Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
IT

Darknets Coming Soon? 288

Posted by CmdrTaco from the something-to-think-about dept.
Anonymous Stalwart writes "CIO.com is running a story on darknets and their implications for security. With the ruling against Grokster, darknets seem poised to become a reality. How this will impact the future of the workplace, from top-level IT/IS managers all the way to non-IT jobs will depend on how the tech community that is developing this technology treats it."
This discussion has been archived. No new comments can be posted.

Darknets Coming Soon? More

Darknets Coming Soon?

Comments Filter:

  • Ok, real response (Score:5, Insightful)

    by LiquidCoooled ( 634315 ) on Sunday November 13, 2005 @09:36AM (#14020013) Homepage Journal
    Shouldn't the first sign "something" is up be an increase in bandwidth?
    Once you know its happening, you know you have to identify the problem.

    Unless somebody can root all the routers and IDS systems for every OS along the way, these darknets will always be detectable.

    • Re:Ok, real response (Score:3, Insightful)

      by agraupe ( 769778 )
      Even if the darknets are detectable, it still won't be possible to monitor traffic on them. There is still the matter of encryption that will provide relative security to the users.

      • Re:Ok, real response (Score:3, Interesting)

        by Tim C ( 15259 )
        Not in the corporate environment - the IT department will simply challenge you to explain why you're using so much more bandwidth than anyone else. If you can't, you either stop or face disciplinary action. At my company that sort of thing could possibly be grounds for sumamry dismissal; ymmv.

        • Re:Ok, real response (Score:4, Insightful)

          by 1u3hr ( 530656 ) on Sunday November 13, 2005 @10:53AM (#14020313)
          ot in the corporate environment - the IT department will simply challenge you to explain why you're using so much more bandwidth

          TFA was focused on corporate espionage, which wouldn't necessarily consume huge bandwidth. Besides corporate types thnk nothing of sending huge files (video presentations, eg) around, so even sneaking out big files wouldn't necessarily make a blip. Of course, USB dongles and such are a much easier and right-now threat in that regard.

          • Re:Ok, real response (Score:2, Interesting)

            by Anonymous Coward
            Not. Most corporate types don't even allow end-to-end internet connectivity onto their networks. They force all email traffic to go through particular relays that scan for viruses, and depending on the industry, check for specific classes of keywords, and block mail to certain domains. They block any email over certain sizes or to too many recipients.

            A friend was streaming music at his new job recently. In less than a day they came to find out what he was doing. His 128kbit stream was 30% of the total bandw

            • Re:Ok, real response (Score:4, Interesting)

              by crazyphilman ( 609923 ) on Sunday November 13, 2005 @04:56PM (#14022064) Journal
              Umm... NO.

              Unless you are actually ENGAGED IN RACKETEERING, you will not be charged with it. Wielding the equivalent of a Captain Midnight Secret Decoder Ring is still not illegal.

              Here's some clarification of "racketeering" from Dictionary.com:

              Main Entry: racketeering
              Pronunciation: "ra-k&-'tir-i[ng]
              Function: noun
              1 : the extortion of money or advantage by threat or force
              2 : a pattern of illegal activity (as extortion and murder) that is carried out in furtherance of an enterprise (as a criminal syndicate) which is owned or controlled by those engaged in such activity --see also Racketeer Influenced and Corrupt Organizations Act in the IMPORTANT LAWS section --compare ORGANIZED CRIME

      • But that's not a problem for IT managers (Score:4, Insightful)

        by Sycraft-fu ( 314770 ) on Sunday November 13, 2005 @03:44PM (#14021708)
        If you are doing traffic on our network that I need to know what it is, I'll go to your computer and check. In a managed environment, like a corperation, you don't have privacy of your data. You can encrypt traffic, and should (we fight all the time to get the last few telnet users to switch to SSH) but that's to keep random malicious users out, not your IT staff. Your IT staff can come and ask to see what's happening on your computer and "no" isn't a legit answer, as the computer is company property.

        I personally don't see any problems with Darknets that didn't already exist with SSH. If I work in an environment where we don't care what you do, unless it's a problem, then we'll ignore your traffic unless it's excessive. If I work in an environment where we restrict what you can do, then we'll monitor your traffic and if we see unknown encrypted traffic, you'll be asked what it was and your computer will be checked.

        So I see Darknets as a problem for the RIAA maybe, and frankly I don't give a shit about them, but not for corperate IT.
      • "Even if the darknets are detectable, it still won't be possible to monitor traffic on them."

        No, but if darknets are detectable, I can just not pass the traffic. Or, perhaps, simply give the packets an exceedingly low priority.

        So yeah, you might get your downloaded music... eventually.

    • Re:Ok, real response (Score:5, Insightful)

      by l3v1 ( 787564 ) on Sunday November 13, 2005 @09:41AM (#14020026)
      The point is not hiding the network's existence, but hiding the traffic and the data itself. No use in you yelling "something's going on here" if you have no clue what it is.

    • Re:Ok, real response (Score:5, Insightful)

      by Kjella ( 173770 ) on Sunday November 13, 2005 @09:50AM (#14020058) Homepage
      Unless somebody can root all the routers and IDS systems for every OS along the way, these darknets will always be detectable.

