Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Privacy Communications

Law Enforcement Targets Online Communication 300

Posted by ScuttleMonkey from the bigger-brother dept.
jesup writes "The FCC ruled yesterday that the CALEA applies both to broadband suppliers and to all calls made via VoIP providers. If they have any connection to the PSTN, it applies whether the call in question is IP-to-IP or not. Separately, all broadband suppliers will have to implement CALEA, which means providing access to law enforcement for trap-and-trace on all traffic on broadband connections. In related news, the FCC has also released a policy document that states that 'consumers are entitled to run applications and use services of their choice, subject to the needs of law enforcement.' In theory, under this they could require wiretaps on in-game chat, or key-logging in file encryption programs."
This discussion has been archived. No new comments can be posted.

Law Enforcement Targets Online Communication More

Law Enforcement Targets Online Communication

Comments Filter:

  • your rights (Score:3, Funny)

    by BarkLouder ( 916884 ) on Wednesday September 28, 2005 @04:13PM (#13670370)
    All your right are belong to us!

    • Re:your rights (Score:5, Funny)

      by Grax ( 529699 ) on Wednesday September 28, 2005 @04:19PM (#13670432) Homepage
      The secret police are there to protect you from the "bad people". We should all support their efforts.
      • The secret police are there to protect you from the "bad people". ..do they only hire suicidal people, then?
      • But can they protect us from the terrible secret of space?
      • If you have nothing to hide, then you have nothing to fear!

        Except your mom finding all your pr0n. And your boss finding out you supported Kerry instead of Bush, getting worried, and not sending you to conferences [slashdot.org]. And the FBI finding out you support Amnesty International - bet you didn't know they're almost a terrorist organization, did you?

        --LWM

      • Re:your rights (Score:3, Insightful)

        by Anonymous Coward
        Seriously people, get over it. CALEA has been law for well over a decade (1994, to be exact). This is not something new. CALEA does not give the feds power to do wiretaps, either. That power was explicitly defined in 1968. It was defined in order to PREVENT law enforcement from snooping on people. Prior to that, there was no law about it, and cops could eavesdrop and tap phones as much as they felt like. The law in 1968 defined their power to tap communications, but also put strenuous restrictions on how th

        • Re:your rights (Score:4, Informative)

          by jesup ( 8690 ) * <randellslashdot@NOspAm.jesup.org> on Wednesday September 28, 2005 @09:20PM (#13672688) Homepage
          Original poster here.

          You're correct that CALEA doesn't *authorize* wiretaps - but it does require that providers make calls easily tappable (when they might otherwise be slow, hard or impossible to tap).

          And as it applies to VoIP providers, it requires they set things up to allow tapping calls that previously weren't covered (IP-to-IP calls), if the service offers _any_ sort of connection to the PSTN, even through a 3rd party.

          TFA has all the footnotes justifying this expansion of powers... Basically if the data goes through a switch or router on a public network, they're covered.
    • Wait. Are you saying we have any left?!?!?

  • welcome to (Score:4, Insightful)

    by mobilebuddha ( 713936 ) on Wednesday September 28, 2005 @04:14PM (#13670380)
    the people's republic of united states.

  • Right... (Score:5, Insightful)

    by pete6677 ( 681676 ) on Wednesday September 28, 2005 @04:14PM (#13670382)
    This will be about as easy to implement as a ban on internet porn, which is to say impossible. Sure they can get the major providers to comply, but good luck tracking down every chat room operator.

    • Re:Right... (Score:5, Insightful)

      by garcia ( 6573 ) on Wednesday September 28, 2005 @04:20PM (#13670447)
      Sure they can get the major providers to comply, but good luck tracking down every chat room operator.

      Yes sir! We will comply with your "family first" and "anti-terrorism" chat room rools even though they violate our First Amendment rights! Tb shpx lbhefrys lbh snfpvfg cvtf! Oh sorry, my fingers were on the wrong keys. Yes, "USA! USA! USA! Down with terrorists and porno!"

      Jura gur shpx ner jr tbvat gb fgnaq hc gb gur snfpvfg shpxref naq svanyyl gryy gurz gb trg shpxrq? Sorry, the keys are slippery.

