Remotely tracking PCs online

http://p2pnet.net/story/4106

"University of California student Tadayoshi Kohno says he and his colleagues have found a way to remotely fingerprint computers so they can be tracked anywhere online.


Powerful techniques for remote operating system fingerprinting, ie, techniques for remotely determining the operating systems of devices on the Internet, already exist, he, Andre Broido and kc claffy say in Remote physical device fingerprinting, going on:


“We push this idea further and introduce the notion of remote physical device fingerprinting, or remotely fingerprinting a physical device, as opposed to an operating system or class of devices, without the fingerprinted device’s known cooperation.


“We accomplish this goal to varying degrees of precision by exploiting microscopic deviations in device hardware: clock skews.


Entertainment industry movie, music and software cartels already spend millions, if not billions, of dollars on surveillance in their efforts to spy on Net users with the ultimate goal of gaining complete control over who does what online.


“Our techniques do not require any modification to the fingerprinted devices,” says the paper. “Our techniques report consistent measurements when the measurer is thousands of miles, multiple hops, and tens of milliseconds away from the fingerprinted device, and when the fingerprinted device is connected to the Internet from different locations and via different access technologies.


“Further, one can apply our passive and semi-passive techniques when the fingerprinted device is behind a NAT or firewall, and also when the device’s system time is maintained via NTP or SNTP. One can use our techniques to obtain information about whether two devices on the Internet, possibly shifted in time or IP addresses, are actually the same physical device.


“Example applications include: computer forensics; tracking, with some probability, a physical device as it connects to the Internet from different public access points; counting the number of devices behind a NAT even when the devices use constant or random IP IDs; remotely probing a block of addresses to determine if the addresses correspond to virtual hosts, e.g., as part of a virtual honeynet; and unanonymizing anonymized network traces.”


We tried to reach Kohno, a doctoral student, at his lab. But, “It’s Friday and I’m the only one here and I don’t have his cell phone number,” said the student who answered.


In the meanwhile, “Although the techniques we described will likely remain applicable to current generation systems, we suspect that future generation security systems might offer countermeasures to resist some of the fingerprinting techniques that we uncover,” the paper concludes.


“In anticipation of such developments, we discussed possible avenues for physical device fingerprinting when information about a system’s TSopt clock or system clock are not readily available to the adversary. Our results compellingly illustrate a fundamental reason why securing real-world systems is so genuinely difficult: it is possible to extract security-relevant signals from data canonically considered to be noise. This aspect renders perfect security elusive, and even more ominously suggests that there remain fundamental properties of networks that we have yet to integrate into our security models.” "

Just wanted everyone to feel warm and fuzzy this morning! Pete

 

Hi guys

This is a really interesting technical question...

Unfortunately, I'm not as good at computers as I'd like to...

Do some other users have varying opinions as regards the two previous posts, and, most interestingly, can some of you expend somehow on the technical aspects of the processes described?

Thanks

Guess I'll definitely have to subscribe to a computer course