00:00:00.042-->00:00:04.958 >>So I wanted to start with uh I'm gonna go kind of fast because this is only a 20 talk 00:00:04.958-->00:00:09.042 and I uh uh it's action packed. I wanted to start with the sort of general presumption which is 00:00:09.042-->00:00:14.292 that it's frustrating when p-technology.. There's not transparency, it's not made 00:00:14.292-->00:00:19.542 public. And I'll, I'll start with the example of breath analyzers uh back in the mid 00:00:19.542-->00:00:25.083 2000's cops would be pulling people over making them blow in a tube, using that to make a 00:00:25.083-->00:00:28.917 decision as to whether or not to make an arrest. And people thought well what if there are 00:00:28.917-->00:00:32.625 problems with the breath analyzer? Why should we trust it? Why was there really 00:00:32.625-->00:00:36.333 probable cause for an arrest here and indeed eventually some enterprising people got their 00:00:36.333-->00:00:41.000 hands on the s-source code for intoxilyzer and found out that it did have some real problems. 00:00:41.000-->00:00:45.875 And and might y-yeild some false positive results and anyone who remembers the 80's will remember 00:00:45.875-->00:00:50.792 the clipper chip uh en-endeavor when the government just said 'Hey I know what we'll do, we'll 00:00:50.792-->00:00:55.500 hold on to 1 true key for all encryption and you guys can have your own keys but we'll be able 00:00:55.500-->00:01:01.833 to just kinda backdoor that and this is a a an idea with a a just a built in fundamental flaw 00:01:01.833-->00:01:07.042 uh should be pretty obvious to everyone here. But anytime you hear just kind of trust us we 00:01:07.042-->00:01:12.625 know what we're doing, that's what gets gets me riled up. And so I'm gonna talk about is a 00:01:12.625-->00:01:18.083 series of tools that are are more developed for for servailing um peer to peer 00:01:18.083-->00:01:23.417 networks and they are not made public and the government just says just trust us we know what 00:01:23.417-->00:01:28.250 we're doing. And and because they're not public I haven't seen them I don't know anyone 00:01:28.250-->00:01:35.208 who has seen them unless they are a sworn agent and they won't talk to me about it. Uh and so 00:01:35.208-->00:01:39.250 the inferences that I'm gonna show you here are made from just reading dozens and dozens of 00:01:39.250-->00:01:42.708 search warrant affidavits when they describe how the thing works and what it does, so we 00:01:42.708-->00:01:45.417 can make some deductions about what it actually what it actually does, that's where 00:01:45.417-->00:01:51.333 we're headed. Um so surveillance is fairly pervasive these days um there's a law that says you 00:01:51.333-->00:01:56.333 probably shouldn't install an untappable phone system um we've got uh the NSA metadata call 00:01:58.750-->00:02:03.917 collection or call metadata collection stuff where they we realize the content uh analysis 00:02:03.917-->00:02:08.958 is fun but traffic analysis can be just as fun. Uh and and surveillance is also pretty 00:02:08.958-->00:02:14.042 secret we usually don't find out about it until there is a leak and everyone gets in the press 00:02:14.042-->00:02:19.750 and heads roll. And there's more than just surveillance going on, surveillance by surveillance I 00:02:19.750-->00:02:25.625 mean is just passive collection of information but we see now some more invasive uh efforts as 00:02:25.625-->00:02:30.125 well and there's a uh uh series of cases right now that playpen serious of cases which some 00:02:30.125-->00:02:35.708 people in the room are familiar with were the government embedded uh some malware that 00:02:35.708-->00:02:40.167 opened a side channel - people would browse to a website using TOR the government operated that 00:02:40.167-->00:02:45.417 website for awhile and implanted some some malware that opened a side channel and would leak the 00:02:45.417-->00:02:50.875 user's public IP address back back to the government so uh that's not just surveillance 00:02:50.875-->00:02:56.667 that's actually changing things and and you might need a warrant for that and some some cases are 00:02:56.667-->00:03:00.333 getting tossed for that reason but by far not all. And we know that the government is 00:03:00.333-->00:03:04.042 collecting exploits that's not been a secret at all so one of the questions that we have to 00:03:04.042-->00:03:08.875 