      Technically, they can look like any kind of encrypted connection, HTTPS, SSH or whatever. Besides, I think the idea of Darknets is flawed to begin with. It is taking current anonymous P2P networks (Freenet, Ants, I2P etc.) and tying both hands behind their back by no longer allowing all-to-all connections, but only connections to people you trust. That pretty much precludes any sensible routing and load balancing because people are selecting the available routes, and you can't create new connections. Say you are the only person with access to two different social groups, all info must flow over your connection creating a huge bottleneck that the software is not allowed to compensate for.

      • Re:Ok, real response (Score:5, Informative)

        by archeopterix ( 594938 ) * on Sunday November 13, 2005 @10:07AM (#14020116) Journal
        Besides, I think the idea of Darknets is flawed to begin with. It is taking current anonymous P2P networks (Freenet, Ants, I2P etc.) and tying both hands behind their back by no longer allowing all-to-all connections, but only connections to people you trust. That pretty much precludes any sensible routing and load balancing because people are selecting the available routes, and you can't create new connections. Say you are the only person with access to two different social groups, all info must flow over your connection creating a huge bottleneck that the software is not allowed to compensate for.
        This is true as the implication of "invite-only". There is, however, a middle ground between the current p2p mainstream and true darknets - encryption + origin hiding routing (onion or ants routing), but no invite-only. MUTE [sourceforge.net] is like this.

      • Not Really (Score:5, Informative)

        by IBitOBear ( 410965 ) on Sunday November 13, 2005 @10:46AM (#14020282) Homepage Journal
        Actually, If you establish the DarkNet in the right way, once you are connected to a trusted node you could connect to any other node by passing authentication and encryption keys the long way. This would allow for dynamic (re)routing.

        Think of an IRC style web. Basically, a properly designed network would allow one party to inform another that it wanted to make a connection. Then it would make that connection. By pre-passing the keys and proof of identity, you would be able to make arbitrary connections within a "closed surface" of the net.

        ===

        What I have been waiting to see make a comeback is the good old fashioned POTS modem. With all the internet wire-tap laws being generally weaker than the phone tapping laws, it would _really_ make sense to transfer authentications (etc) through a old-fashioned BBS style "drop sites" that were not really on the net.

        So you downloaded some particular binary splash. To turn it into the song or whatever you would have to go get the key/completion-tidbit. Heck, the actual directores could be encoded so you _couldn't_ know what you were passing unless you were also in on the sideband/drop-site.
        • Actually, If you establish the DarkNet in the right way, once you are connected to a trusted node you could connect to any other node by passing authentication and encryption keys the long way. This would allow for dynamic (re)routing.

          At which point, you either have a) no scalability (all must trust all) or b) no trust, which negates the entire point of the darknet. Do you trust the friend of a friend of a friend of a friend of a friend or a friend? You've essentially reverted back to current P2P networks w

          • Scalable Trust Levels (Score:2, Interesting)

            by Anonymous Coward
            At which point, you either have a) no scalability (all must trust all) or b) no trust, which negates the entire point of the darknet

            Recognizing that there is no such thing as an entirely trustworthy network (unless you know and implicitly trust each individual involved, and their security) couldn't you just implement a scalable trust level? By this I mean limiting the number of hops, or degrees of separation from who you implicitly trust (your 'friends'), to who they implicitly trust, and so on to the unkn

        • Re:Not Really (Score:3, Interesting)

          by Reziac ( 43301 ) *
          I've been saying for some time now that for secure email, an old-fashioned dialup BBS, with a known and trusted sysop, is one helluva lot more secure than any internet-based email.

          The BBS's sysop is god, he sees all. But on a dialup BBS, no one other than the sender and recipient can see the content of a given local email. (Barring subpoena, of course.)

          Conversely, any node along the internet could intercept and have its way with regular internet email packets.

          Nasty thought: you've got BBS software on your c
          • Problem with this is getting email from outside sources. A BBS would be a great system for local communications, or a small trusted network.

            I really hope that a solution like this takes off, I miss the BBS scene, perhaps we can find some way to make FIDOnet and doors into a trusted scheme too. Seriously though the BBS idea is great, with the execption of the Sysop, I've been on many a board (back in the day) that ran into troubles when the Sysop either lost interest, or got pissy. Is there a way to devel

            • Re:Not Really (Score:3, Informative)

              by Reziac ( 43301 ) *
              For email from outside sources -- well, most halfway modern BBS software (defined as 1994 or later) can do internet email via UUCP, and the more recent incarnations use TCP/IP (and can do QWK/REP by regular email).

              Otherwise, and for maximum snoop-proofing against external forces, one has to be willing to make the phone call to transfer mail (both by users and BBS-to-BBS), which may involve a long distance call, and as with FIDO, often a considerable delay as packets hop from one BBS to the next. (As the old
          • Forgot to say, pirate/warez boards are as old as BBSs. Nothing really new.

    • Re:Ok, real response (Score:5, Interesting)

      by mr_z_beeblebrox ( 591077 ) on Sunday November 13, 2005 @09:51AM (#14020066) Journal
      Shouldn't the first sign "something" is up be an increase in bandwidth?

      Try monitoring a campus network where you have several thousand users and an obscenely large amount of bandwidth. Oh, and you have live research data being generated on campus and moved to places like the NCSA etc... Bandwidth consumption may vary by tens of megabytes by the minute. So I ask you, in that situation (which I work in) what is an "increase in bandwidth" a sign of?
      I don't understand why this article has such a tin foil hat slant to it. Darknets tell nothing about acceptable use, they primarily identify malware and misconfigurations.
      • I don't understand why this article has such a tin foil hat slant to it. Darknets tell nothing about acceptable use, they primarily identify malware and misconfigurations.

