Subject: [perpass] Yet Another Reason why ALL CLEARTEXT MUST BE ELIMINATED!

From: Nicholas Weaver <[email-masked]>
Date: Wed, 11 Dec 2013 07:43:55 -0800

Cookies and user tracking are wonderful things.  If you are a intelligence service, that is.

Its now clear that the NSA (and, remember, any other intelligence service that might see such traffic can do the same thing) uses cookies/advertising for both tracking (e.g. HAPPYFOOT: Advertisement libraries (esp on Android) which broadcast location + IMEI in the clear -> easy user tracking) and targeting (e.g. Know the victim's google PREFID cookie through other means, then use it to target exploitation: 

http://apps.washingtonpost.com/g/page/national/nsa-signal-surveillance-success-stories/647/#document/p3/a135602

http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/10/nsa-uses-google-cookies-to-pinpoint-targets-for-hacking/
)

Everyone on this list should now consider themselves an in-scope target from at least one foreign intelligence service...

But the intelligence services can do even better if they want.  Here's how:

The NSA or foreign intelligence wiretap has a possible candidate for attack, but not probable.  That is, they THINK they may want to do an exploitation attack but aren't sure...

1)  On the packet-injecting wiretap, it sees a possible candidate and it does a packet injection of a 302 redirect to a "User ID" script on the exploit server for something inconsequentially small.

2)  The user-ID script creates a hidden iframe.

Within that iframe, it opens up a bunch of other iframes to various sites, e.g.www.youtube.com,www.linkedin.com, www.yahoo.com, slashdot.org, etc.  Namely ANLY (and well, all) sites which

a)  Identifies the user in the response

b)  Uses a user-identifying cookie that can be sent in the clear.

This causes the possible victim's browser to visit all these sites, identifying the victim to any wiretap that can see it.

3)  Back on the packet-injecting wiretap, it looks for request/response pairs to the targeted sites, using the request to extract the user ID cookies and the response to match the user identification by quick & dirty parsing of the HTML in the response.

Since the wiretap knows the user identifications it wants to exploit, it now knows the user ID cookies it wants to exploit as well.

4)  Back on the user-ID script, after a ~10 second delay, it then creates a second set of iframes to the various sites for different URLs.  This causes the possible victim's browser to revisit all the sites.  These requests contain the user's ID cookies, which any wiretap has now been able to map to "is this the actual person I want to target"

5)  The packet injecting wiretap, now that it knows the user ID cookies it might want to target, packet injects an exploit against any desired user ID cookie...

This enables the packet injection/exploitation system to leverage all known user-identifying sites in the clear to target their exploitation with high precision, even when the potential victim doesn't attempt to visit the user identifying sites in the clear.

The requirements for ANY intelligence service to do this to target YOU are:

a)  They must see ONE web request from you in the clear pass ONE of their wiretaps when they consider you "just might be a possible target"

b)  They must see ONE of the user-identifying web requests pass ONE of their wiretaps, and you must be logged into that site.

As you can imagine, the set of possible actors able to do this actually ends up being pretty darn big...

The IETF needs to work for HTTPS-only, NOW, out of simple self defense.

--
Nicholas Weaver                  it is a tale, told by an idiot,
[email-masked]                full of sound and fury,
510-666-2903                                 .signifying nothing
PGP: http://www1.icsi.berkeley.edu/~nweaver/data/nweaver_pub.asc

---

From: Robin Wilton <[email-masked]>
Date: Wed, 11 Dec 2013 17:23:11 +0100

Thanks Nicholas - this is useful and relevant analysis.

In case you haven't already seen it, this piece about some new research (at Stanford... sorry ;^)  ) gives a similarly worrying perspective on the role of "hub" sites in expanding the scope of the "three hops" rule. Your Step 2 is, I think, a very similar mechanism, and has significant privacy impact.

