Great British Block-Off: GCHQ floats plan to share its DNS filters Officials with GCHQ are said to be mulling a plan that would extend the UK government's network security tools to private-sector ISPs. GCHQ director general for cyber security Ciaran Martin has been in Washington, DC, pitching the plan to arm the ISPs with firewall updates aimed at blocking off known bad actors. The project, …
> Though characterised in press reports as another "Great Firewall," the project appears to be almost entirely focused on catching cyber attacks, rather than gathering intelligence or censoring content.
And given the way Ms May is going, how long before it morphs from protection against cyber attacks, to "protection from the rest of the world, and yourself."?
All hail the Glorious Leader of the DPRUK
I thought that, but it would be a shame to not take advantage of the huge amounts of tax-payer money that they soak up; also we do have to recognise that they do have expertise. However: there is that smell about them, how far to trust them?
The best way of dispelling a smell is lots of fresh air. So if what they released was Open Source and could be readily checked - then we have a chance of keeping them honest.
I would be cautious, but I would like to talk to them further.
I would also like to see them putting effort into dealing with some of the problems that many of us have, eg cold calling scams. Lots of small sums add up to a lot - in total more than the bigger issues that GCHQ is tasked to deal with.
I'd imaging the easiest thing to do would be set up their own DNS server that doesn't return A records for offending domains and has a TXT record added with some kind of identifier for looking up the reason why it was blocked. They could then release the zone files so that anyone can read it, check it, and deploy it by just downloading a single plain-text file.
Tor is a honeypot and always has been. The point is to provide a false sense of security while simultaneously identifying people with something to hide.
For example: http://www.theregister.co.uk/2007/09/10/misuse_of_tor_led_to_embassy_password_breach/
TBB bugs are for the FBI. The NSA can de-anonymise any Tor user just based on their overall view of global network traffic.
Why would you think a project planned, founded, and paid for by the US government - the Navy[*] specifically - would protect you from the US government? That's some seriously wishful thinking there.
The question of legitimacy is all about what they do with the information. As long as the culture within the organisation does not permit it to be used except for national security, the ordinary person is safe. That ship has sailed in the UK - this is used for Serious Crime, which includes child prostitution. And fraud. And pot dealing. And copyright violation. And tax evasion. Pretty much everything which isn't a driving offence actually.
[*] The head of the NSA is an admiral of the USN. Possibly coincidentally.
The head of the NSA is an admiral of the USN. Possibly coincidentally
I'd say that emerged from the early days of signal intelligence, which were primarily Naval. The army usually had a secured line of communication, and the Air Force were based well behind the lines.
Tor is a honeypot and always has been.
It's a tool just like any other. If you want to obscure your location from the destination site, it works fine. If you want to come at a route from different angles to diagnose network problems, it's excellent. Absolute security? No.
Exactly.
I would never use TOR in a million years to do something nefarious. Not that I do anything particularly nefarious, but there you go.
I use it to have a little anonymity in relation to the website I am visiting, knowing all the time I'm wide open to the greater powers. But the website on the other end? Not so much.
The heads of Intelligence agencies are always retired senior officers from the various military branches. The reason is that they would already have the appropriate security clearances, know what military personnel in the field need in terms of intel, have strong relationships with those who will be acting on the intelligence, and are conditioned to follow whatever the President and their cronies say and thus tow the party line.
This is how its always been, and how it will always be...
GCHQ are trying to kill two birds with one stone here; make them look like the good guys, while creeping their mission. Sleazebags.
And all the while, the internet gets more and more carved up.
Oh, and how long before a tax hike is announced so that you may cover the cost of the inevitable engineering tits-up that follows.
>made me think the government was going sell GCHQ on the Stock Exchange.
The prospectus - "For carrying on an undertaking of great advantage; but nobody to know what it is."
Only on el'reg do you get to make obscure C18 financial crises references before breakfast
"The first thing I do on any setup it to ditch the ISP DNS servers and use multiple DNS servers from different organizations. Google, OpenDNS etc."
Some ISPs (e.g. BT) intercept DNS requests (regardless of their destination) and redirect them to their own DNS servers, supposedly to improve performance. This becomes apparent if you try to reach a website on their naughty list: the IP address returned from a DNS query (directed to DNS servers at OpenDNS or Google) will be to the BT server hosting the message about this site being "blocked by order of the high court". In summary, regardless of what DNS servers you set on your broadband router or your local PC, BT will intercept all your DNS queries.
You might consider using DNSCrypt instead.
sorry to be paranoid, but I *was* using DNSCrypt and I suffered an attack that made me think it was likely that DNSCrypt was being used to arm payloads against me, based on what I was surfing & when.
DNS is rather a lot of juicy metadata; who owns/watches the DNSCrypt servers?
actually, Github thinks they aren't all 5eyes
https://github.com/jedisct1/dnscrypt-proxy/blob/master/dnscrypt-resolvers.csv
Then they will come for our IP addresses because websites will continue to exist and operate without working DNS addresses just fine and people will continue to be pwned by drive-bys. It would be nice if they worked on helping folks use the internet securely rather than playing www-whack-a-mole at the tax payers expense. I'd love GCHQ to do stuff like out products that do stupid and insecure things such as rendering the contents of random files in ring 0, or adding leaky as a sieve virtualization features to silicon come to mind.