        Well, TFA took over 10 minutes to load so now that I have RTFAd I guess the darknets to which I refered are different than the author. However, the bandwidth comment stands.

      • Re:Ok, real response (Score:4, Interesting)

        by Florian Weimer ( 88405 ) <fw@deneb.enyo.de> on Sunday November 13, 2005 @10:48AM (#14020298) Homepage
        Try monitoring a campus network where you have several thousand users and an obscenely large amount of bandwidth.

        I have done this and it is much easier than you think. Warez traffic (let's drop this "darknet" term, I always think that it's an end-user-empowered network run over dark fibers) doesn't follow the typical 24-hour cycle in the traffic pattern. The number of legitimate hosts with such a traffic pattern is pretty small in my experience, so it's quite possible to spot the offenders.

        Of course, as a network admin, there isn't much you can do when the host admin says that periodic transfers of multiple GB are perfectly legitimate and done for research purposes. But detection is not the real obstacle.

        Part of the real issue is that so much traffic on research networks is filesharing and warez crap. If you started to enforce an AUP, the bandwidth would drop to minuscule levels, and you wouldn't have any plausible justification whatsoever for those fat pipes. And people feel they need them because of the dick size wars at some research conferences.

        • Part of the real issue is that so much traffic on research networks is filesharing and warez crap. If you started to enforce an AUP, the bandwidth would drop to minuscule levels, and you wouldn't have any plausible justification whatsoever for those fat pipes. And people feel they need them because of the dick size wars at some research conferences.

          In other words, massive copyright infringement drives the demand for more bandwith, which drives research, investment and competition, benefitting the societ

          • Re:Ok, real response (Score:4, Insightful)

            by Florian Weimer ( 88405 ) <fw@deneb.enyo.de> on Sunday November 13, 2005 @12:35PM (#14020823) Homepage
            In other words, massive copyright infringement drives the demand for more bandwith, which drives research, investment and competition, benefitting the society enormously in the form of better technology (both communication and processing, since you need processing power for routing), better communication infrastructure, and cheaper prices for both. I see this as yet another reason for weaker, not stronger, copyright laws.

            Interesting line of thought. But I don't think it's compelling. Contemporary file sharing protocols (especially the search component) are often rather inefficient. Making file sharing clearly legal would make it possible to offer more centralized services supporting it (where it makes sense), which would increase efficiency and reduce bandwidth usage.

            On the other hand, if you outlaw file sharing completely and enforce it rigorously, as a user, you'd have to tunnel all file sharing traffic over secure anonymization networks (similar to what Tor does). Each packet would run back and forth through the network, in order to obscure its sender and receiver, tremendously increasing bandwidth requirements. So, following your argument, truly fascist copyright laws would advance networks even more.

        • Re:Ok, real response (Score:3, Interesting)

          by Hast ( 24833 )
          I agree with you that it's quite easy to monitor data, even on the scale we see here. And let's be clear, there is no need to actually monitor the data. You only need to monitor the amount of data in order to find these darknets. Furthermore, even if you sometimes fail to achieve 100% of data logging that doesn't matter since you'll randomly drop packets from your data loggers and thus the darknets will still shine like beacons of bandwidth. One trick is to look for bandwidth during the off-hours. Typically
      • Try monitoring a campus network where you have several thousand users and an obscenely large amount of bandwidth. Oh, and you have live research data being generated on campus and moved to places like the NCSA etc... Bandwidth consumption may vary by tens of megabytes by the minute. So I ask you, in that situation (which I work in) what is an "increase in bandwidth" a sign of?

        Effective monitoring is actually quite achievable with freely avalible software.

        On a properly managed network you should be able to t
        • Once you have profiling data for a given port or IP on your network, all you need to do is send a trigger to the switch/router/DSLAM/etc.

          Is that all you need to do? Ok, as I pointed out it is a university. People pay to be on that network. People who do things that you may find unacceptable are given grants to do those things. This means that when ou see 'bad' traffic, a certain amount of institutional knowledge has to be applied and perhaps investigative skills to determine if said traffic is bad or not

      • If you want to try monitoring your high-bandwidth campus network let me recommend our open source solution, Ourmon [pdx.edu]. We've been using it for several years with good results.

        • If you want to try monitoring your high-bandwidth campus network let me recommend our open source solution, Ourmon. We've been using it for several years with good results.

          I might take a look at that, but for clarification I didn't mean to imply that we can't monitor the network. My point was simply that a 'blip' in bandwidth is in and of itself meaningless and not 'the way' to monitor.

    • these darknets will always be detectable.

      While technically true, and usually is you can't tell what is going down the darknet. All you might get is a pair of IP address and quantity of traffic. So far many popular darknet's do not use crypto but many do. It is as simple as IPSec between two or more points. In fact, it is possible today to setup a completely private virtual network of friends over the internet by just configuring the operating environment.

      Here is the problem for authorities and I/T se

    • Shouldn't the first sign "something" is up be an increase in bandwidth?