ask ourselves is where is the boundary between just good old fashioned aggressive 00:03:08.875-->00:03:13.625 investigation of crime and violating people's rights and sort of taking things one step 00:03:13.625-->00:03:18.625 too far. So that's the prologue let's get down to it. Um when I s-s-s talk about peer to peer 00:03:20.667-->00:03:25.375 networks I mean things like BitTorrent Gnutella Ares or Edonkey or whatever they call 00:03:25.375-->00:03:31.250 it. These have been around for a long time. Uh the new Gnutella variant of the tool that I'm 00:03:31.250-->00:03:36.375 talking about was in use at least as early as 2009 I don't know if anyone really uses 00:03:36.375-->00:03:41.083 Gnutella anymore I'm sure the tool still exists um and these are generally the tools that I'm 00:03:41.083-->00:03:47.542 talking about are generally forks of open source software, so there's been a a a tool 00:03:47.542-->00:03:53.708 developed like micro torrent or whatever or um Phex that's one of the ones and some 00:03:53.708-->00:03:58.167 enterprising software developer says I'm gonna make my own version of this that does some 00:03:58.167-->00:04:03.375 extra stuff. So they they make use of aspects of the peer-to-peer protocol that are 00:04:03.375-->00:04:08.917 normally obscured from the user they're they're below what the user sees. And they add in some 00:04:08.917-->00:04:12.542 features that were not really of interest to ordinary users and we'll talk about what those are. 00:04:12.542-->00:04:19.292 So who develops these? Well one guy the the the tool for the Ares network was developed by 00:04:19.292-->00:04:24.500 this one person Joseph Versace, he's a he's a Canadian law enforcement uh programmer and 00:04:24.500-->00:04:28.875 analyst uh there's a there was a collaboration between the CS department at a couple of 00:04:28.875-->00:04:33.500 universities and some police departments that produced a roundup which is kind of the 00:04:33.500-->00:04:38.958 most best known of these tools um and it's based on the the Phex uh Gnutella client and 00:04:38.958-->00:04:45.208 there's a a version of it for BitTorrent as well. So it they're developed by a you know 00:04:45.208-->00:04:51.917 normal folks, academics and so forth, and they make new uses of existing features. So for 00:04:51.917-->00:04:57.000 Gnutella when you do a search when you get a query hit it comes back and it includes the 00:04:57.000-->00:05:02.000 SHA-1 hash value of the files that the search hits are so this is a nice quick easy way to 00:05:04.917-->00:05:11.250 identify if you happen to have a database of files that you knew nobody should possess uh you 00:05:11.250-->00:05:15.250 could just quick see, do these hash values match?, and then you would instantly have good 00:05:15.250-->00:05:22.042 targets for investigation um and Gnutella also has a feature called Swarming where if if I 00:05:22.042-->00:05:27.042 admit that I'm sharing a file I will also try to tell you about all the other people I know 00:05:27.042-->00:05:30.583 about that are sharing that file. So that you can grab it from multiple peers and it 00:05:30.583-->00:05:36.792 doesn't all have to come from me and then you can directly uh browse peers as well, not just 00:05:36.792-->00:05:41.083 do searches but once you've found someone who's in Gnutella client you can just go and query 00:05:41.083-->00:05:46.000 them and and get a list of uh what files they have what regardless whether your search 00:05:46.000-->00:05:50.458 turned up those files or not. So that's those are, you know, kinda interesting features if 00:05:50.458-->00:05:55.125 you are an investigator that's kind of fun. Um on BitTorrent we have a couple of other things 00:05:55.125-->00:06:00.875 that are what are called tracker messages and this tells which peers are interested in which 00:06:00.875-->00:06:05.125 torrents so if someone is looking for something you might be able to detect them on that 00:06:05.125-->00:06:11.167 basis um and when they connect for downloads or when they acquire new segments they'll uh 00:06:11.167-->00:06:15.833 uh um clients will send out some announcements of what segments of what they've got so they can 00:06:15.833-->00:06:22.208 immediately begin participating and sharing. Remember the whole idea of BitTorrent was that 00:06:22.208-->00:06:26.250 bandwidth is asymmetrical we can upload, we