Wednesday, February 28, 2007

RIAA Liars

The RIAA launched a new website recently: P2P Lawsuits. It's a one stop shop for anyone who has been sent a letter from the RIAA. They make it nice and easy to pay them their extortion... er, settlement money.

The most interesting part of the site, I think, is their FAQ.

In particular, I like this question the most:



This is a total lie.

From the data that they have collected (essentially, logging onto a p2p network and downloading one or more files from you) - they have absolutely no way to know which computer in your house, or worse, which computer in your apartment building was using the Internet connection.

If you are dumb enough to accidentally share your home movies/homework folder too, and they download your World History final exam - then they may be able to claim that you are the evil-file sharer.. However, with just an IP address, they don't have anything.

Why are they lying? Because by stating this, they may get people to settle who would otherwise have a pretty reasonable defense.

Yes, there have been timing attack papers in the past few year (Kohno et all, in particular), and there are ways of fingerprinting a remote OS, even passively. However, none of these techniques will reveal which specific computer was using a wifi connection.

The RIAA are liars. Plain and simple.

Monday, February 26, 2007

My first FOIA request comes back empty

Late last year, liberal blogger Glenn Greenwald had reason to believe that someone from US customs and border patrol had looked up his border entry/exit records, and posted the information to the Internet. More on that can be viewed at Glenn's old blog site here.

Thus, I fired off a FOIA request to US customs and border patrol, now part of DHS, asking for any and all records and database searches done by an employee named 'Eric Wess' for data on Glenn Greenwald...

C&BP's FOIA office got back to me last week by telephone, and told me that they do not have now, or had in the past year (the scope of my request) any employee named 'Eric Wess' on their payroll. If I wanted to do a search for any agent who had done a search on Glenn, I'd need some kind of privacy act waiver....

Not the most fantastic result, but still, a useful FOIA writing experiene, and a chance to see the US government responding to them in a reasonable amount of time.

Sorry I couldn't be more helpful Glenn.

Saturday, February 24, 2007

My blog post leads to congressional investigation of TSA





I'm crossing my fingers, and hoping for hearings...

Thursday, February 22, 2007

TSA and the Amber Alert

I'm in the middle of finishing up a paper on airport security right now. I hope to make it public in the next couple weeks. I've been doing a lot of research, digging out quotes, facts, figures, etc. I came across this fantastic quote from John Gilmore in a discussion at the Volokh Conspiracy:

At United they eventually offered me a choice of showing an ID, consenting to an unspecified but intensive search, or not being able to buy a ticket. My lawyer always told me to never consent to a search -- if they have the right to search you, then they don't need your consent.



Which brings me to the topic of today's blog entry. On Feb 7, TSA announced that they were partnering with the National Center for Missing & Exploited Children to help find kidnapped children. TSA will circulate information such as photos and descriptions of the abducted child, the suspect and vehicle - to all of their screening officers.

Why is this a bad idea?

1. TSA can barely accomplish their primary task - keeping bombs and weapons off airplanes. In Red Team style tests at New Jersey airport last year, TSA failed to catch 20 out of 22 attempts to smuggle prohibited items past checkpoints.

2. Children do not have ID, typically and TSA does not require them to have ID when they travel, even when with parents.

3. The vast majority of children travelling through the airport system have not been kidnapped. Just as the vast majority of passengers detained or selected for secondary screening by TSA are not terrorists. Thus, the chances are that most of the children/parents who are detained by TSA for being suspect child-nappers are going to be innocent.

Remember, a 1% false positive rate with 2 million passengers a day is still a lot of false positives.

4. Since children have no ID, if you do happen to steal a child - TSA has no way of proving that the kid isn't yours. Kids tend to look alike - esp. the younger ones - and a 10 dollar an hour TSA screener is certainly not going to be an expert on the subject.

Bruce Schneier believes that the no-fly list has not caught a single terrorist. However, it has caused serious inconveniece to a number of innocent travellers - Esp. Maher Arar, a Canadian citizen who the US renditioned to Syria and had tortured for a year after his name was incorrectly included on the no-fly list, thanks to incorrect intelligence provided by the Canadian government.

These are the kinds of false positives we have to face already due to the no-fly list. With the introduction of the Ambert Alerts at TSA, we now have a whole new class of potential false positives that will cause significant delay and hastle to passengers.