      Thats also the sign of a new spam source, or a new exploit in the wild, or that your little brother just discovered bittorrent. All it has to do is remain below the level of the rest of the noise out there.
    • Well, one option would be to go with wireless MANs (tech has caught up to the point where l0pht's guerrilla net is now feasible on a pretty large scale) as the intracity transfer network, and which used a whole bunch of hosts on the MAN as ingress/egress points to the larger Internet.

      Traffic modeling could be used to insure that the traffic sent across the Internet is not only encrypted, but that it looks like some other sort of traffic (fake game server or web cam traffic or something, anything that has pa

  • Dark Ambition (Score:5, Informative)

    by Doc Ruby ( 173196 ) on Sunday November 13, 2005 @09:41AM (#14020025) Homepage Journal
    The "Grokster" ruling says that network operators can be liable for users illegal network abuse when operators promote abuse. It's a stupid ruling, but limited. And its standards for proving promotion are unfounded, really allowing just "appreciation" of abuse, without any evidence of public promotion. But operators which do not include even internal organizational acceptance of abuse, which promote only legal use, which offer even minimal protections of abuse, rather than any internal corporate policies which rely on the abuse, are not threatened. The sloppy evidential and jurisprudential standards in that landmark ruling will make it much more expensive for legit operators to remain safe, as they're sued willy-nilly by vengeful media corporations. But the mass media story that "P2P is now illegal" ought to get no promotion on geek sites like Slashdot. If you're going to run a darknet, why not just leave out the abuse promotion, and let your P2P flag fly?

    • Re:Dark Ambition (Score:5, Interesting)

      by theonetruekeebler ( 60888 ) on Sunday November 13, 2005 @10:08AM (#14020117) Homepage Journal
      With due respect, it's not a particularly stupid ruling. Grokster did in fact promote its product as a way of doing something illegal. The Supreme Court agreed that doing so exposed them to liability. If Sears/Craftsman promoted its crowbars as "The Burglar's Best Friend," they'd be liable for that, right? If Louisville Slugger had a booth at the local skinhead rally, promoting its bats as the perfect fag-bashing tool, they'd be liable for that, too. It's that simple---promote an illegal use, accept responsibility for illegal use. Why shouldn't Grokster be liable for promoting the illegal use of its products?

      I have no problem with uniformly enforcing product liability laws. My problem is with the insanity of today's copyright laws. TFA was very sloppy starting off with a falsehood like

      The Supreme Court might have stirred up a bigger problem than it settled when it ruled last June that file-sharing networks such as Grokster could be sued if their members pirated copyrighted digital music and video.

      The Supreme Court said no such thing. But the RIAA/MPAA will of course do everything they can to take a mile from this very straightforward inch.

      • Re:Dark Ambition (Score:5, Interesting)

        by Doc Ruby ( 173196 ) on Sunday November 13, 2005 @10:55AM (#14020323) Homepage Journal
        The Supreme Court found that Grokster "promoted" abuse solely on evidence that Grokster employees planned to use growth from abuse in scaling their network, and considered ways to use that abuse. They did not find any evidence that Grokster publicly promoted abuse. They found "intent" by a corporation, which is not a person who can "intend" (even if you believe that a person's intent can ever be proven). Hence my comment that Grokster "appreciated" abuse, but did not promote it.

        I don't believe that people who promote illegal acts, whether advertising products or mere advocacy, are liable for the actions of those who take them up on their promotion. I do believe that their free speech can be found to be contributory, a lesser liability, when they have either demonstrated expectations of satisfaction of their promotion, clearly reasonable expectations, willful neglect of developing prior expectations, or even negligent passive ignorance of such expectations. Yelling "fire" in a crowded (nonburning) theater is a lesser crime than shoving someone down the stairs. Liability, especially liability for speech to people with freedom of choice, is not quite so simple. The Supremes have made such speech even more complicated, by ignoring its absence, and finding liability where criminals act without even the speech, just the benefit. That's an economic argument, but not a legal one. And the economics of the industry now employ the prohibitive expense to keep new distributors they don't control out of the competition. With the Court as their enforcer.
        • They did not find any evidence that Grokster publicly promoted abuse. They found "intent" by a corporation, which is not a person who can "intend" (even if you believe that a person's intent can ever be proven).

          Hm. With that kind of logic, I guess gun some gun manufactures [bradycampaign.org] could be found libel.

          :w
  • by prosecuting unencrypted networks like eDonkey, bittorrent, etc. they're only enforcing users to search for encrypted ways to transmit data. And I don't think encouraging encryption is gonna be any good for national security.

    Just a thought.

  • Darknets? Blame the RIAA!!! (Score:5, Insightful)

    by ThatGeek ( 874983 ) on Sunday November 13, 2005 @09:45AM (#14020039) Homepage
    Well, only 3 comments posted, and the link is already hosed.
    As reported by Darknet dot com [darknet.com], a darknet is nothing more than a place where illegal communication (filesharing/hacking talk/speaking badly of the US president) can take place.
    I don't see how darknets will make things any different. For years we've had gopher, IRC and other communication channels that have been below the vision of the management elite.
    I think lawyers are starting to learn that techies can't be bullied as easily as most, because techies are able to build new infrastructures. Instead of giving up, techies take threats as a challenge or motivation to dive further and further away from public vision.

    • Not necessarily illegal (Score:4, Insightful)

      by Ritz_Just_Ritz ( 883997 ) on Sunday November 13, 2005 @09:51AM (#14020063)
      A Darknet is a private virtual network where users only connect to people they trust. That's it. It can be used for good or evil.
    • >> a place where illegal communication (filesharing/hacking talk/speaking badly of the US president) can take place

      Oh, a place like say... /.?

