Feeds

Blanket discovery for stolen laptops

Of John Doe and IP addresses

  • alert
  • submit to reddit

Internet Security Threat Report 2014

Comment Bad things happen online. Trade secrets are lost or stolen. Personal information is compromised. Copyrights and trademarks are infringed. Bloggers post confidential information, defamatory information, or just annoying information. Websites host stolen credit cards, hacking tools and techniques, or other things that you might not want.

In the course of investigating these things, companies or law enforcement agencies frequently need to rely on information in the hands of third parties. An example of this is the various companies that offer data or computer locator services. A sort of "LoJack(tm) for stolen computers. If a corporate computer is reported lost or stolen, these services use various means to identify the computer, or the data on it. When the target computer is then used - generally to get online - the computer essentially "phones home" with its location.

Here's the problem with this approach. The computer doesn't really give its location. At best, it can reveal the Internet Protocol (IP) address of the network it is on. While this information is helpful to the true owner of the computer, it is not sufficient to locate and/or recover the stolen hardware.

Imagine that your "On-Star(tm)" equipped car is stolen. OnStar is one of the various services that provides motorist assistance, including Global Positioning Satellite location data. If you report the car stolen, they can remotely turn the GPS on, track the car, and even turn the telephone inside the car on and listen into the thieves' conversations. All of this occurs on the network the real owners own and it reveals information about your vehicle. So, no problem, right?

Finding subscriber information

When it comes to network based investigations however, we cannot easily track where the computer went. Once we have the IP address, we would look up the network that was assigned that block of IP addresses. It might be an Internet café in Riga, Latvia, or a giant Internet Service Provider in Dulles, Virginia.

What we really want is subscriber identification information. That is, what subscriber was assigned that particular IP address at that particular instant. Now of course, a lot of this information may be spoofed, and it is usually less than trivial to piggyback on a legitimate network (such as, a hacker using an open or insufficiently secured WiFi network.) Nonetheless, tracking down physical location data or subscriber data from a raw IP addresses is the ultimate goal of the investigator.

This is where technology and the law intersect - and not in a good way for either of them. While you can do a traceroute or a WHOIS search in a couple of seconds, in order to get subscriber data from an ISP requires some form of legal process (usually). ISP privacy policies legitimately protect this data, but they generally contain a provision (and one would be implied by law even if it wasn't in the policy) that the information may be disclosed if there is a "valid legal order."

In the case of law enforcement agencies, there are many legal avenues for obtaining this information from ISPs. First, they can just ask for it - obtain consent. In extreme situations (imminent threat to health and safety) the promise of a later subpoena may be sufficient. In the United States, for example, they can also use various legal processes - a grand jury subpoena, a formal investigative demand, an administrative subpoena, a discovery order, a search warrant, a Title III wiretap order, an order issued by the Foreign Intelligence Surveillance Court. Or, as recently revealed in The New York Times, various agencies including the Department of Defense and the Central Intelligence Agency (and of course the FBI) can issue what is called a National Security Letter (NSL) on their own authority to get this information.

Building a subpoena

There are various levels or proof required to obtain different demands for information. A subpoena generally requires very little level of proof that the information demanded is relevant to whatever you are looking for, or may lead to the discovery of relevant information. Most people think that subpoenas are issued by a court or a judge – that you apply for a subpoena to a court, show them that the information is relevant, and then get an order. Not true – well, at least not for the most part. In reality, law enforcement (either the cops or the prosecutor) has a desk drawer filled with subpoenas. They just whip ‘em out, type in the name and the information needed, and email or fax ‘em to the ISP. No big deal - takes a couple of seconds and the court is not even notified.

Now technically (at least in the US federal system) all of this is illegal. You see, to issue a subpoena there has to be an investigation authorized by a grand jury: a group of citizens authorized by the court to investigate crimes. The grand jury engages in this charade of authorizing the prosecutor to investigate and issue subpoenas on their behalf - but they usually don't know what is being investigated or how. Moreover, even this bare charade is not followed in most investigations. A prosecutor unknown to the grand jury may be investigating crimes unknown to the grand jury and issuing subpoenas on their behalf without even the pretext of delegated authority. But who can argue with success?

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
UK smart meters arrive in 2020. Hackers have ALREADY found a flaw
Energy summit bods warned of free energy bonanza
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Mozilla releases geolocating WiFi sniffer for Android
As if the civilians who never change access point passwords will ever opt out of this one
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Reducing the cost and complexity of web vulnerability management
How using vulnerability assessments to identify exploitable weaknesses and take corrective action can reduce the risk of hackers finding your site and attacking it.