On the upside, perhaps after a few highly public wrongful arrests initiated by TSA staff, parents will stop flying as much - and thus significantly reduce my chance of having a screaming baby, or annoying seat-kicking child directly behind me on a flight .... just kidding ;)

Wednesday, February 21, 2007

No ID: A letter to the DCA Police

Sergeant Sonya Westbrook
Police Department
Reagan National Airport
Washington, DC

Virginia Delegate David Toscano, TSA Director Kip Hawley,

Dear Sergeant Westbrook,











I ask that you provide me with the following information:








Thank you,

Christopher Soghoian

Tuesday, February 20, 2007

New TSA Website back online - Now Less Phishy



just like a shady, perpetual going-out-of-business sale retailer, TSA's website has resurfaced again, only this time, with a new name. It isn't linked to yet from the main site, but can be found via links from

The new website is:

New improvements:




Problem: It is still outsourced.

Both and are served by akamai distributed proxies, so it's impossible to figure out where they're actually being hosted.

However, someone from TSA visited my website last month, so I do know that TSA's outbound web proxies are: A A A A A

(Note, this is why Tor is useful)

Additonally, (which runs a webserver, albeit not one configured for public viewing) resolves to: A

TSA's new website,, resolves to A


I don't know the ip address of the old website - since it is no longer listed in DNS records. However, resolves to


traceroute to (, 30 hops max, 38 byte packets


12 ( 81.561 ms 118.933 ms 84.338 ms
13 ( 82.985 ms 81.489 ms 83.893 ms
14 * * *

traceroute to (, 30 hops max, 38 byte packets


12 ( 84.352 ms 83.722 ms 84.142 ms
13 ( 82.005 ms 82.326 ms 83.552 ms
14 * * *

Problem: It still uses cookies!



When I browse to both, and this new unannounced TSA website, I am given a web cookie - "ForeseeLoyalty_MID_8El4YcUdgN".



Monday, February 19, 2007

ID rules inna Babylon: A police confrontation at DCA Airport



Today, I tried to do just that - with TSA.





It was at this point that things got interesting.










Friday, February 16, 2007

Communal ziplock bags at airports?

I flew out of Indianapolis on Wednesday evening. The airport was in a complete state of chaos, due to the number of cancelled flights that day and the day before.

While in standing in line to get to the TSA checkpoint, I saw a scary, yet amazing thing:

TSA agent David: Remember, any liquid greater than 3.4 oz must be discarded. All liquids in small bottles must be placed in a ziplock bag.
Concerned female passenger: What about this item? *holds up some kind of liquid in a small bottle*
TSA agent David: It's small enough, but you still need a ziplock bag. Do you have one?
Concerned female passenger: No. *thinks quickly* Can I put it in someone else's bag?
TSA agent David: Sure, just as long as they all fit in a 1 quart ziplock bag.

The concerned female passenger then approached a random stranger standing in the line (who had her ziplock bag out in her hands already), and asked her if it would be ok to put her bottle of liquid in said random passenger's bag..

Not only did this person agree to taking a complete stranger's item through a TSA checkpoint - but the TSA agent, David, watched while it happened and didn't say a word.

Utter insanity!

The TSA checkpoint was pretty crazy once I got through the line. It seems that every passenger who is bumped from one airline to another is automatically given the SSSS treatment. Since US air had cancelled my flight, and had instead put me on a flight run by another airline, I was stuck in the back of the SSSS line that was about 10 people deep - including at least 4 passengers under the age of 7.

While killing the time, I looked over to my left, and saw a man in a blazer and suit pants helping out at the checkpoint. I peered at his badge, and made out the name: David Kane. The federal security director, the guy who signed the letter notifying me of my investigation, was actually helping out on the floor. Things were so crazy there it seems, that the suits from the office were drafted to come and help out.

When I got to the puffer machine - as usual, I declined to go through. I often get told in Indianapolis that I must go through the machine. I had them ask Mr Kane - who after coming over to verify my request, confirmed that I indeed have the right to go through security without submitting to the puffer machine.

Now if only I could get that in writing....

Tuesday, February 13, 2007

TSA has outsourced the TSA Traveler Identity Verification Program?





* Unable to print Boarding Pass at Kiosk/Home
* Directed to Ticket Counter every time I fly.
* Missed flight while attempting to obtain boarding pass


Two things immediately jump out at me.






Now, they do at least have a ssl webserver running at But they're using a self-signed cert.





