September 2001 - Test - lists.nanog.org

RE: Just Carnivore (was: Yahoogroups and Carnivore)
by Roeland Meyer 18 Sep '01

18 Sep '01

|> From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] |> Sent: Monday, September 17, 2001 10:10 PM |> |> On Mon, 17 Sep 2001 18:01:53 PDT, Roeland Meyer |> <rmeyer(a)mhsc.com> said: |> > However, given mil-grade VPNs these days, there is no way |> they can read what |> > you sent. They can only tell that you sent something. |> However, I just |> > discovered the Steganography stuff in my SuSE Linux |> distribution, hmmmmm. |> > But, they still know where it came from and where it went. |> |> As Bruce Schneier said, the problem with steganography is |> that you need |> a good cover story for why you're mailing JPG's of giraffes |> back and forth... I can actually see lots of applications for steganography; Stealth porn on a public web-site, for example. But for purposes of clandestine communications with and far-flung org, use a news content site that has pictures and imbed messages in the news content pictures. A site like www.Kavkaz.org, for an example, could be used to transmit messages in such a way. Another method is to take advantage of a photo album sharing site like www.ofoto.com. Whom is to know that a mega-pixel image isn't just an image of the family dog? Photos are just the easiest thing, there are other multi-media content vehicles. However, most folks aren't sufficiently talented to be able to post original music. I imagine that the terrorist population has no larger percentage of musical composers than the general populous. Whereas, people generally take snapshots like crazy. I am reasonably sure that Casper the friendly ghost has either thought of, or used, most of them, at one time or another. I can't think that your average terrorist scum-bag has any less of an imagination. So, Bruce Schneier, when posing that problem, must have had his imagination disengaged. There is more than adequate cover story for passing huge JPGs around.

3 2

RE: Just Carnivore (was: Yahoogroups and Carnivore)
by Roeland Meyer 18 Sep '01

18 Sep '01

|> From: Larry Diffey [mailto:ldiffey@technologyforward.com] |> Sent: Monday, September 17, 2001 4:22 PM |> Let's see, I want to send email to someone but I want it to |> be completely |> anonymous. I go to safeweb.com or any other anonomizer and |> get myself a |> hotmail address. I then send it to the recipient with PGP |> encoded text. He |> logs on to hotmail through anonomizer and retrieves it, |> decodes it and reads |> it. If I was really smart I'd bounce around a couple of |> other proxies while |> I was at it. The only way this works is that you route to someone, that has a VPN pipe to somewhere else.... nah, even that won't work. You can encrypt the packets but you can't do it anonymously, unless you are at a public access point. Even so, they can identify the MAC addr. That, plus the time-stamp, and you're nailed. All they need is the motivation. However, given mil-grade VPNs these days, there is no way they can read what you sent. They can only tell that you sent something. However, I just discovered the Steganography stuff in my SuSE Linux distribution, hmmmmm. But, they still know where it came from and where it went. The problem is that, it's looking for a camoflaged needle in a camoflaged needle stack, all of which are capable of changing patterns, like a chameleon. First you have to find it and then figure out what it is. That processing capability doesn't yet exist. Certainly not under WinNT and the typical hardware it runs on. All that they can tell is that encrypted traffic went from point A to point B.

3 2

CNN.com - Officials: Government failed to react to FAA warning - September 17, 2001
by daryl＠daryl.org 18 Sep '01