      • Re:Right... (Score:3, Funny)

        by Virak ( 897071 )
        Geez, you should at least use something secure, like 2ROT13 [clifford.at].

        • Re:Right... (Score:4, Informative)

          by interiot ( 50685 ) on Wednesday September 28, 2005 @04:51PM (#13670734) Homepage
          Due to the special properties of ROT13, the number of rounds must be even, otherwise the algorithm provides only as much security as simple ROT13. Good implementations would be e.g. 2ROT13, 4ROT13, 6ROT13 or 2048ROT13.

          Currently, an implementation of 2ROT13 exists, which is called Pretty Good Double ROT13 Privacy - or short PG2ROT13P - and is meant to be a successor to the infamous Pretty Good Privacy cryptography toolkit.

          Long-term goals are also to make the EU parliament and US congress pass laws that require all personal letters, postcards and even face-to-face conversations to be encrypted with 2ROT13.

          Brilliant!
      • According to rot13.com, the parent translates to:
        Lrf fve! Jr jvyy pbzcyl jvgu lbhe "snzvyl svefg" naq "nagv-greebevfz" pung ebbz ebbyf rira gubhtu gurl ivbyngr bhe Svefg Nzraqzrag evtugf! Go fuck yourself you fascist pigs! Bu fbeel, zl svatref jrer ba gur jebat xrlf. Lrf, "HFN! HFN! HFN! Qbja jvgu greebevfgf naq cbeab!"

        When the fuck are we going to stand up to the fascist fuckers and finally tell them to get fucked? Fbeel, gur xrlf ner fyvccrel.

      • Re:Right... (Score:4, Funny)

        by g2devi ( 898503 ) on Wednesday September 28, 2005 @05:16PM (#13671013)
        Dam straight.

        And you're not alone.

        The following organizations have proudly joined the fight for freedom:
                    MAtrOx, microsoST, ALexa, INTerpol, Avanti, LIBerAty alliNnce, HUeS aircraft, Sara lEe, INgsoc

        Who else will join The Fight?
    • Who needs to track down a chat room operator, they just trap the traffic a hop or two down the line. Or do chat room operators run their own ISPs now?
    • Wait, isn't it illegal for the fed to spy on it's citizens? Won't they need to get a court order to wire tap even with VoIP? And how would that work in a chat room where lots of good citizens are talking?
      • The chatroom is an extension of "public place" where you have no reasonable expectation of privacy.
        As to the VoIP I would assume a wiretap order would be required.
        -nB

      • Re:Right... (Score:3, Interesting)

        by arkanes ( 521690 )
        Wait, isn't it illegal for the fed to spy on it's citizens?

        No.

        Won't they need to get a court order to wire tap even with VoIP?

        Yes and no. Mostly no, these days. They need a warrant, but they can get them after the fact, and from secret courts.

        And how would that work in a chat room where lots of good citizens are talking?

        If it's like interception of email, they're supposed to just ignore what anyone says unless they're talking to the person being tapped. I leave it up to your imagination just how ti

  • Gahrewjhrjkhare (Score:5, Insightful)

    by Brandon K ( 888791 ) on Wednesday September 28, 2005 @04:16PM (#13670399)
    which means providing access to law enforcement for trap-and-trace on all traffic on broadband connections.

    Goddamnit, I swear, the last few decades in America have been more like an Orwell book than the books themselves.

    I'm moving up to Canada, the worst they have there is stray polar bears. Who's coming with me?

  • Reasons to go black market IT (Score:5, Insightful)

    by dada21 ( 163177 ) * <adam.dada@gmail.com> on Wednesday September 28, 2005 @04:16PM (#13670402) Homepage Journal
    I have no problem providing stronger encryption communications to my customers. I've helped implement encrypted VoIP before VoIP was a defined term. Some of the shadier "organizations" already employ an incredible amount of geeks -- $100,000 a year cash (for a 20 hour a week job) is hard to say no to.

    These laws are a waste of money. A VoIP stream can easily be hidden in a Quake3 online stream played between bots. There's too much information changing hands.

    And who the hell are they trying to catch? Drug dealers? Terrorists? Enforcement of either set of laws only creates more people filling in the shoes of those caught.

    We're not making a dent in any non-violent crime, why throw more money at a non-problem?