The whois database shows as follows:

Administrative Contact, Technical Contact:
Desyne, Inc. dns@DESYNE.COM
Desyne Web Services, Inc.
PO Box 143
Boston, VA 22713

Record expires on 21-Mar-2015.
Record created on 20-Mar-1996.


Why can't TSA do a simple form submission themselves?

Digging up dirt on the International Intellectual Property Institute








Wednesday, February 07, 2007

Un-SAFE Behavior











Lets get technical now...





The perl script can be downloaded: *Removed*


apt-get install libimage-imlib2-perl



# Chris Soghoian
# Feb 7, 2007.
# Licenced under the GPL. Find it via Google.

# Broken glass
# v. 0.1
# This will break any MD5/SHA1 comparison of images.


The Law Is Not A Machine

I have a number of projects I'm working on right now. Given that I'm taking two law classes - most of my ideas at least involve the law in some way.

I've had two conversations in the past few days - where I have sought advice from super intelligent and seriously kickass legal experts - and both of them have ended with me receiving a sharply worded (yet friendly) warning:

The law is not a machine. You cannot find a loophole in it in the same way that you would with a computer algorithm. The law is pliable, and if a judge wants to rule against you - he'll find a way.

As plain and simple as this may be, I'm still struggling to get my head around it.

I remember as a high school senior being amazed by the EFF's trickery regarding the Deep Crack machine. Since it was illegal to export the source code to this machine, they simply had it printed as a book - where it was transformed from code to speech - sent over to Europe, and then run through OCR scanners to turn it back into usable computer code. This single event was deeply inspirational, and got me thinking, way back then, that perhaps the law could be abused in the same way as the bugs and holes I was (ab)using in online games.

Clearly, there are loopholes to find - but the act of finding them is far more dangerous than in computer security. When you fail online, you get locked out of the service you want to analyze. When you fail with the law, you go to jail...

These are truly dangerous, yet interesting times.

Sunday, February 04, 2007

Plausible Deniability via 2 wifi-routers?






Which is why I now have 2 wifi routers.








Saturday, February 03, 2007

Avoiding the NSA through gmail

I've been thinking a fair bit about the EFF's lawsuit against AT&T. According to court papers and press reports, AT&T is giving the NSA a direct network tap at multiple locations around the country, giving the US government access to all unencrypted email/IM conversations and web traffic that flow through AT&T's network. It's probably fair to assume that a few other backbone providers are also doing the same thing.

Consider the following situation:

Alice sends an email from her home computer (connected via Verizon DSL Connection) to her friend Bob, who checks his email from his desktop computer at work. Alice uses Hotmail, and Bob uses his company's email servers.

Alice's web connection to hotmail will most likely flow across AT&T's backbone, and if it doesn't, it'll cross one of the other Big Boys, like Level 3. Once Alice has created her email, it'll flow from Microsoft's email servers to Bob's employer's email server - unencrypted, again, probably over one of the major backbones, until it reaches Bob's desk.

There will be at least a couple chances for the NSA to sniff this.

What if Alice sends an email to her pal Charlie, who also uses hotmail?

Well, again, the spooks will have a chance to watch Alice construct the email, and then will be able to see Charlie login to hotmail and read it. Key to note here, is that since the email stays within Hotmail's network, it never has to flow across the Internet to go from Alice to Charlie.

Which brings me to the subject of gmail.

Google is nice enough to allow SSL encrypted sessions. Whereas Yahoo and Hotmail merely allow you to login via SSL (just to stop a passive network sniffer learning your email password), google allows the entire session to remain encrypted. Thus, any interaction between a user at their home computer, and Google's gmail servers remains secret, providing the user changes the url to be https://

Let us now consider a situation where Alice and Charlie each have gmail accounts, and each login via ssl. Alice's connection to google is encrypted, the email flows from one gmail user to another, so it never leaves google's network as it is transmitted from Alice's outbox to Charlie's inbox, and then Charlie's connection to Google is SSL encrypted, so the contents of his email is not revealed to anyone watching his packets cross the backbone.

Right now, very few of gmail's users are using SSL. It us turned off by default (mainly for performance reasons, I'm guessing. 10 million users all requiring an SSL handshake is expensive in processing power).

As gmail's user base grows, and if their users can be convinced to embrace SSL, the NSA's wholesale data slurping from the backbone will increasingly become less useful.

"If we all use encrypted email (PGP/GPG), we won't have this problem" - this is the very true. However, I cannot convince my less technically savvy friends/relatives to use PGP. It has far too many usability problems - still.