can download things way faster than we can upload 00:06:26.250-->00:06:31.542 them generally speaking, and so we wanna share large files uh what we'll do is everybody 00:06:31.542-->00:06:36.000 shares segments of the files or you know you share the whole file but we'll grab segments a 00:06:36.000-->00:06:39.333 segment from here and a segment from there and a segment from here and that means that we can 00:06:39.333-->00:06:43.917 download multiple things while we're only uploading, you know, whatever our up upstream 00:06:43.917-->00:06:47.542 bandwidth is. Uh and then there's something called peer exchange which is kind of like 00:06:47.542-->00:06:52.167 the swarming feature for Gnutella so these are the features that exploits on on 00:06:52.167-->00:06:57.917 BitTorrent and then we add in some features as well. Um known file lists, so a database of 00:06:57.917-->00:07:03.542 known files of interest so that we can quickly determine when we seize search query results 00:07:03.542-->00:07:09.625 whether they are things that we want to be investigating. IP Geolocation - are these doofuses 00:07:09.625-->00:07:14.792 in our jurisdiction? So before we spend a whole lot of time investigating something can we 00:07:14.792-->00:07:19.500 at least tell if we would have the power of arrest over these people. Uh Single-source 00:07:19.500-->00:07:24.500 downloading, this is uh we don't wanna find out we don't want to swear out a warrant and go and 00:07:26.667-->00:07:30.333 arouse someone out of bed and seize their computer only to find out that they only had the 00:07:30.333-->00:07:34.417 first 3 segments of an 80 segment torrent. Uh we wanna know that they have the whole 00:07:34.417-->00:07:38.292 thing so that means we have to download the whole file from them so this is completely 00:07:38.292-->00:07:44.583 antithetical to what BitTorrent is designed to do uh we're gonna instead of grabbing things from 00:07:44.583-->00:07:48.083 all over the place we're gonna grab them from just one thing and that's so that's it's not 00:07:48.083-->00:07:53.458 really subversion of the protocol but it uh a use other than what it was designed for 00:07:53.458-->00:07:58.458 and then fake file share also uh we'll get throttled if we're not sharing anything. Uh and if we 00:08:00.708-->00:08:05.333 share the right kinds of things we might attract people into connecting to us.. Am I doing 00:08:05.333-->00:08:11.958 something funny with the mic or is.. Okay I'm okay? Alright! [laughter] Um so we we we we we 00:08:11.958-->00:08:16.250 don't wanna actually be distributing contraband so we're not going to actually do that 00:08:16.250-->00:08:19.750 but we're gonna announce that we have it to share to see who will connect to us and so also so 00:08:19.750-->00:08:23.958 that we don't get throttled. Uh so that it looks like we're sharing and we don't get um 00:08:23.958-->00:08:29.875 taken out of the out of the network. Finally we'll have the ability to tag individual 00:08:29.875-->00:08:34.292 clients that we connect to. And that's there's gonna be more on that later but that's a pretty 00:08:34.292-->00:08:40.250 interesting thing. Can I identify some point down the road that this was the, you 00:08:40.250-->00:08:45.542 know, the client that connected to you know that I connected to and downloaded from. That'd be 00:08:45.542-->00:08:50.792 that'd be an important piece of evidence. Uh and we'll talk a little bit about how that works. 00:08:50.792-->00:08:55.792 Um so what they're gonna do, these tools, is impersonate regular old peers on the 00:08:57.875-->00:09:03.375 network. They're gonna engage in activity design to attract connections whether they're 00:09:03.375-->00:09:09.708 doing searches uh or or um announcing what they've got uh they'll do queries of their own 00:09:09.708-->00:09:15.250 to find things of interest they'll inspect the systems that they connect to to look at as 00:09:15.250-->00:09:21.000 much as they can in the shared areas. They'll perform those single source downloads and they 00:09:21.000-->00:09:26.417 log their activity and this is the game plan, right? We'll we'll the investigators will go 00:09:26.417-->00:09:31.208 make themselves a a good log of what they did and what they found and they'll use that as 00:09:31.208-->00:09:36.208 the basis for obtaining a warrant. Alright so um if you were accused of a crime on the 00:09:39.000-->00:09:45.708 basis of a log file - you might like to know is that log file a reliable source of information. 