    • Re:Reasons to go black market IT (Score:5, Insightful)

      by Concern ( 819622 ) * on Wednesday September 28, 2005 @04:30PM (#13670551) Journal
      why throw more money at a non-problem?

      I know your question is partly rhetorical. But it's such a good one, I'll answer.

      Social control.

      The people in power today are anxious to return to the J Edgar Hoover days of federal "law" "enforcement," when federal agents could be employed as a goon squad for servicing the needs of the dominant political and economic interests backing the government.

      To make this good, they need eliminate oversight (such as judicial review), and expand their powers (limiting civil and human rights). As far as I can see, this has basically been the sole law enforcement agenda of both Bush and Clinton - the only difference was the intensity with which they pursued it.

    • I agree. If you really want to hide your communications, just roll your own communications programs and/or roll your own encryption. Although you might not create the strongest encryption scheme for the "law enforcement" folks to spy on you they have to federally funded script kiddies. I'm sure they have scripts to crack main stream encryptions. If you were one of "them" wouldn't you just go after the low hanging fruit first?

      It's kinda like the car alarm theory, your alarm doesn't have to prevent th

    • These laws are a waste of money.

      Watch a COPS TV show lately, perchance? Sure, there are some criminals who are smart and intelligent enough to CYA. But most seem to be really really stupid, and have the means to avoid prosecution in any number of ways, but still manage to get themselves caught.

      Even more or less simple computer-wipe killswitches wouldn't be difficult if a tiny bit of forethought went into criminal malfesence, but 99% of the population isn't anywhere near technically savy enough.

    • Why? (Score:2)

      by cr0sh ( 43134 )
      We're not making a dent in any non-violent crime, why throw more money at a non-problem?
    • I've actually thought about that some. It would be trivial to provide any organization that has 'runners' (I'm thinking organized crime here.) with unbreakable one-time pad encryption.

      Assume a 20k/s VoiP stream. A CD could be used as a OTP for about 9 hours,.

      Set up a secure generation site somewhere, make a dozen CD-RWs, run them to computers all over a city.

      Each diskless computer boots off the CD using a custom Linux distro that takes up maybe 50 megs, and the rest is encrypted data. It boots up, sucks

    • Cockroach Response (Score:5, Interesting)

      by Phoenix666 ( 184391 ) on Wednesday September 28, 2005 @07:42PM (#13672197)
      Sorry, but I just can't think of a better term. Everytime this sort of Big Brother article comes along, one of the two major memes that pops up is, "gee, the wording of the law/policy/whitepaper/directive says this, but it doesn't say that, so by simply reworking the protocol stack or implementing this kind of encryption stored in SeaLand we can perform a simple end-run around it." It's basically, right-wing neo-fascist does this, so I'm going to do that in an attempt to run, hide, and sneak around them. And I'm sorry, but this sort of attitude is a molly-coddled, namby-pamby Harvey milquetoast response that likely stems from the "I've been bullied/abused/neglected all my life" meme. Basically it's fascists whomp some area of the countertop and everyone runs for cover response.

      In truth, if we're talking about a war for the freedom of information, then Slashdotters collectively are the best possible warriors to prosecute that fight. In the rest of your life, you may have felt powerless--physically intimidated or socially out-classed. But in this realm you are the gods of the age. You must do something.

      There are myriad offline groups out there that are fighting their guts out against this sort of thing. You can help them. They all need I.T. systems that help them organize, raise money, and fight. You can sign up to code a system that will enable them to do so. You can give money from your above-average I.T. salary to support their efforts. Or you can get creative and blow everyone away. You can do so much, which is for you relatively little, and you will make an enormous difference.

      Still not sure what to do or where to channel your energies? Send me a message via Slashdot and I will be happy to give you some leads. For one, I started a grassroots political group in NY that has won several elections but still needs help with its website and volunteer organization system. We could use your help. Drop me a line and let's do something.

    • I have no problem providing stronger encryption communications to my customers

      You may have a problem when they make it illegal and make you choose between 50 years in jail or not doing it.

      • This won't be a problem. All it means is they have to go to my clients when they want a wiretap. The hook will be in all my code to do the wiretap, but you can't do it at the phone company because all you get is a stream of unintelligible bytes.