18 Sep '01

Do you guys think that this is BS? ******************** If you are having trouble with any of the links in this message, or if the URL's are not appearing as links, please follow the instructions at the bottom of this email. Title: CNN.com - Officials: Government failed to react to FAA warning - September 17, 2001 Copy and paste the following into your Web browser to access the sent link: http://www.emailthis.clickability.com/et/emailThis?clickMap=viewThis&etMail… Copy and paste the following into your Web browser to SAVE THIS link: http://www.savethis.clickability.com/st/saveThisPopupApp?clickMap=saveFromE… Copy and paste the following into your Web browser to forward this link: http://www.emailthis.clickability.com/et/emailThis?clickMap=forward&etMailT… *Please note, the sender's email address has not been verified. ******************** Email pages from any Web site you visit - add the EMAIL THIS button to your browser, copy and paste the following into your Web browser: http://www.emailthis.clickability.com/et/emailThis?clickMap=browserButtons&…" Instructions: ----------------------------------------- If your e-mail program doesn't recognize Web addresses: 1. With your mouse, highlight the Web Address above. Be sure to highlight the entire Web address, even if it spans more than one line in your email. 2. Select Copy from the Edit menu at the top of your screen. 3. Launch your Web browser. 4. Paste the address into your Web browser by selecting Paste from the Edit menu. 5. Click Go or press Enter or Return on your keyboard. ********************

1 0

Clueful person from charter...
by Eric Whitehill 17 Sep '01

17 Sep '01

Can I please get someone from CharterMI.net to contact me off list? I'm having some issues and can't seem to get them resolved through esclation. Couldn't find contact info on nether.net....sorry I had to resort to this. Thanks, Eric

1 0

RE: Just Carnivore (was: Yahoogroups and Carnivore)
by Stafford, Todd 17 Sep '01

17 Sep '01

> Supposedly Carnivore only targets specific kinds of traffic and doesn't > really monitor everything at once. It's not like (again, supposedly) > Echelon that examines everything and then red flags certain items. > Carnivore is only looking for certain things. Also, there is no outside > access to it. Someone has to physically come in and remove the mass media > (what ever that may be: more than likely a hard drive). Afraid I'd have to say that in this instance your conclutsions are inaccurate. For more information, see the FBI's Carnicore site at http://www.fbi.gov/hq/lab/carnivore/carnivore2.htm > Let's see, I want to send email to someone but I want it to be completely > anonymous. I go to safeweb.com or any other anonomizer and get myself a > hotmail address. I then send it to the recipient with PGP encoded text. He > logs on to hotmail through anonomizer and retrieves it, decodes it and reads > it. If I was really smart I'd bounce around a couple of other proxies while > I was at it. Again, check out the above link. Your idea of going to an anonmizer would be useless as Carnivore scans the traffic directly from your ISP.....before it ever gets to the anonmizer. Granted, encrypting your message before ever logging onto your ISP and then sending it via it's encrypted format would prevent it from being read in cleartext but considering what Congress is proposing, the sending of encrypted messages could be just what the FBI would need to start looking deeper into your life. > Carnivore? Toothless! No breach or attempted breach of one's civil liberties is toothless....especially the right to privacy.

2 1

RE: CNN and NAWAS
by Roeland Meyer 17 Sep '01

17 Sep '01

|> From: Sean Donelan [mailto:sean@donelan.com] |> Sent: Monday, September 17, 2001 3:56 PM |> The rumor is it takes NORAD less than 3 minutes to issue an alert. |> The government had the means to issue a warning. I lived near NORAD, whilst working for MCI. The tour is amazing. The Space Command Center is equally amazing. Their target tracking systems and info processing capability is equally amazing, what I've seen of it. That capability exists now. Unfortunately, what is equally amazing is the poor state of the civilian systems. Hughes (HAC) should have been awarded that contract, back in 1987, rather than the IBM/Raytheon clan that fsck'd the pooch. Parts of the FAA air traffic control system are older than I am.

