<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7638.1">
<TITLE>RE: [AusNOG] Wifi Security and Interception</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>FWIW, I am not sure about other ISPs, but I do not allow contractors or engineers to do PCap on our network without it being done on our own hardware - this runs deep freeze so we cannot store personal information between reboots and the machine never leaves an employee's sight.<BR>
<BR>
This kinda stuff is too serious to take lightly.<BR>
<BR>
<BR>
-----Original Message-----<BR>
From: ausnog-bounces@lists.ausnog.net on behalf of David Connors<BR>
Sent: Wed 6/9/2010 3:15 PM<BR>
To: ausnog@lists.ausnog.net<BR>
Subject: Re: [AusNOG] Wifi Security and Interception<BR>
<BR>
On 9 June 2010 13:20, Richard Pruss <ric@cisco.com> wrote:<BR>
<BR>
> Way out of my narrow area of expertise here<BR>
><BR>
<BR>
So am I but that does not appear to be stopping everyone else from<BR>
interpreting the law or offering opinions. I am eminently unqualified to<BR>
comment and so shall pile on.<BR>
<BR>
<BR>
> I have a few fumbling basic question here. How much of network<BR>
> Ethernet/WiFi/L2/L3/l4-L7 do you feel is covered by the TIA?<BR>
><BR>
<BR>
[ ... ]<BR>
<BR>
<BR>
> If INTENDED RECIPIENT does not include anything that can get and one<BR>
> expects to forward/drop on the message, allot of things networks regularly<BR>
> do become implicated and possibly "BAD".<BR>
><BR>
<BR>
So the elephant in the room no one is talking about is the fact that ISPs<BR>
and network providers do promiscuous packet captures every day of the week<BR>
on wired networks that customers presume to be secure. I'd venture that if<BR>
you went and had a look at the file servers/laptops of network engineers at<BR>
nearly every ISP/hoster/whatever on this list you would find that there is a<BR>
pcap or three laying around that contains more data than was needed or<BR>
intended - maybe even personally identifiable information and so on.<BR>
<BR>
I'm not all that sure there is too much difference between a network<BR>
provider collecting my PII and storing it on an engineer's laptop just<BR>
because my personal data happened to transit their IX while they were<BR>
analysing or debugging something - and what Google did (except in the Google<BR>
case there is *some* negligence on my part for not having my wifi<BR>
encrypted).<BR>
<BR>
Meanwhile, Conroy births another half-a-dozen kittens carrying on about how<BR>
Google *deliberately wrote* software to collect all of this data. "Eric<BR>
Schmidt says Google loves cash!!", and other non sequiturs he barks at the<BR>
Senate, as if to show the horrid depths of their packet snaffling depravity.<BR>
<BR>
Sheesh. Give me a break and get out your Occam's razor. The most likely<BR>
scenario is that some poor sod at Google uses tcpdump or knocks up something<BR>
using libpcap and runs it on 11-13 radio interfaces in promiscuous mode and<BR>
collects a heap of stuff driving 'round (hard disks are cheap compared to<BR>
drive around the world AGAIN if you didn't get all the data you need). The<BR>
intention would be to analyse it later to generate the necessary data to<BR>
support W3C location support back in the office. Network engineers do<BR>
promiscuous packet captures all the time. Grab all the data - more the<BR>
better - when you can - and pore over it back in the office to get whatever<BR>
the required outcome is. They might even keep the original captures around<BR>
to re-run their analysis later to prove other assumptions/etc.<BR>
<BR>
I have never seen anyone carefully exclude errant HTTP traffic from their<BR>
captures before analysis (in the interests of privacy, the law, or anything<BR>
else).<BR>
<BR>
Unfortunately for Google, they are one of the new whipping boys of privacy<BR>
on the Internet. If the AFP decided to randomly raid a bunch of ISPs they<BR>
would find all sorts of packet captures in tmp directories and backup tapes<BR>
containing all sorts of data to which the ISP is not entitled.<BR>
<BR>
Conroy has a bug up his proverbial and wants to discredit Google as if that<BR>
will somehow bolster his position on the mandatory filter. He gets a few<BR>
rants in the press/senate. A bunch of people pile on in some sort of<BR>
half-cocked conspiracy theory that Google is going to make off with the fact<BR>
I was on Facebook when they drove past my house on the 23rd of April last<BR>
year and captured data for the 15 seconds they were in range.<BR>
<BR>
He has more important things to worry about - like the 20 000 scams and<BR>
spams coming through the ... ummm ... portal.<BR>
<BR>
$0.022 inc GST<BR>
<BR>
--<BR>
David Connors (david@codify.com)<BR>
Software Engineer<BR>
Codify Pty Ltd - www.codify.com<BR>
Phone: +61 (7) 3210 6268 | Facsimile: +61 (7) 3210 6269 | Mobile: +61 417<BR>
189 363<BR>
V-Card: <A HREF="https://www.codify.com/cards/davidconnors">https://www.codify.com/cards/davidconnors</A><BR>
Address Info: <A HREF="https://www.codify.com/contact">https://www.codify.com/contact</A><BR>
<BR>
</FONT>
</P>
</BODY>
</HTML>