More than willing to give this a try if it is opt-in. Cyber attacks are an ever increasing problem and at least GCHQ are looking at ways to reduce the problem. I have long been a fan of DNS filtering (opendns) and one that is advert free looks like a sound idea to me. If GCHQ are after my dark browsing history then I could just send them a list of my favourite PRON sites anyway. Perhaps they will reciprocate with a few suggestions.
Not surprised they are pushing out a product that can be monetised.
Let's think this through.
Charge £x to each ISP for access to the filter database or £y a lower amount for routing the traffic through the GCHQ's already in place firewall, of course we won't look at the data without just cause.
The only surprise is that this is not being rolled out as mandatory for .gov, .nhs, .police etc or that its not being offered as "protect your home network for £10 a year, just set your dns to point to us and we'll "take care of you"!" to the general populace/sheeple.
Or the slow lane, you too can chose soon.
Obviously networking resources will need to be focused on the GCHQ compliant traffic to ensure all good citizens see the benefit of adopting safe, compliant browsing.
Those who chose not to use the government approved name servers will enjoy the 2% of bandwidth allocated to them by 2020. You see you will still have choice and if you have plenty of time will probably be able to resolve all those old unregulated sites you used to.
to seeing what sort of decentralized replacements the inventive Britons will come up with to fill the coming void. I always enjoyed reading about the glory days of pirate radio in the UK, it will be interesting to see the methods by which those who wish to communicate freely will challenge the dominance of the corporatised web.
I wouldn't look too far forward to it. There's a law against that, with increasing severity of penalties the more impotent they are to protect against it.
The way I see it (and I'm no network guru) the greater powers have it all stitched up - hook line and sinker.
Sure, they now have more data to sift, sure it's not meant to prevent paedophilia, sure it's not meant to protect against terrorist attacks. It's meant to stamp the Digital Imprimatur on things.
https://www.fourmilab.ch/documents/digital-imprimatur/
Forget about encryption (I'm no crypto guru either), there's a back door/tap for that.
Forget about it all.
The truth is, we have already been harvested. TOR for one - the biggest honeypot in the world. Remember Silk Road? They let it run, harvesting the punters, and then skimming all the profits - 4 million bit coins was it? Ta very much!
Talking of TOR, set up by Naval Intelligence. Yeah, conspiracy theory. Remember Silk Road?
They are not going to tell you there is a back door in it. Remember when people were called paranoid for claiming there was a key in windows for the NSA? Paranoid, yeah, paranoid as Andy Grove - only the paranoid survive right? Andy's done alright for himself hasn't he? CPUs that can change state with the computer turned off, all via Ethernet. Bloody hell, now that is what I call paranoia.
And that is just what we know about, what they are telling us.
One thing is for sure, software and the whole shenanigans involved with it has reached such a state of complexity, that even those that work on high-end stuff don't know wtf is going on. Remember Ken Thompson and the compiler thing? People are still asking if it is still a threat. Try explaining that to Doris at no.46 who just uses Facefuck to sell time in her 'properly equipped dungeon'.
And talking of honey pots, and talking of the NSA - fuck it - we're still being harvested - as we have been for the last 10 years or more - let me tell you this, something very interesting I came across the other day:
I started using Opera Developer edition to check out the VPN built in to it. Some people said it wasn't a proper VPN, and I can dig that, but it was handy for testing and interesting to play with.
I did an Alexa type check on a website I was curious about, just to see what traffic was like lately, and lo and behold, even though I was supposedly using an IP address from the Netherlands, the bloody server was in the fucking NSA data center in Utah! Ditto for the American IP that was an option in it as well.
Ok, it was actually less than a hundred miles up the road in a small unassuming building, that obviously had a server farm (and was a known quantity) - so there you go for plausible deniability. It wasn't in Holland though.
I went a bit mad with the IP tracing, and the whole whois shebang. Honeypot!
Shortly after, my internet started cutting out, and the Opera Developer edition stopped working altogether - it's fucked totally now. Just for me. Great idea - provide a free 'VPN' and have the servers in Utah in the NSA fucking data center - genius - you have to hand it to them. Not that they couldn't have got the information anyway, by other means, but that was bold. Must have been a reason for it.
I don't know much about it, and maybe I made a mistake, but what are the odds of that? Doesn't that seem fishy to you? You think you have a Netherlands IP, but the server is a few miles down the road from the NSA HQ? Ditto the American IP.
Maybe an innocent explanation. I only discovered it by chance, but still.
All the same, if you made a comment on the Guardian newspaper and had it deleted by a radical feminist, your name has been harvested. I wonder what they plan to do with all this information?
There can't be enough jack-booted nazis to carry out door to door exterminations can there?
I wasn't paranoid before, but I am now. That means, I can't really be paranoid, because paranoid people always deny they are paranoid. So maybe I'm not that paranoid after all.
No wonder most people don't want to face up to the shit that's going down at the moment. And the tech savvy especially. Now, I imagine you could get really paranoid if you knew what you were doing (thankfully I don't).
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
