Subject: Re: [Raven] Three Questions and Some Examples

From: Vernon Schryver <[email-masked]>
Date: Wed, 17 Nov 1999 09:45:27 -0700 (MST)

> From: "chefren" <[email-masked]>

> ...
> ...
> > Since laws against hardware scanners have not worked, why would laws
> > against netsnooping work?  As with scanners, as long as the police don't
> > say why they just happened to stop that particular car to check that the
> > driver's license was current, who is to say that they used a scanner or
> > tcpdump?
>
> Our standard should use technical tricks that make it 
> obvious they didn't had a warrant and didn't use the 
> properly sealed tapbox.

As we all know, words by themselves are often not sufficient to send
someone to jail, at least in the U.S.  It's better to find evidence of a
crime in more than the accused's words.  Thus, the main use of wiretaps
is not to convict people, but to discover where to look for other
incriminating evidence.  Police use all kinds of taps, scanners, and
anonymous informants to know where to look.  Once they know which car to
stop or whose bedroom to search, they do so.  The tap itself is then
irrelevant and can be forgotten, unless the police are very scrupulous or
too lazy to find or invent another probable cause for the search.  If the
source of the information was illicit, such as an illegal wiretap, the
police attribute the information to an anonymous tip.  As pointed out in
the newspaper article sent to this list today, the police making the arrest
and the prosecutors who get the conviction might honestly not know that
an illegal wiretap was used to get the information that lead to the
evidence.  Other police using taps to look for other crimes can drop hints
to the arresting officers like "a little bird told me that if you search
under Joe Smith's bed, you'll find something naughty."

None of this is theoretical, and it happens in more than just Los Angeles.
The reports I've read about the use of scanners concerned New York.
There can be no honest doubt that it also happens in The Netherlands
and anywhere some wiretaps are forbidden.  To claim otherwise is dishonest.
Law enforcement officers are human, and humans everywhere often take illegal
shortcuts toward what they rationalize as desirable and just ends.

> ...
> > No, I mentioned a way to obscure one of the unreliable signs of games such
> > as spoofing TCP/IP connections. ...

> I really think we can simply agree on the technical facts 

That implies acknowledgement of the technical fact that an auditable
tcpdump would be a fraud, that while it might be able to certify
that it heard what it recorded, it could not certify that what it
heard was spoken (or transmitted, etc.) by any particular person,
and it could not record things it didn't hear.

> ...
> How to counter a malicious communication provider?
>
> Pretty simple start: We need a law that prohibits him to do 
> so. If there is no law that states the communication 
> provider may not inject false packets he may.

That is a willful misreading of what I wrote.
I said nothing about naughty communications providers, but talked about
what anyone can do.  If you were an ISP and someone claiming to be from
your local police asked to inspect one of your co-lo closets for contraband
like drugs or guns, would you refuse?  How would you know whether during
that inspection, they connected a laptop to your Ethernet and send a few
MB of forged IP packets?   Would you necessarily notice if they left the
laptop, either hidden from sight or in the open and supposed a camera to
catch theives?  Would you know whether they happened to install software
on a co-located server that they could later use remotely to inject
whatever they wanted?  What if one of your co-lo servers is running
years-old software that has a root-exploit security hole, a bad cop or
"member of organized crime" discovers the hole from over the Internet,
and installs some remotely operated tools, say a copy of Microsoft's netmon
agent (remote tapping) and the obvious code to inject a stream of forged
TCP segments?

> The law should provide a pretty high penalty and if there 
> are serious suspicions the police should be able to enter 
> the technical rooms of the provider and hire Vernon to 
> check if someone messed with the routers.

That is nonsense.  I said nothing about anyone "messing with" any
"routers" other than sending packets that they'll handle just as they
handle 1,000,000,000's of other packet daily.  There would be no more
traces in routers of injected TCP packets than there would be evidence
in telephone central offices of tape recordings played for taps.

> > Such games are theoretically impossible to detect unless
> > the victims are using real (i.e. private) authentication
> > and real encryption, but then the tap rooms and auditable
> > tcpdump are useless. 
>
> As far as I know they aren't useless. There are still 
> precise fingerprints of the communication and those 
> fingerprints can help law enforcement. Law enforcement is 
> used to work with little...

"Fingerprints of the communication"?  Is that what is commonly called
"traffic analysis" or it is dishonest nonsense like "auditable tcpdump"?

> ...
> Is there a way to detect injected TCP packets or not? I 
> assume the tapped person will receive them and his tcp-
> stack will reject them?

Yes, of course, as I've repeated said, there are ways to "inject TCP
packets".  No rocket science is needed.  Commercial snooping programs like
Microsoft's `netmon` can inject arbitrary packets for diagnostic purposes.
However, for this application, you'd want a different, more specialized
program.  A competent UNIX programmer needs less than a day to hack a nice
little utility for sending an existing stream of voice/IP bits in forged
TCP segments.

Yes, the IP destination will "reject" (for some notion of "reject") the
"injected" TCP segments, but only if the IP destination receives them.
That rejection might or might *not* pass through the "tapping room" that
recorded the "injected" TCP segments, and even if it passes through the
tapping room, the "tapping box" might or might *not* record them.  A
moment's consideration of routing offers ways to ensure that the the
victim's computers never see the "injected" TCP segments.