00:09:45.708-->00:09:52.083 Does it work? Uh and so people over time attorneys have tried to get their hands on these 00:09:52.083-->00:09:58.167 tools because they wanna know how does it work? What does it do? And they're uniformly 00:09:58.167-->00:10:03.750 rebuffed uh nobody's to my knowledge ever succeeded in that quest. And there have been times 00:10:03.750-->00:10:09.083 where the court has ordered the court has sided with the defense attorney and said yeah, um law 00:10:09.083-->00:10:12.750 enforcement cough up, cough up this code or give them access to a working instance of it or 00:10:12.750-->00:10:17.750 something. And uh the case will get dropped so they'd rather do that then burn their source and 00:10:21.250-->00:10:26.583 this is a curious thing because on the one hand they say there's nothing interesting about these 00:10:26.583-->00:10:31.083 tools. They're just simple forks of regular open source software uh anyone could make this it's 00:10:31.083-->00:10:36.542 not a big secret and yet they'll go to great lengths to preserve the secrecy. And reason number 1 00:10:36.542-->00:10:41.542 that they give is it would divulge our database of you know naughty files. Uh and and first 00:10:43.667-->00:10:48.667 off I think the software developers in the room just snickered because who embeds a 00:10:48.667-->00:10:52.042 database in the software that they're distributing, it should be two separate things so that 00:10:52.042-->00:10:57.000 you can update the database without having to distribute a whole new build of the code. So 00:10:57.000-->00:11:02.167 it's probably not exactly that. I don't think the database is literally part of the software 00:11:02.167-->00:11:07.333 but the reason that they give is that if we do this everyone who wants to trade illegal materials 00:11:07.333-->00:11:12.375 would just go and flip one bit in them and then all of our hash values wouldn't be uh any good 00:11:12.375-->00:11:17.542 anymore and while that's true it works it's a two way street it wouldn't be any good for the 00:11:17.542-->00:11:22.500 people who are sharing either because they'd not they would not know if you were out on the 00:11:22.500-->00:11:26.125 internet and everybody, you know, claimed to have different files if the hash values, didn't 00:11:26.125-->00:11:30.708 match how would you know you were getting segments of the same file? So that reason is a 00:11:30.708-->00:11:35.708 little bit shaky to me. Um but even if everyone did flip bits in their files that would be so 00:11:39.000-->00:11:43.208 disruptive to the trade of contraband maybe you'd want that result anyway. Okay, the code 00:11:43.208-->00:11:49.958 must remain secret reason number 2. It would disclose the undercover investigators and 00:11:49.958-->00:11:54.542 here I think they're speaking kind of metaphorically. The the the metaphor that they use is 00:11:54.542-->00:12:00.625 well, you know, if we had um someone buried deep undercover in a drug cartel we would use 00:12:00.625-->00:12:05.750 information that they gave us and that's okay there's nothing wrong with that we wouldn't 00:12:05.750-->00:12:11.375 identify that person unless and until we absolutely had to. Um well this isn't quite like that 00:12:11.375-->00:12:17.792 I don't think uh but it but it's interesting. So I can think of two possibilities and they both 00:12:17.792-->00:12:24.250 revolve around the idea that we don't want one law enforcement inadvertently targeting agents 00:12:24.250-->00:12:28.083 of another law enforcement agency going out on the on the networking and seeing that these 00:12:28.083-->00:12:34.125 guys announced their sharing all of this stuff let's go pick on them. So possibility number 1 is 00:12:34.125-->00:12:38.917 that nodes know about one another there's some either central database or a list 00:12:38.917-->00:12:44.083 that's published of who's using this software and that that way you can identify your friend on 00:12:44.083-->00:12:49.083 the network and you don't go and and pick on them. Um this also is probably not part of the 00:12:49.083-->00:12:53.500 software itself but maybe the software contains the the means of obtaining that list or 00:12:53.500-->00:12:59.833 something. and that list really should remain secret we that that's