    • I think lawyers are starting to learn that techies can't be bullied as easily as most, because techies are able to build new infrastructures. Instead of giving up, techies take threats as a challenge or motivation to dive further and further away from public vision.

      while lawyers otoh, get paid by the hour. sit back and grab a beer, this fight ain't going nowhere.

      seriously, it's like the cold war, it's against lawyers interests for either side to win, endless escalation is killer for billable hours. this kin

      • Re:Darknets? Blame the RIAA!!! (Score:4, Interesting)

        by ScrewMaster ( 602015 ) on Sunday November 13, 2005 @11:00AM (#14020338)
        blame the US for producing way too many of the vermin.

        That's the most reasonable bit of U.S.-bashing I've heard yet on Slashdot. At least you didn't single out all of us as being warmongers or evil or Bush-lovers or whatever. And you're right: we're becoming a remarkably litigious society. Not that I have any idea how to cure the problem.

        But your average corporate attorney isn't the problem, he or she is simply a tool, and a symptom of a larger problem. It is bad law, admittedly written by a bunch of lawyers (collectively known as "Congress"), combined with corporate executives who see nothing but dollar signs. Corporate lawyers just don't sit around suing people and companies for fun: somebody has to pay them to do it, and pay them handsomely. Those people are the ones you need to worry about.

        You know, like the good folks in charge of Lexmark, Diebold and DirecTV. Laws like the DMCA just gave them an opportunity to put their lawyers to work. All Congress did was give a loaded gun to a bunch of idiots.
        • we're becoming a remarkably litigious society. Not that I have any idea how to cure the problem.

          The obvious, if paradoxical, solution is to sue anyone prepared to resort to litigation....

          Um...

          I'll get my coat
        • If you want to find a true culprit behind the proliferation of greedy lawyers, blame Nader. The bastard is nothing but a trial lawyer disguised as a human being ...

        • I am told that the main difference between common law (as used in the USA and most former Brittish colonies) and civil law (as used in most of the Rest of the World) is that common law places more emphasis on precedent, whereas civil law places more emphasis on written law. Precedent is a lot vaguer and a lot less organized than written laws. Thus, it's harder to predict the outcome of a suit without trying under common law than it is under civil law.

          Another thing that sets the USA apart in a legal sense is
    • You can speak badly of the president all you want in any public forum. That falls under the prime First Amendment right: freedom of speech. However, it's a whole different ballgame if you start making direct threats to the safety of the president.

      Of course, I'm assuming you're talking about the United States. Other countries with a president as head of state may not have the same freedom of speech clauses in their governing documents.
    • Why is everybody acting like these "darknets" are some new and dangerous threat? Christ, the Lockheed Martin guy sounds like he's angling for a job in the Bush administration.

      Just because some random article suddenly applied a new word to a private invitation-only network of individuals doesn't make them new. In the mid-90's when I first went online, I would (try to) hang out with the hacker/phreaker/warez types. Because a lot of what they did was illegal (and btw, they got punished back them just as they d

      • Re:not a new thing! (Score:3, Interesting)

        by shmlco ( 594907 )
        "Darknets" have always been around and always will. By their very nature, you don't see them. You can't tell how many there are, and you certainly don't know what's going on inside them because you won't get invited without proving that you're one of them first.

        Sorry, but if you're using the same network and infrastructure as the rest of us then those connections can be monitored, your endpoints mapped, and your packets and traffic patterns analyzed.

        I'm quite sure, however, that the NSA appreciates your

    • I don't see how darknets will make things any different. For years we've had gopher, IRC and other communication channels that have been below the vision of the management elite.

      Dude. If gopher [wikipedia.org] is the only way you can support your argument, no matter what that argument is, you really need to reevaluate your position :-)

      But seriously. The US Government was one of the biggest supporters of Gopher. I'd hardly call that 'below the vision'.

  • Article Text && Coral Cache URI (Score:5, Informative)

    by Anonymous Coward on Sunday November 13, 2005 @09:53AM (#14020072)
    http://www.cio.com.nyud.net:8090/archive/110105/tl _filesharing.html [nyud.net]

    ---
    FILE SHARING
    Spies in the Server Closet
    BY MICHAEL JACKMAN

    The Supreme Court might have stirred up a bigger problem than it settled when it ruled last June that file-sharing networks such as Grokster could be sued if their members pirated copyrighted digital music and video.

    Since then, some programmers have announced they would pursue so-called darknets. These private, invitation-only networks can be invisible to even state-of-the-art sleuthing. And although they're attractive as a way to get around the entertainment industry's zeal in prosecuting digital piracy, they could also create a new channel for corporate espionage, says Eric Cole, chief scientist for Lockheed Martin Information Technology.

    Cole defines a darknet as a group of individuals who have a covert, dispersed communication channel. While file-sharing networks such as Grokster and even VPNs use public networks to exchange information, with a darknet, he says, "you don't know it's there in the first place."

    All an employee has to do to set one up is install file-sharing software written for darknets and invite someone on the outside to join, thus creating a private connection that's unlikely to be detected. "The Internet is so vast, porous and complex, it's easy to set up underground networks that are almost impossible to find and take down," says Cole.