Actually, with dial-up PPP, the bad guys need only wait until the
victim's computer is turned off for the night.

It is intellectually dishonest propose technical mechanisms while lacking
the vaguest idea of the technical facts.  It is dishonest to persisently
propose an "auditable tcpdump" without knowing even the least bit of how
TCP/IP works.  The talk about an "auditable tcpdump" is either dishonest
because it is based on willful ignorance or it is dishonest because it is
known to be nonsense.

Vernon Schryver    [email-masked]

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: Matthew Saroff <[email-masked]>
Date: Wed, 17 Nov 1999 11:40:21 -0600

> someone to jail, at least in the U.S.  It's better to find evidence of a
	Not true.  Look at the criminal conspiracy and RICO statutes.  People
can be sent to jail for conspiring to commit a crime, even if the crime is
never comitted.
	Declan McCullough can also give information on a case where the
contents of a cypherpunks list discussion resulted in jailtime for someone.

-- 
Matthew Saroff
Do not reply directly to this message.  Reply to
[email-masked]

---

From: "chefren" <[email-masked]>
Date: Wed, 17 Nov 1999 19:35:50 +0100

On 17 Nov 99, at 9:45, Vernon Schryver wrote:

> As we all know, words by themselves are often not
> sufficient to send someone to jail, at least in the U.S. 
> It's better to find evidence of a crime in more than the
> accused's words.  Thus, the main use of wiretaps is not
> to convict people, but to discover where to look for
> other incriminating evidence.  Police use all kinds of
> taps, scanners, and anonymous informants to know where to
> look.  Once they know which car to stop or whose bedroom
> to search, they do so.  The tap itself is then irrelevant
> and can be forgotten, unless the police are very
> scrupulous or too lazy to find or invent another probable
> cause for the search. If the source of the information was
> illicit, such as an illegal wiretap, the police attribute
> the information to an anonymous tip.  

"Invent another probable cause???" If that comes out they 
should be severely punished. We have to be very serious 
about these things.

I start getting the idea that you do believe police 
organizes crimes and also believe organized crime is a non 
existing problem.

And facts are to the contrary. If criminals are organizing 
a "case" these day's they start buying a set of prepaid GSM 
telephones and only make calls within their group. So the 
only chance for law enforcement is actually =see= a 
suspected criminal make a call and ask for logs of the 
local GSM "antenna". That's a very very small chance. 
Really looking and following criminals is very costly and 
only done in very serious cases. So most organizing of 
crimes goes fully undetected (and most crimes ARE 
organized! If the crime isn't something with anonymous 
administration only, they probably have do "do" something 
that can't be undetected. For example a bank robbery. But 
also a bank robbery is very clueless these day's. The ones 
who do the upfront looking might only have met the ones who 
rob the bank personally once or even never.

Since organization is easier and easier to hide for law 
enforcement criminals really do so and law enforcement 
needs more and more means to detect less evidence.

> As pointed out in

I agree but I see no reason not to do something about it!

> shortcuts toward what they rationalize as desirable and just ends.

Agree, and it is wrong so we have to do someting about it, 
serve this world with an auditable tap standard. It won't 
be a 100% guarantee against misuse but we can get it pretty 
close.

> and it could not record things it didn't hear.

Is there anything new here? There are nog 100% solutions 
and law enforcement has to do -something- for the money we 
all pay them.

> That is a willful misreading of what I wrote.

Probably I misread something and I have no problems with 
giving my excuses for that, but I'm pretty sure I 
understand what you mean with "willful misreading" and I 
just deny that.

> like drugs or guns, would you refuse?

What do you think are printed, stamped and signed warants 
for? Why do you think central offices supply digital key's 
in The Netherlands? They are there to PROOF things and 
avoid misuse of power.

Communication providers should definitely not leave anybody 
in critial rooms without proper screening.

> How would you know whether during
> MB of forged IP packets?

Right moment, relevant information, not highly probable and 
the tapbox would record it so it can be studied carefully.

>  Would you necessarily notice if they left the

I agree with al your technical idea's and the only thing 
that comes up to me: Law enforcers, paid by us all, have a 
very difficult task in the future.

> in telephone central offices of tape recordings played for taps.

OK, sorry, so the only way to detect them are signs in the 
data that the tapbox has recorded.

..

> "traffic analysis"

Different people different language.

> or it is dishonest nonsense like "auditable tcpdump"?

If you think I'm dishonest and thus only want to fight 
instead of discus about serious and rising problems in this 
world please let me know so officially and please take note 
that I don't want to fight, that can only destroy this 
channel.

> because it is based on willful ignorance or it is dishonest because it is

I still don't think so and I shall repeat some old input:

If communication providers by law have to encrypt the data 
they exchange it's nearly impossible to inject TCP 
segements there. So the vulnerable place is within the 
technical rooms of the communication provider. And those 
should thus be "sealed". Most of them I know of are more or 
less sealed already but I do believe international 
standards can help here.

+++chefren

---

From: Declan McCullagh <[email-masked]>
Date: Fri, 19 Nov 1999 10:34:18 -0500

Right. Check out y2kculture.com/mccullagh/pubs.html (scroll down) to find
some articles I wrote on Carl Johnson and Jim Bell.

-Declan