Feeds

Kaminsky takes on censorship with info-mapping tools

Wants to transparency to provoke debate

The Power of One eBook: Top reasons to choose HP BladeSystem

Black Hat 2012 When he's not working on DNSSEC, Dan Kaminsky is taking on censors, both in government and in private industry, with plans for a series of user-friendly tools that will map out where information is being deleted or blocked online.

Last year Kaminsky released his n00ter tool, which mapped internet traffic speeds to spot any monkey business by ISPs on the censorship front. But the tool was difficult to install and use and lacked wide support, he acknowledged in his presentation at this year's Black Hat conference in Las Vegas.

To rectify this he's working on a new system, due to be released in the next few months, which will be a simple browser add-on that can map out where censorship is occurring. Kaminsky said that he wasn't looking to run a censorship information service himself, but to provide a large data set to privacy organizations that do, like OONI-Probe, Herdict, and the EFF.

"It's crowdsourcing censorship detection," he explained. "The internet is becoming less and less flat every day. The actual content that you see on the network is changing based on where you are because ISPs and governments are altering content."

dan kaminsky

Censorship needs to be pointed out, warns Kaminsky

Kaminsky cited the example of Verizon, which is currently trying to contest the Federal Communications Commission's Open Internet Order, which insists that ISPs can't censor content for payment, or if they disagree with it. Verizon is claiming that it can do what it likes with content under First Amendment free speech rules.

"Just as a newspaper is entitled to decide which content to publish and where, broadband providers may feature some content over others," Verizon said in its filing. "Although broadband providers have generally exercised their discretion to allow all content in an undifferentiated manner, they nonetheless possess discretion that these rules preclude them from exercising."

Kaminsky's plan is to release a tool which will capture the actual identity of the certificate used in a connection, to counter spoofing and intervention by third-parties. This will collect a data set and allow users to know just how their connections are being managed.

"My goal here is transparency," he said. "If networks are going to be blocking or altering content, let that be transparent, and let us have that political discussion about what that means. We can't have the discussion until there's awareness and these tools exist to increase that." ®

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.