    He advises that the best--and perhaps only--defense against darknets is a combination of network security best practices (such as firewalls, intrusion detection systems and intrusion prevention systems) and keeping intellectual property under lock and key. In addition, he says, companies should enact a security policy called "least privilege," which means users are given the least amount of access they need to do their jobs. "Usually if a darknet is set up it's because an individual has too much access," Cole says.

    ---
    • There is no technology reason that I know of why someone would need a invatation only darknet to practice their right to share information freely. But this is the exact kind of orginisation that government people are trained to infilterate. The government is notorious for creating, or infilterating various gangs or club like groups so they can draw in suckers and arrest them in big sting opperations from time to time to justify their over paid budget.

      This method also has the advantage of not hooking peopl

  • Darknets (Score:5, Interesting)

    by ledow ( 319597 ) on Sunday November 13, 2005 @10:01AM (#14020100) Homepage
    For those that are asking, a darknet is used in this context as a closed P2P system (i.e. you, your mates, your mates' mates and others by invitation only sharing what you have with each other over the internet).

    Reminds me of something me and my brother used to do. We wanted to play a game online over the Internet but didn't want to sign up to yet-another online gaming service (The Zone or something it was called). We both had legit copies of the game, we both had internet connections and we just wanted to play online against each other. We couldn't do a straight TCP/IP connection for some reason or another so the only options left in the software were LAN, Modem or this Zone thing.

    So what we did was set up PPTP between our routers, assigned nearby IP addresses on both sides that routed across the connection and played a "LAN" game over the Internet. As far as I can see this was a type of darknet if you like.

    If we'd had non-legit copies, many games of the era would let you plan LAN without the CD so long as one player had the CD but not across the Internet. Or, say we'd cracked or VirtualCD'd the CD so that neither of us had a legit copy but could still play online. Then this sort of "PPTP darknet" would be used to let groups of friends without the legit CD to play over the Internet without needing the authorisation or intervention of the person running the gaming servers.

    A further thought, bringing it up to the modern day, would suggest that things like Steam could be played over this sort of "PPTP darknet" as a LAN game (connecting to PC's spread over the internet, all disconnected from the "real" internet and bypassing restrictions on who / what is allowed to play)?

    It's a interesting idea, sort of like a hidden black market for the internet (which I'm assuming is where the name comes from). As companies crack down on people lending movies to their friends and similar other quite legitimate activities, things like this are going to appear, translated from the real world where this happens all the time to the Internet.

    It seems to me that these sorts of things have existed for a while, though. I've heard that things like paedophile rings are already using such tactics? Detection is much, much harder than for a centrally administered P2P network. The only way to detect is to infiltrate the network itself, which is basically social engineering?
    • Well, if I read it like you then this is basicly a no-news item. If Darknet == private network, then it is essentially nothing more than existing solutions going back as far as "social" p2p networks in the 1970s, one sends by irc to another by e-mail etc. I believed Darknets were to provide an anonymous network on top of trusted peers (your friends). Networks that are only private do nothing if they don't prevent going "upstream". Imagine the RIAA going "Ok, cooperate with us and turn in your peers for a no

  • They'll Never Learn! (Score:5, Insightful)

    by TheZorch ( 925979 ) <thezorchNO@SPAMgmail.com> on Sunday November 13, 2005 @10:15AM (#14020141) Homepage
    You can't teach the RIAA anything. They think they can stop P2P file sharing but the truth is all their legal efforts are driving it underground...where it was before Napster appeared.

    There are a lot of very talented techies out there who can come up with some astonishing new tech. A fully encrypted P2P service that masks a user's IP address would make it hard for "the man" to find those who are illegally filesharing. Also, the hacker community can adapt to changing situations faster than any corporation. This is because they aren't hindered by office politics, ethics, patant and copyright compliance and legal compliance. They operate above the law, so it was really no surprise to me when Slashdot ran the story of the trojan that exploited the cloaking ability of Sony's DRM.

    I wasn't surprised one bit.

    Because of Grokster and others the RIAA bring down a new, bigger, and better P2P service will emerge with multiple layers of custom encryption, IP address masking, and no central server that can be distrupted. You could even block ports at the ISP level and they'll adapt again to support multiple ports at once. Its a loosing battle they just don't get it yet.

    Why do you think Internet Security and Antivirus Industies are racking in so much money these days. They DON'T want to see the hacker put in jail because if all the security threats cease and no more viruses are being made they are all out of a job. It a multi-billion dollar industry.

    The RIAA is utter and completely out of their league.
  • ...treachery. Seriously. If they can't go through a public channel to find wrongdoers (that is, to find unprofitable conditions), they will start using undercover agents to befriend and betray their way into darknets. So basically they'll have spies pose as college students then coaxing real students into inviting them into the henhouse.

    Hell, they'll probably set up a few darknets of their own, as "loss leaders" in their quest to fuck as many people out of as much money as possible. And they'll start

  • It's the way things were and they way they should have stayed. p2p has been a huge mistake, finally giving authorities and companies good reasons to invade the net, attempt to control it, and even put rootkits on our media [slashdot.org] to "protect" it.

    Small affinity groups always have and always will be more successful at this type of activity than the general public, even when "competition" from the public draws attention, making it difficult for everyone.

    Honestly, I love watching p2p networks fall.

