can catch all of the fish at once and devour them at your leisure.
I think I see why it's named Carnivore.
Re:Free spyware!! (Score:1)
I agree completely! I've always accepted this. Nobody ever promised privacy on the net (unless you're talking about encryption, but even then, is it perfect? And who's willing to promise?). Asking for privacy on the net is like asking for privacy on an interstate highway.
By schooling, fish reduce their chance of being singled out by predators. In a group of a million fish, the chance of any particular one of them getting eaten by a shark is small.
Unless the shark has a really big mouth.
Re:Free spyware!! (Score:1)
Re:Free spyware!! (Score:1)
It won't help your ISP at all--it is designed for the output from an ETHERNET packet sniffer, and your ISP is almost certainly using fiber. Your "shool of fish" defense is illusory as well. One of the things computers do really really well is filter large amounts of data, picking a fish out of a school. Even the FBI's Carnivore wasn't startling because of its tech, but because it was going to be installed in formerly open waters.
I also doubt this will ever be usefull for "security", although network analysis certainly can be (see the Intrusion Detection Working Group of the IETF). However, it might be possible to write a client that gives you traffic analysis that could be used to make your network more effecient. Sniffing is legitimate for more than just security--network flow design and protocol debugging are actually probably more widespread.
I'm still not sure I really like this program, though. As the artist says in his NY Times interview, he wants people to become more comfortable with the idea of survellience. I'm not sure I like that. On the other hand, it might decrease the demonization of packet sniffers, which would be a good thing. On the gripping hand, it's out there, check and see if it's running on _your_ network.
Re: (Score:2)
Re: (Score:1)
Re: (Score:1)
Re:Free spyware!! (Score:1)
ever heard of a packet sniffer? Like TCPdump? which is all this is, parsed by a perl script. If you had bothered to read the site you'd see that all this does is re-serve the input of a packet sniffer and is inteded as some kind of comment on the public natuire of information etc. It has not raised any privacy bar. In fact if it makes people aware of privacy issues, it has probably helped. All the functionality provided is superseeded by other tools.
Re:Free spyware!! (Score:1)
Where are the clients? (Score:1)
Examples are cute, but where is the software ?
Re:Where are the clients? (Score:1)
Cool art... (Score:2)
This is too freakin' scary (Score:1)
Now not only do you have the Feds watching everything you do online, but you also have the approval of those who claim to fight for your "freedom". What a joke, indeed. It is time that we, the freedom-loving citizens of the Internet, teach these people that it is not ever acceptable to watch other peoples' network traffic. This is a violation of privacy pure and simple and if we need cause a great disturbance in protest against such a thing, then so be it. We will retain our right to privacy.
Re:This is too freakin' scary (Score:2)
I can not point to any protocol standard that says you have such a right.
Your packets travel over the internet through other administrative domains that you do not control... What makes you think you have privacy there ?
Now if you want privacy get PGP/FreeSWAN/isakmpd/etc. and make it so your packets have no meaning to any but the destination. Until then NEVER assume you have privacy...
Re:This is too freakin' scary (Score:1)
Re:This is too freakin' scary (Score:1)
Re:This is too freakin' scary (Score:1)
Re:This is too freakin' scary (Score:2)
If you freely give something to the government, there is ZERO Constitutional protection on that information.
The Constitution (4th) just says the government can't take information from you. Doesn't say a damn thing about what they already have.
Kindly tell me where in the Constitution it says that they can't freely publish your tax records for example.
The 9th and 10th are the only ones that can remotely be considered protecting privacy, but those aren't enforced worth crap.
I'm waiting for FBI@home (Score:2)
Just imagine it - due to the wild success of the SETI@home and protein folding efforts, the FBI has decided that they too can distribute the loads of finding nefarious people in the world.
And, with the MPAA and RIAA @home supplemental modules, your MP3s will be reported directly to the master FBI server...
Re:I'm waiting for FBI@home (Score:2)
Carnivore is one place open source ain't great (Score:2)
You've just given Carnivore tools to the Chinese, The Iraqis and all the other oppressive governments of the world. Even though buying a network sniffer and configuring it was within their power before, this makes it easier.
And whatever fears I may have (and they are many) about the U.S. government and its agents abusing their powers, they are nothing compared to the fears I have about those other powers.
What we needed was two things. One was source review of the boxes the goverment uses by a wide range of trusted people, and two was a free as in free beer tool for U.S. ISPs so they can use it as an excuse to refuse a carnovore box on their ISP in the first place.
