Carnivore PPT
-
Upload
mansi-singh -
Category
Documents
-
view
158 -
download
0
Transcript of Carnivore PPT
Carnivore:Internet Wiretapping
MADHAVI MISHRA
PRIYANKA VIKRAMADITHYAN
MANSI SINGH
PRESENTED BY
Introduction
• Needs of the Law enforcement agencies
• Individual's privacy concerns
• Emerging technology
Goals
• To inform about the current technical, government, and public opinion state of U.S. Internet wiretapping policy through a case study of the FBI’s Carnivore system
• To discuss concerns about the current state of U.S. Internet wiretapping policy
• To propose changes to improve the U.S. system of Internet wiretapping
Executive Background
When does the FBI use Carnivore?• The ISP cannot narrow sufficiently the
information retrieved to comply with the court order
• The ISP cannot receive sufficient information• The FBI does not want to disclose information to
the ISP, as in a sensitive national security investigation.
Executive Background
Full mode wiretap
• Case agent consults with the Chief Division Counsel, and a Technically Trained Agent.
Pen mode wiretap
• Case agent writes up a request with a justification for necessity
Executive Background
• FBI shows a judge the relevance of the information
• FBI shows a judge why traditional enforcement methods are insufficient
• FBI submits a request with information such as target ISP, e-mail address, etc.
• FBI waits 4-6 months
Hardware Architecture
• A one-way tap into an Ethernet data stream• A general purpose computer to filter and
collect data• One or more additional general purpose
computers to control the collection and examine the data
• A ‘locked’ telephone link to connect the computers
Hardware Architecture
CarnivoreHub
RemoteHub
Tap
Ethernet Switch
Other NetworkSegments
The Internet
Target
Bystander
Software Architecture
Functionality
• Filtering
• Filter Precedence
• Output
• Analysis
Software Architecture
Software Architecture• FilteringFixed IP Can choose a range of IP addresses.
Dynamic IP If not in fixed IP mode, one can choose to include packets from in either Radius or DHCP mode.
Protocol Filtering One can choose to include packets from TCP, UDP, and/or ICMP in either Full mode, Pen mode, or none.
Text Filtering One can include packets that contain arbitrary text.
Port Filtering One can select particular ports to include (i.e 25 (SMTP), 80 (HTTP), 110 (POP3)).
E-mail address Filtering
One can select to include packets that contain a particular e-mail address in the to or from fields of an e-mail.
Software Architecture
• Filter Precedence• Output
– .vor– .output– .error
• Analysis– Packeteer– CoolMiner
Software Architecture
• TapNDIS (written in C) is a kernal-mode driver which captures Ethernet packets as they are received, and applies some filtering.
• TapAPI.dll (written in C++) provides the API for accessing the TapNDIS driver functionality from other applications.
• Carnivore.dll (written in C++) provides functionality for controlling the intercept of raw data.
• Carnivore.exe (written in Visual Basic) is the GUI for Carnivore.
CONTROVERSIES
• Pen mode collection– Not strictly defined.– Low standard for obtaining a court order for the
interception of this information.– Reporting of pen mode interceptions is
minimal.
CONTROVERSIES
• Minimization of interception:– No formal definition of minimization of search
requirements.– The minimization process only has optional
judicial review.– No requirements on who conducts the
minimization.
CONTROVERSIES
• FISA interceptions:– No notification requirement, unless information
from the intercept will be used in a criminal trial.
– Completely confidential, the only information reported annually is the number of applications and the number of orders granted.
DISADVANTAGES
• Trust
• Ease of access
• Loss of ISP control
• Procedural
ANTIVORE
Antidote to Carnivore. Developed by Chain Mail Inc.-
software firm, Virginia,US. To secure corporate data. Used to encrypt users e-mail messages.
Technical Concerns
• Problems– Wrong goals– Bad implementation
• Hidden functionality
Technical Problems: Wrong Goals
• No structured development process
• No audit trails
• Limited security of data
Technical Problems: Bad Implementation
• Problems with high throughput
• Standard Ethernet v. Full Duplex
• Security of remote computer
• Thwarted by crypto
• RADIUS (analysis omitted from Illinois Report)
Hidden Functionality
• TapAPI provides 45 entry points callable from Carnivore.dll, only 22 are used.
• Commented out code: more sophisticated filters, real-time viewer, case tracking
Public Policy Proposals
• Trust
• Ease of access
• ISP control
• Public awareness
Technical Proposals
• Get goals right
• Open source code
• Tamper-proof the local data
• Provide secure remote configuration
• Auto-post logs to website
Conclusion
“If you’re talking to someone in the next bathroom stall, the government shouldn’t have to be able to listen in.”
– Robert Ellis Smith
Publisher, Privacy Journal
THANK YOU!!THANK YOU!!