Yrs.,
Robin

Robin Wilton
Technical Outreach Director - Identity and Privacy
Internet Society

email: [email-masked]
Phone: +44 705 005 2931
Twitter: @futureidentity

On 11 Dec 2013, at 16:43, Nicholas Weaver wrote:

> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass

---

From: [email-masked]
Date: Wed, 11 Dec 2013 13:16:22 -0500 (EST)

And this time *with* the link... I hate it when I do that.

[http://webpolicy.org/2013/12/09/metaphone-the-nsa-three-hop/] http://webpolicy.org/2013/12/09/metaphone-the-nsa-three-hop/

Robin

On 11 Dec 2013, at 17:23, Robin Wilton wrote:

Yrs.,
Robin

Robin Wilton

email: [mailto:[email-masked]] [email-masked]
Phone: +44 705 005 2931
Twitter: @futureidentity

---

From: Nicholas Weaver <[email-masked]>
Date: Wed, 11 Dec 2013 11:44:41 -0800

On Dec 11, 2013, at 10:16 AM, [email-masked] wrote:

> http://webpolicy.org/2013/12/09/metaphone-the-nsa-three-hop/
> Robin

Everyone on this group should be considered within the "3 hop" rule.

Edward Snowden <-> Various Reporters And Others I've Identified <-> Me <-> You all.

Enjoy.

---

From: Martin Millnert <[email-masked]>
Date: Wed, 11 Dec 2013 21:20:56 +0100

> Edward Snowden <-> Various Reporters And Others I've Identified <-> Me <-> You all.

Two hop is actually sufficient, since Jake's participating here. :-)

Regards,
Martin

---

From: "Christian Huitema" <[email-masked]>
Date: Wed, 11 Dec 2013 20:44:16 -0800

> Cookies and user tracking are wonderful things.  If you are a intelligence service, that is.

We actually described that attack in draft-trammell-perpass-ppa-01, which we submitted last month:

   4.3.5.  Tracking address use with web cookies

   Many web sites only encrypt a small fraction of their transactions.
   A popular pattern was to use HTTPS for the login information, and
   then use a "cookie" to associate following clear-text transactions
   with the user's identity.  Cookies are also used by various
   advertisement services to quickly identify the users and serve them
   with "personalized" advertisements.  Such cookies are particularly
   useful if the advertisement services want to keep tracking the user
   across multiple sessions that may use different IP addresses.

   As cookies are sent in clear text, a PPA can build a database that
   associates cookies to IP addresses for non-HTTPS traffic.  If the IP
   address is already identified, the cookie can be linked to the user
   identify.  After that, if the same cookie appears on a new IP
   address, the new IP address can be immediately associated with the
   pre-determined identity.

Your analysis goes one step further, linking cookies to active attacks. We only considered "pervasive passive attacks" in the problem statement, but it is pretty clear that we want to also consider the active attacks. Packet injection can act as an efficiency multiplier on top of the passive monitoring.

In any case, it is pretty clear that if a connection carries identifying data such as cookies, then it should be encrypted. Alternately, we may want to convince browser developers to allow a privacy setting "no cookies in clear text."

-- Christian Huitema

---

From: Jacob Appelbaum <[email-masked]>
Date: Thu, 12 Dec 2013 10:12:00 +0000

> Two hop is actually sufficient, since Jake's participating here. :-)

Indeed. I'm happy to have all of you in my graph - especially those who
are the most stubborn and accidental supporters of decisions that
increase surveillance!

All the best,
Jacob

---

From: Robin Wilton <[email-masked]>
Date: Thu, 12 Dec 2013 14:49:11 +0100

Sounds like a call for a t-shirt to me:

"I'm a Friend Of Jake: if you know me, They know you" ;^)

R

Robin Wilton

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 12 Dec 2013 22:23:18 -0500

> Two hop is actually sufficient, since Jake's participating here. :-)

I know Glenn Greenwald, I think he is considered a prime target, not a
secondary.

So the whole IETF is two hop.

-- 
Website: http://hallambaker.com/

---

From: Robin Wilton <[email-masked]>
Date: Wed, 11 Dec 2013 19:14:45 +0100

Robin