11 ms·

To me, by far the most interesting bit is this: GCHQ developed a system called NOCTURNAL SURGE to search for particular engineers and system administrators by

by derf_ 12y ago

To me, by far the most interesting bit is this: GCHQ developed a system called NOCTURNAL SURGE to search for particular engineers and system administrators by finding their IP addresses... The confirmation came in the form of Google, Yahoo, and LinkedIn “cookies,” tiny unique files that are automatically placed on computers to identify and sometimes track people browsing the Internet, often for advertising purposes. GCHQ maintains a huge repository named MUTANT BROTH that stores billions of these intercepted cookies, which it uses to correlate with IP addresses to determine the identity of a person. Hope you aren't sending cookies to an http site. Ever.

jacquesm 12y ago
Score one for adblockers. At least that will get rid of some of the most frequently used ones that in the case of google also tie into your real world identity.
acqq 12y ago
Also note "GCHQ developed a system called NOCTURNAL SURGE to search for particular engineers and system administrators by finding their IP addresses, unique identifiers that are allocated to computers when they connect to the internet." Then the screenshot shows some queries of TELNET / SSH connections, which can mean: whoever uses SSH stands out from the crowd. Wow. Ever used SSH?
- mcintyre1994 12y ago
  Do companies using Git tend to use it over SSH like personal github/Bitbucket works? If so, that's presumably a lot of noise in this genius detection scheme.
  - acqq 12y ago
    Do you have an example where such a bit "bigger coverage" makes any problem for such attackers? I can't imagine it.
  - forgottenpass 12y ago
    There would be very different traffic patterns. Git over SSH would be a shortlived session with high data speeds, an interactive shell is longer with lower throughput changing in fits and starts. The popularity and hostnames of ssh servers also give some hints. Noise in detection would all depends on how intricate the monitoring is and how well it can be queried.
anewhnaccount 12y ago
Is there a way to disable http cookies in the browser without disabling https cookies? It seems like with the recent push towards https this should be viable.
nl 12y ago
HTTPS was no protection. GCHQ (via NSA) had access to the non-encrypted traffic between the front end HTTPS servers and the backend for at least Google and Yahoo[1]. Google started a crash program to encrypt that traffic[2] (see also the famous "fuck you" post on G+[2]). Not sure what Yahoo has done. [1] http://www.thewire.com/politics/2013/10/nsa-hacked-google-and-yahoos-private-networks/71100/ http://www.thewire.com/politics/2013/10/nsa-hacked-google-an... [2] http://www.washingtonpost.com/business/technology/google-encrypts-data-amid-backlash-against-nsa-spying/2013/09/06/9acc3c20-1722-11e3-a2ec-b47e45e6f8ef_story.html http://www.washingtonpost.com/business/technology/google-enc... [3] https://plus.google.com/+MikeHearn/posts/LW1DXJ2BK8k https://plus.google.com/+MikeHearn/posts/LW1DXJ2BK8k

by derf_ 12y ago

jacquesm 12y ago

Score one for adblockers. At least that will get rid of some of the most frequently used ones that in the case of google also tie into your real world identity.

acqq 12y ago

Also note "GCHQ developed a system called NOCTURNAL SURGE to search for particular engineers and system administrators by finding their IP addresses, unique identifiers that are allocated to computers when they connect to the internet." Then the screenshot shows some queries of TELNET / SSH connections, which can mean: whoever uses SSH stands out from the crowd. Wow. Ever used SSH?

mcintyre1994 12y ago
Do companies using Git tend to use it over SSH like personal github/Bitbucket works? If so, that's presumably a lot of noise in this genius detection scheme.
- acqq 12y ago
  Do you have an example where such a bit "bigger coverage" makes any problem for such attackers? I can't imagine it.
- forgottenpass 12y ago
  There would be very different traffic patterns. Git over SSH would be a shortlived session with high data speeds, an interactive shell is longer with lower throughput changing in fits and starts. The popularity and hostnames of ssh servers also give some hints. Noise in detection would all depends on how intricate the monitoring is and how well it can be queried.

anewhnaccount 12y ago

Is there a way to disable http cookies in the browser without disabling https cookies? It seems like with the recent push towards https this should be viable.

nl 12y ago

HTTPS was no protection. GCHQ (via NSA) had access to the non-encrypted traffic between the front end HTTPS servers and the backend for at least Google and Yahoo[1]. Google started a crash program to encrypt that traffic[2] (see also the famous "fuck you" post on G+[2]). Not sure what Yahoo has done. [1] http://www.thewire.com/politics/2013/10/nsa-hacked-google-and-yahoos-private-networks/71100/ http://www.thewire.com/politics/2013/10/nsa-hacked-google-an... [2] http://www.washingtonpost.com/business/technology/google-encrypts-data-amid-backlash-against-nsa-spying/2013/09/06/9acc3c20-1722-11e3-a2ec-b47e45e6f8ef_story.html http://www.washingtonpost.com/business/technology/google-enc... [3] https://plus.google.com/+MikeHearn/posts/LW1DXJ2BK8k https://plus.google.com/+MikeHearn/posts/LW1DXJ2BK8k