  • Wrong Premise (Score:5, Interesting)

    by RAMMS+EIN ( 578166 ) on Sunday November 13, 2005 @10:39AM (#14020241) Homepage Journal
    From TFA:

    ``The Supreme Court might have stirred up a bigger problem than it settled when it ruled last June that file-sharing networks such as Grokster could be sued if their members pirated copyrighted digital music and video.

    Since then, some programmers have announced they would pursue so-called darknets. ... And although [darknets are] attractive as a way to get around the entertainment industry's zeal in prosecuting digital piracy, they could also create a new channel for corporate espionage''

    Am I the only one who thinks that if darknets are attractive vehicles for corporate espionage, they would be built no matter what the Supreme Court rules on filesharing?
    • They would have come eventually. The question is one of timing...and general usage. If they aren't widely used, then those seriously trying to hide (national and corporate espionage, e.g.), won't use them for even low sensitivity communications. If they are widespread, then they will be widely used (though perhaps only in coded form) for things that aren't too revealing.

      It would seem quite easy to use a more secure method of encryption (say a one time pad), and hide the message by sending it over a darkn

  • Two definitions (Score:3, Informative)

    by michaelmalak ( 91262 ) <michael@michaelmalak.com> on Sunday November 13, 2005 @10:39AM (#14020245) Homepage
    As usual, a Slashdot story summary haughtily uses new jargon without defining the term. So as usual, I go to Wikipedia to look it up. It seems there are two definitions [wikipedia.org].

    One definition is an encrypted protocol over the Internet. The other definition is using wireless technologies off the Internet. Oddly, the person quoted in the CIO article was trying to claim that encrypted, closed file sharing over the Internet was nothing like a VPN. That makes no sense to me, especially given the other definition of a darknet (the wireless one off the Internet) really is nothing like a VPN.

    A wireless-off-the-Internet darknet could serve Thomas Paine purposes if the U.S. government ever shuts down the Internet in response to a terrorist attack. An encrypted, closed information sharing network on the Internet could not.

    • "A wireless-off-the-Internet darknet" Sounds like the mesh network that those MIT(?) kids setup in the offcampus housing to provide internet access. Even if the net connection gets cut, they've still got a really big wireless LAN to play around in.
  • I'm talking about snailmail. If it gets right down to it you can fall back to this time honored completely private way of transporting any files you wish to share. It also has the advantage of carrying a federal criminal violation against anyone who attempts to stop your mail. If things gat so bad in this country that even this becomes too troublesome we can all move to eastern europe or china as they will become the beacons of freedom much as our country used to be.
    • You're really talking about a SneakerNet. "the bandwidth of a station wagon full of HDs" The FBI can request (for National Security) that the Post Office make a copy of "any data appearing on the outside cover of any sealed mail or unsealed mail delivered to an address, forwarding address, or Post Office box" Translation: really labor intensive packet sniffing of an encrypted network. Your postal mail is effectively encrypted because they're not allowed to look inside, but if they spend enough time watch

  • Already there (Score:4, Informative)

    by m50d ( 797211 ) on Sunday November 13, 2005 @10:45AM (#14020272) Homepage Journal
    Gnunet [gnunet.org] is here and working. Fully usable as a P2P network, not as fast as unencrypted but close. I haven't tried using it in pure friend-to-friend mode but the functionality is there. And of course it has all the things you'd expect from an advanced P2P network, searches for automatically extracted keywords, signed namespaces where you can publish content anonymously but show that it's all from you, directories, etc.
  • ``These private, invitation-only networks can be invisible to even state-of-the-art sleuthing.''

    Invisible or incomprehensible? Seems to me that as long as you're sending data over the same Internet as everybody else, others can see that there's traffic. In that case, this is just like a VPN (invite only, encrypted traffic between endpoints), right?

  • old news (Score:2, Informative)

    by Jerbol ( 660353 )
    there was a wired article [wired.com] on this very topic several months ago.
  • advertisements will state:

    Coming soon...to a darknet near you.

  • Can't stop the signal (Score:5, Insightful)

    by macemoneta ( 154740 ) on Sunday November 13, 2005 @11:55AM (#14020633) Homepage
    There are so many ways to abuse TCP/IP that it's impossible to stop data exchange unless you block all traffic. Heck, you can even communicate using ping, as in:

    HOST1: ping -c 1 -p facedead12349876 host2
    PATTERN: 0xfacedead12349876

    HOST2: tcpdump -x ip proto \\icmp and src host host1
    11:41:51.646216 IP host1 > host2: icmp 64: echo request seq 0
    0x0000: 4500 0054 0000 4000 4001 1af7 8752 0886 E..T..@.@....R..
    0x0010: 8752 0888 0800 4550 242d 0000 cf6c 7743 .R....EP$-...lwC
    0x0020: 25e5 0900 face dead 1234 9876 face dead %........4.v....
    0x0030: 1234 9876 face dead 1234 9876 face dead .4.v.....4.v....
    0x0040: 1234 9876 face dead 1234 9876 face dead .4.v.....4.v....
    0x0050: 1234

    Sure, you'll see a lot of icmp traffic, but odds are most network folks won't considering the pad data in a ping to be payload.

    It's like the old ppp over email implementations. Connectivity means data transfer. If some journalist or newbie network admin thinks otherwise, then it's just that much easier.

