Re: [perpass] On men at the end

[Brian Trammell <[e-mail]>]

hi Stephen, all,

and on a third topic, briefly...

On Aug 18, 2013, at 11:47 PM, Stephen Farrell <[e-mail]> wrote:

> 
> Hi Brian,
> 
> First, thanks for the thoughtful post. You make some good points.
> A few responses below. Might be better to follow up in separate
> mails, since you raise too many interesting points probably:-)
> 
> On 08/18/2013 07:45 PM, Brian Trammell wrote:
>> 
>> However, being a perfect passive adversary is terribly expensive and
>> doesn't work nearly as well as just compromising the end systems,
>> whether through the traditional phishing, social engineering,
>> rootkits and keyloggers or through cooperation and court orders, as
>> recent revelations have shown. 
> 
> One interpretation of the current news stories might be that its
> not so expensive to compromise some almost random but "nearby" end
> systems and have those contribute to your monitoring network. I
> could believe that its more expensive to very specifically target
> an attack at one end-system, particularly if you want to disguise
> the fact that you tried.

True. Bots get more expensive the more specific you want to be about where and what they are. But here you're compromising end systems and using them as middle systems, which is a bit different than owning the end host of a targeted individual, turning on his webcam, and having a look around his flat.

One of the points of the perfect passive adversary attack model is that it illustrates that you don't really _need_ to compromise the ends to get a _whole lot_ of information. When the passive monitoring is done at the physical layer, you can't even detect its presence from the ends. Sitting at the endpoints is infinitely more detectable, and you have to conceal your presence through technical and/or legal countermeasures. 

>> This illustrates the first
>> limitation:
>> 
>> (1) The most serious threats today reside outside the scope of the
>> network and its protocols. It's not the men in the middle we should
>> be worried about, it's the men at the end. It's not clear that we can
>> do anything about this at all.
> 
> I'd quibble a bit there. We spec protocols at many layers, and what's
> an endpoint for one, is the middle for others.

Point. I don't mean that it's useless to work on better securing the middle -- anything we can do to increase the cost of indiscriminate, pervasive passive surveillance is a Good Thing. I'm just saying that we shouldn't be surprised when the reaction to the increased cost of pervasive passive monitoring at layers 1 through 7 is a layer 9 attack: new legislation compelling every access provider, service provider, and blogger with comments on in a given jurisdiction to deliver detailed application-level logging information to the authority designated for the purpose.

Best regards,

Brian