  • Freedom of speech, as long as the cops OK it (Score:4, Insightful)

    by Grax ( 529699 ) on Wednesday September 28, 2005 @04:16PM (#13670407) Homepage
    I assume this means we continue to have the constitutionally guaranteed freedom of speech, as long as it is OK with law enforcement. (hmmm)
  • Now, not only am I afraid to look at porn on the internet, I can't even cyber in peace!

  • Secure Lines (Score:3, Interesting)

    by Doc Ruby ( 173196 ) on Wednesday September 28, 2005 @04:18PM (#13670420) Homepage Journal
    When will I see the first voip provider which sends a Java client applet to my phone (not a PC) with the call? It's not architecturally necessary, but I'd like that kind of encapsulated/authenticated voip client. End-to-end encryption of every call.

    • Re:Secure Lines (Score:3, Interesting)

      by Tackhead ( 54550 )
      > When will I see the first voip provider which sends a Java client applet to my phone (not a PC) with the call?

      Why, as soon as the VOIP provider embeds CALEA support in the client applet that it sends to your phone, sir!

      > It's not architecturally necessary, but I'd like that kind of encapsulated/authenticated voip client. End-to-end encryption of every call.

      What you propose isn't architecturally necessary. But neither is it architecturally sufficient.

      Unless you're proposing to...

      a) write yo

      • Want to come over for a nice brisk hand of INWO [sjgames.com]?
        • > Want to come over for a nice brisk hand of INWO [sjgames.com]?

          It's been a long time. Thanks for the memories. That'll give me something to do while waiting for... wait a sec...

          /me removes gold pin with red eye, swaps it for a green pin with red eye

          Ah, much better. That'll be a great way to pass the time waiting for the next bit of Paranoia XP [costik.com], and between turns of Paranoia Live [paranoia-live.net]. (I'm happy! Are you happy?)

  • Military Misuse (Score:5, Interesting)

    by Valacosa ( 863657 ) on Wednesday September 28, 2005 @04:20PM (#13670436)
    So legally, we're forced to leave our lines of communication open for law enforcement.

    Who watches the watchers?

    IM programs aren't that hard to write, if someone really wants to avoid John Law they could just write a proprietary program with a proprietary encryption protocol. Is that technically illegal?

    Every time I read a story like this, I am reminded of that video on the 'net somewhere (too lazy to look for it) of military personnel using military equipment to watch a couple make out in a car.
    • if someone really wants to avoid John Law they could just write a proprietary program with a proprietary encryption protocol. Is that technically illegal?
      If the FBI's policy memo is true and enforced, it could be. Read the second CNET article.

    • Re:Military Misuse (Score:4, Funny)

      by Concern ( 819622 ) * on Wednesday September 28, 2005 @05:04PM (#13670862) Journal
      I'm pretty sure you're talking about this. [ifilm.com]

      "06 - 26"
      "This is 06."
      "Uh, we've got activity out here but I don't think we really need to report it"
      "What do you see?"
      "Ah, appears to be fornication in a converitble"
      (laughter)
      "Do a target score, and I'll be there in a second"
      (laughter)
      "Ah, we're taping it." ...

      "White Hawk 26 - Alpha 1 1 Uniform"
      "Ah, this is 26"
      "Roger, I'm gonna need that tape from you, and an additional..."
      "Roger, we'll make copies for everyone."

      Our tax dollars hard at work.

    • if someone really wants to avoid John Law they could just write a proprietary program with a proprietary encryption protocol.

      Or just use good-old talk encapsulated with OpenSSL.

      And for file transfers, there's always scp or https (with client certificates).

      I'm sure someone could rig something up really quick to do point to point audio wrapped in TLS (via OpenSSL). Or just set up a VPN between firewalls and use Netmeeting, OpenPhone, or GnomePhone.

      I'd bet someone already has.

    • GAIM encryption will work over AIM and i think other networks though i don't know how secure GAIM encryption is
  • From TFA:

    A House of Representatives committee report prepared in October 1994 emphatically says CALEA's requirements "do not apply to information services such as electronic-mail services; or online services such as CompuServe, Prodigy, America Online or Mead Data (Central); or to Internet service providers."

    So it sounds like this will only apply to VOIP, not to email, chat-rooms, and so on, as the /. summary states.