Re:Carnivore is one place open source ain't great (Score:2)
Why do you think that espionage is still a booming practice in the world? Because it's a great way for "them" to steal "our" technology! They've already got it, my friend!
Besides, Carnivore was never a secret from governments--just from citizens. What good purpose is there in keeping it secret from a country's own populace.
Re:Carnivore is one place open source ain't great (Score:2)
But this is one piece of software I don't want to be easier to use, and maintained at higher quality. Most of us are never going to use it ourselves.
But I do want to be sure it's not got hidden holes, so there is a dilemma. But the right answer may be in some mix, not the pure open source model.
And you're dreaming if you think the spooks who take and enhance this software here or elsewhere are going to contribute back their modifications, GPL or no GPL.
Re:Carnivore is one place open source ain't great (Score:1)
If your are the admin of the networks system, which in totalitan regimes, you are, you have total control over the access and routing and logging of packets. You don't need carnivore, you just have the routers log all packets to from specific IPs.
Carnivore exists because in the USA, the govt doesn't have 100% of the network.
Re:Carnivore is one place open source ain't great (Score:2)
The question is how easy do we make it. I don't know about this GNU carnivore but one thing FBI's Carnivore/DCS1000 does is track DHCP and radius traffic so that it associates IP addresses with real userids. Not something you can as easily do with a standard router.
Instead of writing tools to make it easy to snoop, we should be writing opportunistic crypto tools to make it harder.
Re:Carnivore is one place open source ain't great (Score:1)
Re:Carnivore is one place open source ain't great (Score:3, Interesting)
We do want to be sure that they aren't snooping on us improperly, and some feel that if they are open source, that means we can check for that sort of thing. But in fact, that's possibly a big mistake.
We can verify that the open source version is OK, but as you point out, there are people who can modify the code. And it's a lot easier to take the open source snooper and add patches to it to take out the safeguards than it is to write one without safeguards from scratch. This is really quite different from the goals of open source.
The people who take out the safeguards won't tell you they did it, nor will they contribute their patches. Nor will they follow the GPL.
When the FBI shows up with a DCS1000 Carnivore, they just attach a black box to your ethernet. They claim it's even wired so it can read, and not write, to your ethernet. But you don't get to inspect it, or check MD5s on the binaries to assure they were inspected to behave well.
Now, I like the idea of a free tool for ISPs so they can install it to comply with warrants and thus refuse the police black box. But what advantage is gained by that being open source. It would be nice if it's free to the ISPs, with source available if you sign a contract, but that's about it.
I'm also concerned that since secuity at ISPs is not super high (some run IIS for chrisakes) that it's not that hard for anybody, even a script kiddie to break in to a machine on my ISP's ethernet, and then get another script based on this open source snooper you want to snoop me. Forget the feds, these guys are worse.
So I want to work to encrypt all my traffic but I can't yet, so I hope to not make it easier for the snoops.
Not that it should be illegal or anything to release this package. I just want to argue that it's not a great idea. It doesn't match the reasons we like open source.
That's odd.. (Score:1)
KidA
go audio (Score:1)
I've often thought of vocalizing my lan. Does anyone know where to start to realize tcp packets as sounds?
Re:go audio (Score:1)
Another memepool.com post (Score:1)
hhmm (Score:1)
ahh dident work.
Why You Should Use Encryption (Score:2)
Fickle (Score:2)
But is it "art"? (Score:4, Interesting)
I did this better in webcollage [jwz.org] years ago. But of course I didn't call myself an Artist Collective, and I didn't put out a press release, so no article in the Times for me, darn. I guess that's why webcollage is a ``hack'' rather than an ``art project.''
I swear, one of these days I'm gonna apply for a federal grant to hack on xscreensaver [jwz.org]. I've seen people get money for worse things [sfmoma.org]. All you have to do is swallow your sanity and gag up an artist statement [catalog.com] of some kind, and the literati will take you seriously: if you cloak it in pretentiousness, the most trivial piece of eye candy can become a Serious Work, full of Insight And Meaning!
The problem with art is artists. My goal has long been to eliminate the artist from the creative process.
Re:But is it "art"? (Score:1)
Proof that... (Score:1)
In other news, Richard Stallman is considering changing the GNU Project's name to Monty Python and hawking its software as parodies of the real stuff.
Cygwin? (Score:1)
Doing the work for them... (Score:2)
Did anyone read the post or the web site? (Score:2)
Graphical warning... ;) (Score:1)
That might stimulate a few lax sysadmins when bosses see their boxen showing jolly rogers..
---
Paul
Re:woohoo! (Score:1)