1 0

CNN and NAWAS
by Sean Donelan 17 Sep '01

17 Sep '01

Sorry to do this, but I read this CNN news story and I'd like to point out the technology existed. The procedures and policies may have been lacking. http://www.cnn.com/2001/US/09/16/inv.hijack.warning/ Military officials at NORAD ordered fighter jets from Langley Air Force Base in Virginia to intercept the flight, but neither the FAA, NORAD, nor any other federal government organization made any effort to evacuate the buildings in Washington. Officials at the Pentagon said that no mechanism existed within the U.S. government to notify various departments and agencies under such circumstances. Actually, there has been a mechanism to alert almost every public safety point in the nation for many years. Quoting from the NAWAS manual: > The National Warning System (NAWAS) is a 24-hour continuous > private line telephone system used to convey warnings to > Federal, State and local governments, as well as the military > and civilian population. Originally, the primary mission of > the NAWAS was to warn of an imminent enemy attack or an actual > accidental missile launch upon the United States. NAWAS still > supports this mission but the emphasis is on natural and > technological disasters. > > In todays post-Cold War environment, the threats imposed by > disasters make it imperative for all government officials to > have access to an effective and reliable means of warning the > public of impending emergencies so that they may take protective > actions. Title VI of the Robert T. Stafford Disaster Relief > and Emergency Assistance Act authorizes the use of the NAWAS > to support the All-Hazards emergency response mission of the > Federal Emergency Management Agency (FEMA). NAWAS is used to > disseminate warning information concerning natural and > technological disasters to various warning points throughout > the continental United States, Alaska, Hawaii and the Virgin > Islands. This information includes but is not limited to acts > of terrorism including Weapons of Mass Destruction (WMD) after > aircraft incidents/accidents, earthquakes, floods, hurricanes, > nuclear incidents/accidents, severe thunderstorms, tornadoes, > tsunamis and winter storms/blizzards. NAWAS allows issuance of > warnings to all stations nationwide or to selected stations as > dictated by the situation. The rumor is it takes NORAD less than 3 minutes to issue an alert. The government had the means to issue a warning.

2 1

Yahoogroups and Carnivore
by Jay Fenello 17 Sep '01

17 Sep '01

As of yesterday, the performance of Yahoogroup's has degraded from a couple minutes, to a couple of hours between posting and distribution. It is rumored that this is due to Carnivore being installed at major ISPs throughout the country. Any insights? Jay. +++ Jay Fenello, Internet Coaching http://www.Fenello.com ... 678-585-9765 http://www.YourWebPartner.com ... Web Support http://www.AligningWithPurpose.com ... for a Better World ----------------------------------------------------------- "A new civilization is emerging in our lives, and blind men everywhere are trying to suppress it." -- Alvin Toffler

12 14

Re: What Worked - What Didn't
by Mike Lewinski 17 Sep '01

17 Sep '01

> Are you aware of any "downside" to implementing this command ? I opted against using it on our network, after considering the consequences of having an eBGP link go down for a few seconds repeatedly (which has actually happened here twice in my memory). Under this circumstance the fast-external-fallover would probably have caused our routes to be dampened. Other than that, I think it's probably a bonus that a single very brief failure on an eBGP link doesn't require the tables to be reset. Mike > ----- Original Message ----- > From: "Mike Lewinski" <mike(a)rockynet.com> > To: <nanog(a)merit.edu> > Sent: Monday, September 17, 2001 3:38 PM > Subject: Re: What Worked - What Didn't > > > > > > > But speaking of BGP: what concerns me is the very long timeouts. When > > a > > > BGP router loses power, it takes minutes for the peer on the other > > side of > > > the connection to notice something is wrong and reroute the traffic. > > > > This IOS command should remedy that under most circumstances: > > > > bgp fast-external-fallover > > > > > > Mike > > > >

1 0

Re: Yahoogroups and Carnivore
by smd＠clock.org 17 Sep '01

17 Sep '01

Yes, it's so much more fun to blame keystone kops or incompetent service providers for any sort of slowdown, rather than accept that scaling is hard once you've passed size large. The danger to the kops in question is that anyone who actually solves the problem of increasing both the amount of processing time per unit and the number of units processed is likely to make alot more money in private industry, still, even in the wake of the collapse of the equity bubble. Sean.

1 0