  • I just wonder one thing... (Score:5, Insightful)

    by Daneurysm ( 732825 ) on Wednesday September 28, 2005 @04:21PM (#13670455)

    Will the coup be bloody?

  • People have more privacy than YOU!

    <NELSON>HAH HAH!</NELSON>

  • wiretaps (Score:3, Insightful)

    by Whammy666 ( 589169 ) on Wednesday September 28, 2005 @04:24PM (#13670477) Homepage
    The sad thing is that any criminal/terrorist organization is going to encrypt any communication they want to keep secret. There are plenty of alternatives for passing secret messages such as posting coded messages in plain sight on public forums (even /.!). This is going to have more impact on Joe Citizen's privacy than on criminal behaviour.
    • Ab jnl fbzrbar jbhyq cbfg pbqrq zrffntrf ba /.

  • Needs of Law Enforcement (Score:5, Insightful)

    by N7DR ( 536428 ) on Wednesday September 28, 2005 @04:25PM (#13670489) Homepage
    So: consumers are entitled to run applications and use services of their choice, subject to the needs of law enforcement.

    Which, translated into English, means: "if you want to use service X, but Law Enforcement can't tap service X, then you no longer are entitled to use X". For "X" substitute whatever service you like. Wonderful.

  • What about DIY PBXs? (Score:5, Insightful)

    by ectospasm ( 5186 ) on Wednesday September 28, 2005 @04:26PM (#13670504) Homepage Journal
    What if some [terrorist, child porn, etc.] group decided to set up a network of Asterisk [asterisk.org] or Bayonne [voip-info.org] servers, virtually circumventing any established VoIP providers? I'm not sure about Bayonne, but Asterisk is extremely easy to throw together and set up. Will they make setting up such "unlicensed" servers illegal? I shudder to think what that would do to the community at large...
  • Since the Public Switched Telephone Network is running out of room anyway, I recommend we build an alternative to it. In fact, an alternative is already available; it's called DNS. I propose that all "standard" P2P VoIP software include dynamic DNS capability, and provide a default "phone number" service which registers the user as a particular subdomain name. (The user can of course change it if he wants.) This will provide a new way to connect to people, and I wouldn't be surprised if it would supplan

  • Piss 'em off! (Score:3, Interesting)

    by Frodo Crockett ( 861942 ) on Wednesday September 28, 2005 @04:29PM (#13670539)
    Use one-time pads for all your online communications. Of course, these are no good if you send them via an ordinary electronic medium. You need physical contact with the person who's getting the pads to ensure a secure exchange.

    This wouldn't be too difficult to do--you could print normal-looking business cards with a short key printed on the back in UV-reactive ink. (That's invisible ink to those of you in Rio Linda.)

    As for meeting the people you need to give pads to, need I remind you that this is Slashdot? I'll see most of you at the next big scifi/anime/gaming/tentacle porn convention.

  • Imagine the possibilities (Score:5, Funny)

    by evil agent ( 918566 ) on Wednesday September 28, 2005 @04:29PM (#13670542)
    Imagine someone playing a multiplayer fps with a screen name like George Bush or something. Every time he gets killed, the feds would have to investigate!

  • We of the EU (Score:3, Interesting)

    by FidelCatsro ( 861135 ) <fidelcatsro AT gmail DOT com> on Wednesday September 28, 2005 @04:33PM (#13670573) Journal
    We of the EU , The common Wealth and all other nations in the world would like to thank the USA .
    What with these new Spiffy morality and Communications laws ,we will likely see a sharp rise in investment and customers (and already have in many cases ) .
    I would like to thank your politicians from the bottom of my heart for my recent pay rise .

    Though i do feel sympathy for the thousands of unemployed they are attempting to create in their efforts to secure the votes .. um I mean Save the souls of their good people .

  • This is damned creepy (Score:5, Insightful)

    by JayBlalock ( 635935 ) on Wednesday September 28, 2005 @04:46PM (#13670693)
    Did anyone read the actual policy document [fcc.gov]? The arrogance in it is just stunning. It has a list of things the consumer is "entitled" to do, every one with a legality-related caveat.

    The FCC appears to truly believe that they have been granted power to regulate Internet usage as they see fit.