a legitimate secret. Um 00:12:59.833-->00:13:03.917 but I I don't think that's it because from time to time they will give you the log file and 00:13:03.917-->00:13:09.125 that contains their IP address in it so that that doesn't make a lot of sense so the other 00:13:09.125-->00:13:14.292 possibility is there's something distinctive in the way the tool does its initial handshake so 00:13:14.292-->00:13:19.292 when the when the when the two peers connect, when two peers connect, they'll exchange some 00:13:19.292-->00:13:23.958 information usually uh it'll have a globally unique ID or something like that that it 00:13:23.958-->00:13:28.375 exchanges and there might be something unique in that handshake that would identify 00:13:28.375-->00:13:33.375 this as a non traditional uh peer to peer client. And I think that's a pretty likely guess. 00:13:35.917-->00:13:41.125 And I'll talk a little bit more about that because this is how the tagging feature works. 00:13:41.125-->00:13:47.375 Alright so we have some problems with not being able to look at this software and one of them is 00:13:47.375-->00:13:53.833 just the reliability of the software. Does it ever erroneously make a report? Well 00:13:53.833-->00:13:59.375 it's quite common I can tell you from my own experience consulting with attorneys it's 00:13:59.375-->00:14:03.792 quite common that investigators when they go and they seize a computer they don't find the 00:14:03.792-->00:14:08.167 files that they say they downloaded from that computer that happens well over half the 00:14:08.167-->00:14:13.833 time. There are two explanations for this possible uh one is the files weren't there in the first 00:14:13.833-->00:14:19.250 place and the report is wrong and the second is um they don't usually execute their warrants 00:14:19.250-->00:14:23.542 until months after they did the initial download so the files is not there anymore uh and that 00:14:23.542-->00:14:28.542 that's probably pretty likely but uh what we don't know is how many warrants have they obtained 00:14:33.250-->00:14:39.208 and executed that didn't result in an arrest. We don't see those, that's stuff that never 00:14:39.208-->00:14:43.417 makes it across and attorney's desk. And so we don't know so we don't know if there are false 00:14:43.417-->00:14:47.875 positives, we don't know it's the the tool's false positive rate and that I think is a 00:14:47.875-->00:14:53.083 worrisome thing. And the are there conditions under which it malfunctions? Well I'm here to 00:14:53.083-->00:14:56.875 tell you that software has bugs and um I mean we wouldn't even have this conference if that 00:14:56.875-->00:15:03.750 weren't true. [laughter] He's shocked! This is the first he's heard of it! I can't imagine why 00:15:03.750-->00:15:09.667 should think this particular software has less bugs than any other. And it might be useful to 00:15:09.667-->00:15:14.042 know what they are and there's been no review of this um the government just says yeah it 00:15:14.042-->00:15:19.042 works. The next problem is the standard for obtaining a warrant. In order to obtain a 00:15:21.208-->00:15:26.208 warrant you're supposed to establish probable cause that a crime might be committed. And 00:15:28.750-->00:15:32.792 this isn't technology by definition this isn't technology that's in the hands of the 00:15:32.792-->00:15:38.292 public there's a really interesting case from the turn of this century. Killo or Kyllo 00:15:38.292-->00:15:42.917 I'm not sure which it is vs United States where the uh the feds used a forward looking 00:15:42.917-->00:15:49.667 infrared radar to visualize what was going on inside of a house and the the supreme court said 00:15:49.667-->00:15:54.792 you needed to get a search warrant for that you can't just uh you can't just do this, this 00:15:54.792-->00:16:00.292 is stuff that's outside of what the public could could have they can't this it violates their 00:16:00.292-->00:16:06.042 reasonable expectation of privacy. Um and I think that's the case here too. That nobody 00:16:06.042-->00:16:10.333 thinks that there's a tool out there that does this and it's not in our hands we can't 00:16:10.333-->00:16:14.708 examine it, we can't see it. Um and again this is where the government tries to tell us that 00:16:14.708-->00:16:18.250 well this is just modified opens for software, any user could do the same thing. Well that's 