However, most of my friends already use gmail - due to the way accounts were given out in the early days, gmail has a very geeky user base. All I need to do now, is to convince them to use SSL... Which is where the Customize Google firefox extension comes in useful.

Customize Google is mainly used to screen out google's advertising - both in gmail, and in the "ads by goooogle" that you see everywhere on the web. I typically install this on the computers of most of my less tech savvy friends. In addition to blocking out ads, Customize Google also turns on SSL for all gmail/google calendar sessions, without requiring that the user do any fiddling themselves. Problem solved!

Small Print:

This only stops the massive sniffing of data currently done by the US government of backbone traffic. This in no way protects you from the feds asking Google for the contents of your email - either by presenting a warrant, or more likely (since it doesn't involve asking a judge), a national security letter. I have good reason to believe that the FBI did this to me - but that's beside the point. This at least requires them to know who you are, and to be interested in you - whereas under the current NSA sniffing scheme, they can watch all email flow by, and analyze it without knowing who they're interested in spying on.


Much respect to the the reporters committee for freedom of the press for their kickass FOIA letter generator .

FOIA/PA Mail Referral Unit
Department of Justice
Room 114, LOC
Washington, DC 20530-0001

Dear FOI Officer:

Pursuant to the federal Freedom of Information Act, 5 U.S.C. § 552, I request access to and copies of Any and all documents (including but not limited to) memos, electronic mail, presentations, briefings, meeting notes, guidelines and policies relating to "Tor", "onion routing", "onion router", and "anonymous/anonymizing proxy/proxies" . I am interested in anything that matches this description between the dates 01/01/2002 and 02/01/2007.


Transportation Security Administration
TSA-20, West Tower
FOIA Division
601 South 12th Street
Arlington, VA 22202-4220

Dear FOI Officer:

Pursuant to the federal Freedom of Information Act, 5 U.S.C. § 552, I request access to and copies of All documents including but not limited to) memos, electronic mail, presentations, briefings, meeting notes, guidelines and policies relating to the storage and or data deletion policies for the data from chemical/explosive analysis of passengers, passengers bags, items and personal possessions. In particular, I am requesting information on how long TSA keeps the data generated by the machines that perform the explosive residue analysis on the swabs that TSA agents wipe on passenger's bags/objects. I am also requesting information on how long data is kept from the "puffer" machines used by TSA (these are typically made by either GE or Smiths), which shoot air at passengers and then analyze the particles that are dislodged. In addition to this data, I also request any and all information relating to how the information is matched or associated to specific passengers, in what format, and held in what databases, if it is at all. The scope of this request is for all information matching this description between the dates of 01/01/2003 and 02/01/2007.

Friday, February 02, 2007

Tor: Lies or Ignorance?

I went to a symposium on Search and Seizure in the digital age at Stanford last week.

One topic that kept popping up was the so called "Creepiness Factor" of various surveillance technologies. Just like the 'ol government standard for obscenity, we can't quite define creepy surveillance, but we know it when we see it.

One of the last speakers of the day was an Assistant US Attorney - based in Silicon Valley, and who focused on cyber crimes. I'm fairly sure that his name was Matthew Lamberti. Fairly early into his talk, it was plainly obvious that his opinions did not mesh too well with the rest of the room - at least after he quite proudly announced that he didn't think it was in any way creepy to go through someone's trash. Facial expressions around the room quickly changed.

After his talk was over, I walked up to him, introduced myself, and asked him what he thought of Tor.

(I'm paraphrasing here)

"What's that", he asked.

I explained that it was an anonymity preserving system that enabled hundreds of thousands of Internet users to browse the web and communicate anonymously.

He replied that he wasn't familiar with the technology, so he really couldn't answer my question.


Back in November, when I met with the Cybercrime specializing Assistant US Attorney in Indianpolis, his eyes lit up at the mere mention of Tor, and he proceeded to give me a long lecture on the evils of the technology, and how Indiana University has no business doing anything that even comes close to anonymity-promoting research.

I find it shocking, yet amazing that an Assistant US Attorney who works out of the San Jose DoJ office - who prosecutes Internet/IP crime cases all the time - in possibly the most high-tech areas in the country, and who has never heard of Tor.

Are the Indianapolis DoJ more Internet Savvy than those in Silicon Valley? Did I catch Mr Lamberti on an off day, or what?

And that's where my latest FOIA request will come in handy ;-)

No ID on United: Piece of Cake





Total time to go through security: Less than 10 mins.