    It's not just the wording, it's the mentality. Everything about the document suggests that the FCC is the source from which the right to use the Internet flows. AND that the *consumer* is ultimately responsible for anything "illegal" that is on his computer. Even if it's just a matter of unknowningly using a VoIP protocol that doesn't allow tapping.

    There's no other way to read it, and furthermore, it's the only "logical" (in terms of the logic of empire) way of dealing with the situation. Since they can never regulate the internet COMPANIES - who will all swiftly relocate to another country - they will have to regulate the PEOPLE to make sure their laws are followed. And they have to do that since, of course, laws passed must be enforced.

    This is, as they say, doubleplus ungood.

  • This is an FCC ruling. That's bad enough. But at least it's not a court ruling.

    That is, as we saw with the broadcast flag, the courts can put the smackdown on the FCC when it gets out of bounds.

  • "They have made their decision... (Score:5, Interesting)

    by mcc ( 14761 ) <amcclure@purdue.edu> on Wednesday September 28, 2005 @05:06PM (#13670891) Homepage
    "They have made their decision, now let them enforce it" is honestly the first thing that comes to mind.

    Or in other words, how the hell does the FCC even have the power to enact this rule? The FCC of course has the ability to set standards for telephones; if someone wishes to patch a computer program into the "normal" phone network, then of course it's reasonable that those calls follow the same regulations as any other phone provider. But what they're talking about now sounds way, way outside the scope of anything the FCC was ever empowered or intended to regulate. It reminds me of when the FCC demanded copy control chips be put into every TV and video card, until some months later, just before the deadline for the regulations to begin, the courts, in response to inquiry by the EFF, pointed out that, no, the FCC doesn't have the right or power to demand such things.

    Has anyone spoken to the EFF or ACLU about possibly challenging this new ruling in court?

  • Attack on Privacy (Score:5, Insightful)

    by MrSteveSD ( 801820 ) on Wednesday September 28, 2005 @05:12PM (#13670976)
    Ask yourself why the government has never tried to open everyones letters, photocopy them and then reseal and post them?

    It's not because they wouldn't like to, it's just too much hassle to do it. Even if they did try to do it, the public would be outraged, yet far less noise is being made just because the medium is electronic rather than paper. Computers make it possible to snoop on people cheaply and that is the problem. As technology progresses, more and more snooping abilities will become economical.

    They would like you to believe that this is to thwart terrorists, but terrorists will of course use the strongest encryption and will not play by the rules. I believe the general public are the real target here. If you suspect a certain person is a terrorist, there are already many ways you can put them under surveillance. You can install keyloggers on their computer, bug them, bounce lasers of windows etc etc. If you don't know who the terrorists are you have to perform mass surveillance of eveyones mail looking for keywords. The problem is that terrorists won't say "Meet me by the Bank of America with the Semtex" they will say something like "See you at the pub on Wednesday. Bring that new playstation game.".

    Recent freedom of information releases in the UK (my country) have shown that the police have in the past infiltrated groups such as the anti-apartheid movement and other legitimate and non-threatening political groups. That's the sort of behaviour I expect in Uzbekistan not the UK. We must also not forget Echlon [wikipedia.org], which has been used to spy on European businesses. Our governments have shown that they cannot be trusted time and time again. We must not allow them to use the fear of terrorism to rob us of our rights and privacy.

    Anyway. I have a counter proposal. We now know that politicians are making important decisions in face to face meetings so that there are no electronic records. I propose that all politicians be required to wear head mounted video cameras that record everything they say and do. The tapes must be handed in and stored in the event of any enquiry. We can explain that we have to do this because of the terrible threat of CORRUPTION. Anyone in the government could be involved in CORRUPTION and innocent politicians will have nothing to fear in these new measures. We have to balance the need for government secrecy with the important fight against CORRUPTION. We cannot allow CORRUPTION to win.
  • ....when you elect fascist republicans to office who don't believe in a right to privacy...or in any of your rights at all. We are all criminals in their minds. Mod me as flamebate...I dare you...but its true. And inciteful ;-)

  • Guess what - Vonage already complies (Score:5, Informative)

    by Zebra_X ( 13249 ) on Wednesday September 28, 2005 @06:38PM (#13671756)
    Something I wrote a few months ago:

    A few weeks ago while on vacation I bought a Linksys wrtp54g router from Radio Shack. It is touted as a two line VoIP router that is compatible with vonage. It seemed like what I needed at the time, a g capable wireless router that wouldn't crash like my old netgear.