00:16:18.250-->00:16:24.083 farcical, maybe any software developer could. But most users are not those. But it sort of 00:16:24.083-->00:16:28.833 raises the the supplementary question how would we know we were doing the same thing? If we 00:16:28.833-->00:16:33.333 can't see the tool to begin with? Yeah maybe we could, right? Maybe we could write any 00:16:33.333-->00:16:37.708 kind of software but how would we know it works the same way that the government one does? Um 00:16:37.708-->00:16:44.000 and that brings us also to tagging. Right now there are when you're using these tools 00:16:44.000-->00:16:47.625 there are shared areas on your computer so folders full of things that you're willing to 00:16:47.625-->00:16:50.250 share on the peer to peer network and then there's the rest of your computer which is 00:16:50.250-->00:16:55.250 supposedly off limits. When, the way that tagging works is in that initial handshake, the the 00:16:58.500-->00:17:03.875 law enforcement software will submit a blob of data that's gonna get written to a log file 00:17:03.875-->00:17:08.625 in in Gnutella that's the client dot net file. The list of clients that the thing is 00:17:08.625-->00:17:13.542 connected. That's not in a shared area of the computer and it contains now a blob of data 00:17:13.542-->00:17:17.417 that the government wrote and when later they come and look through the log they'll say Yep 00:17:17.417-->00:17:23.292 this is the one we wrote, it's encrypted with our our our key. Uh so is that something you 00:17:23.292-->00:17:28.958 should have to get a warrant for? I don't know ah that's a unlitigated um question right 00:17:28.958-->00:17:35.958 now - or there's been litigation but we haven't gotten a sensible result. Uh the next thing is 00:17:35.958-->00:17:40.708 what are the chances you're gonna find a judge who's able to tell if these statements are 00:17:40.708-->00:17:45.125 reliable that how IP addresses can be connected to subscriber identity how peer to peer 00:17:45.125-->00:17:49.417 networks work um how a government tool based on open source software works. Judges 00:17:49.417-->00:17:54.667 don't know this. They just get a 20 page warrant affidavit and they say "Ah, okay! Sign" Uh 00:17:54.667-->00:17:59.917 [laughter] cause they don't have a choice it's it's that or conduct a really serious 00:17:59.917-->00:18:05.417 investigation of their own and it's not gonna happen. Another thing is who's qualified to 00:18:05.417-->00:18:10.542 testify about how these tools work in court? You usually see the investigator who operated 00:18:10.542-->00:18:14.583 the software come and say this is what I did on this such and suchin night. But that person 00:18:14.583-->00:18:19.292 can't really explain, he's that person is trained in how to use the tool but doesn't necessarily 00:18:19.292-->00:18:24.583 know the inner functioning, you know, the the that the developer of the tool would know. Um so I 00:18:24.583-->00:18:28.417 I think testimony ought to require more than just knowledge about which button you click to 00:18:28.417-->00:18:34.500 make the single search download happen. And then of course again software ha-having bugs it might 00:18:34.500-->00:18:41.500 be exploitable ah to an a really enterprising person. Um you know the-these things we know, 00:18:41.500-->00:18:45.750 there's java based stuff, there's dot net based stuff, there's you know the the the 00:18:45.750-->00:18:50.750 clients that the the tools are derived from any bugs that those have this probably has two. Um 00:18:53.750-->00:18:58.750 and it may have it's own bugs too of course. And and one of the things that we've got here 00:18:58.750-->00:19:02.917 is the exploitation would probably go undetected because of this lack of transparency 00:19:02.917-->00:19:07.083 that we've got and because it's mostly not used by security professionals it's mostly used 00:19:07.083-->00:19:11.458 by investigators, and they might just not even notice if they're software crashes in a funny way 00:19:11.458-->00:19:18.292 one day. . Alright I have I think about one minute left, ah I would uh uh yep okay I have 00:19:18.292-->00:19:24.708 one? One. Ah So I could do like a question if somebody's got one. [pause] No? Alright well 00:19:24.708-->00:19:29.708 thank you very much and thanks for coming to my talk! [applause] See you again, soon! 00:19:33.625-->00:19:34.750 [applause]