  • nah.. this is bunk (Score:2, Insightful)

    by sl4shd0rk ( 755837 )
    Whatever devices are between the nics (no crossover cable) leave an opportunity to see whatever traffic is going between them. Even ntop [ntop.org] will tell you what types of traffic it's seeing - not to mention if you are inside a bunch of hubs. 'Darknet' sounds spectacular, but it just comes down to another stupid protocol running on a non-standard port. If you're lucky, your best luck is to invent your own protocol, encrypt it, and don't share the source with anyone. Good luck getting anyone to trust you thoug

  • Darknets have been around a long time (Score:4, Interesting)

    by HangingChad ( 677530 ) on Sunday November 13, 2005 @12:29PM (#14020784) Homepage
    I won't say who around here has been using one for years (insert innocent look here) but it's not a new concept. It's only people they know and those with technical skill higher than the average bear. High enough to figure out how to encrypt files with PGP. Not bullet proof, but it sure makes it more difficult for ISP's to figure out what you have in your password protected ftp folder. Especially mixed in with a lot of family pictures, videos and routine stuff similarly secured.

    That group has lists of what they have rather than the items themselves, so it's fairly easy to check for particular files. Sometimes they'll collaborate on new movies coming out. You bought Batman last month, we'll buy Mr. & Mrs. Smith next month. Maybe one of them has a coupon or gets a copy from a neighbor. And so on. They IM back and forth, but never the FTP address which everyone already knows.

    It's not exactly a darknet but the principle is similar. Trusted users, encrypted files. If corporate snoops were going to try and catch that group they'd have to hack their way on to an FTP server, pull files pretty much at random then spend days trying to crack the PGP wrapper. Good luck with that. You might be surprised at how much material five or six different families actually have. Movies, music the differing tastes produce quite a wide selection. They save hundreds, maybe thousands a year and the risk is pretty minimal. And there's no special clients required, just a copy of PGP tools. If that group were 10 people or families instead of five, imagine how much more material would be available?

  • None of this matters. The RIAA is trying to impose an outdated idea on a population too numerous and clever to stand for it. I don't particularly like the idea of warez (and that IS what 95% of P2P traffic is) as a Free Software zealot, but we passed a tipping point years ago. The average person today (especially among the 30 population) no longer considers swapping files to be immoral.

    Eventually the law will catch up to practice, but until it does the [RM]PAA will continue to drive it underground. I pr

  • Darknets have always been around, and always will. (Score:3, Interesting)

    by crazyphilman ( 609923 ) on Sunday November 13, 2005 @04:37PM (#14021946) Journal
    Darknets are just the latest "OH MY GOD WE MUST ALL FEAR" line the computer industry is going to use to field a "solution" (probably some kind of sniffer for corporations, which tries to detect traffic which it cannot categorize and produces reports for suits).

    Say it with me: darknets have always been here, and they will always be.

    Hackers have IRC and other invite-only forums, and all the ways in which they've used them to secretly pass information around without the squares being in on it. P2P networks are darknets (for YOU, anyway) if you don't have software which uses the protocols and don't know anyone who knows about them. ANY new network protocol can be a darknet. You can roll your own anytime you want.

    Darknets are the modern equivalent of the Captain Midnight Secret Decoder Ring. They are NOT the Beginning Of The Fall Of Civilization(tm).

    Don't believe me? Fine. Be that way. Try this fun experiment:

    Write yourself a Java suite that:

    CLIENT SIDE:

    1. Briefly touches a server, downloads the current list of IP addresses that have announced themselves to the server, announces ITSELF to the server, and then logs off. The server IP is probably best implemented as one of a list of possible server sites, so that if one is compromised (doesn't give the correct handshake or whatever) you just move on to the next one. All communication should be encrypted using the server's public key and YOUR public key (RSA between the two points, or whatever is fashionable in your circle of friends).

    2. Lets you compose messages, or file transfers, or whatever, destined for whatever IP address you want to communicate with, again encrypted with both public keys. Maybe you even compress the data first, to reduce bandwidth usage.

    3. Lets you "blackball" any IP address you think is compromised. You could implement this as "My PC Only" or as a common blackball pool, which everyone could vote on, or as a common blackball pool which people could consider provisional and accept or not accept.

    SERVER SIDE:

    1. Manage lists of IP addresses and their status.

    2. Provide a handshake which is meant to test whether your software is authentic and you are in fact an approved node. If you're not, you get sucked into a honeypot and studied. You are NOT given an actual IP address list; rather you are given a fake list full of false leads.

    3. Allow certain admins to control the system to some extent, ousting problematic members (bans) and so forth. This could alternately be implemented on the client side, with a voting scheme, or whatever.

    Bam. Instant darknet. And it's a piece of cake for anyone who's passed the junior-level networking course at any public university. THINK about it -- why do you think anyone studies computer science these days? It sure ain't to find a job... People study computer science to build themselves cool, weird things that stiff, stick-up-their-ass types don't approve of.

    Deal, people. The world is not all simple and sparkly, like an amusement park. We are all grown-ups, and we can do grown up things even if it frightens The Man(tm). And, really, computer science is the closest thing any of us gets to wielding supernatural power. Us geeks can do things NOBODY else can do. Why not do them? Why be a boring square if you don't have to? Build something freaky, get yourself one of those weird, off-kilter cover photos in Wired that makes you look like Dr. Evil. Why not? You weren't put on this earth to make Sheeple feel comfy and warm. Fuck 'em.

Slashdot Top Deals

You know you've landed gear-up when it takes full power to taxi.

Close