    I set it up - and it's been running quite well for a month now. I noticed though, that I could SSH to it. What was curious was the fact that i couldn't login. I used the "administrative" login, but it didn't work. I also tried the other default passwords - with no luck. This made me wonder who infact had the password and could login to the router. I wasn't too worried about it. Until today.

    I've been trying to get inbound PPTP VPN working, and it hangs at "Verfiying Username and Password..." only to return error 721. Indeed it would seem that inbound GRE forwarding doesn't work. So I thought to myself, I'll just get a firmware update and everything will be happy. The question was "Where is the firmware?". It's not on linksys's site. I come to find that Vonage controls the firmware for this router. I've also found that it's not easy to get through proper channels. Also, it seems to not flash when the router is not in a "provisioned" state.

    This is where things get really interesting. It would seem that Vonage has complete control over the router. There are a number of default passwords that can be accessed, but not changed through the various interfaces. It would also seem that there is a bit of "phoning home" going on. Some of the firmware versions have automatic update installed allowing them to download the latest version via TFTP.

    Now that's an interesting topic. From my reading, the updates are not encrypted nor are they transmitted over a secure connection. There seems to be no verification of the contents of the firmware file. Let's go out on a limb for a moment and say that the update server is compromised and a compromised update is placed on the server. The update is then automatically, with no verification or intervention, downloaded and installed on all of the vonage routers that have been provisioned.

    The result: *PWND*. Every last router.

    This is terrible. Not only is it terrible, there is absolutely nothing on the box, or in the literature that says that this router is programatically connected to Vonage. There is absolutely no warning that there is even a *chance* that Vonage, could for example install various utilities or wares on your router at their discretion.

    This device should not be sold in stores. It should be shipped by Vonage to end customers who agree and ackknowledge that they are giving up control of what goes in and out of their network.

    Now it's time to do something about it.

  • Corporate Interests Meddling in OSS (Score:5, Insightful)

    by Bananas ( 156733 ) on Wednesday September 28, 2005 @06:47PM (#13671831) Homepage
    Has it occured to anyone here that over time, more and more OSS is going to become "borderline illegal"? That we may end up with VLC as a program that you can't import into the USA (because of its DVD capabilities); that Asterix will move out of the states (because it provides private communication without a corporate entity, and will eventually be "regulated" in such a way that only telcos could use it); that even simple tools like GNU shred will "disappear"? B.S. like the E911 service are merely thinly vieled threats against existing VoIP providers, by way of legislation from the dominate telcos to ensure that VoIP doesn't take off...without them leading the way, of course.

    I'm beginning to think that I should hoard source code like never before...

    Suddenly, that 15-CD debian distro looks better and better, provided the source code is provided.

    RMS may sound like a crackpot to our facist overlords^W^Wcorporate lobby, but he's right on the money - if the source code to a program can be controlled (by hardware, software, or firmware, no difference) then you really don't have any freedom as to what you can do. And that kind of freedom scares some people, but not for the reasons that are presented in the nightly news; you have to remember, never in human history have you had a world-wide connected information network that spanned cultures, beliefs, and challenged the status quo in every case. What we are seeing is the slow relentless progress of those entities - governments, transnational corporations, and hyper-wealthy private interests - to "dumb down" or take away from that potential. If people woke up one day and realized that they didn't have to work for someone else to provide for themselves, well, they jig would be up and the few in privledge would find themselves fighting to maintain control, as they always have through the ages. This isn't about political spectrums such as right vs left, democracy vs communism; this is about power, and the maintenance of power. Money, which years ago used to actually have a value of some sort, has degenerated into just another form of power. In this case, CALEA is power applied for both the telcos (who suddenly are felling the heat from VoIP) and government interests (in this case, the existing regime^W administration wants to extend its powerbase).

    (Yawn) enough ranting for today, go outside and play...

Slashdot Top Deals

A physicist is an atom's way of knowing about atoms. -- George Wald

Close