[HN Gopher] RouterOS - Communications Assistance for Law Enforce...
___________________________________________________________________
RouterOS - Communications Assistance for Law Enforcement Act (2012)
Author : qwertox
Score : 105 points
Date : 2022-05-20 11:39 UTC (11 hours ago)
(HTM) web link (wiki.mikrotik.com)
(TXT) w3m dump (wiki.mikrotik.com)
| sgjohnson wrote:
| Every router is technically capable of doing this.
|
| It's just firewall rules and pcap.
|
| Not sure this is front-page worthy.
| kj4ips wrote:
| It depends, I've got some junipers that only pass the
| application processor the first N bytes of a packet, and even
| captures are limited to the first N bytes. Vendor docs say that
| if you need captures, you should do them on the switch, or use
| DPI and route everything through the application processor.
| bombcar wrote:
| You could probably develop a "NSA sniffer" to determine when
| captures are happening by noting network degradation,
| especially if it forces everything onto the application
| processor and off of fast-path.
| jhartwig wrote:
| like putting a script on the switch that says the cpu
| utilization is x% higher? Do higher end switches report out
| utilization of the packet processing asic? I have a few
| high end switches in my homelab, I can of course tell the
| utilization of the management processor but I have never
| tried to delve into what the actual switch chip is doing.
| bombcar wrote:
| I was thinking more remotely noticing that throughput
| dropped - my switches can route at line speed if they
| avoid the CPU, but if the CPU is involved it drops to
| about half line speed.
|
| If you're the one controlling the network router, you
| know when the sniffing is going on - this would be trying
| to detect that your ISP has turned the "NSA button" on.
| frankfrankfrank wrote:
| I find that nephile mentality quite ignorant of the fact that
| the negative and bad things aren't just ephemeral, regardless
| of whether you would like to move on to next-thing. But I guess
| to people with your mindset the slippery slope is no slope at
| all, but rather a flat plane as you are sliding down it.
|
| "Why are you so concerned with the old Constitution" you
| proclaim, "we have the patriot act instead. It even has the
| word patriot in its title and the iPatriot act is on the way to
| replace the old patriot act. I support next-thing."
| [deleted]
| capableweb wrote:
| Seems like a feature for mandatory "intercept and log network
| traffic" is interesting enough for hackers for the story to
| land on the frontpage.
|
| I didn't know about CALEA since before but I've dealt with lots
| of network infrastructure (never in the US though), so I found
| this interesting, and upvoted it.
| medo-bear wrote:
| > Not sure this is front-page worthy
|
| why not ? i believe it is especially as i imagine most people
| are not aware that such things exist in freedom lands
| distantsounds wrote:
| if you're on HN there is a level of confidence that you
| understand basic networking, and that you are aware your
| traffic goes through a multitude of devices before you get
| the data you requested.
|
| it should come as no surprise that those devices can log the
| data passing through it.
| icedchai wrote:
| Just wait... someone will complain this is a GDPR
| violation. ;)
| sgjohnson wrote:
| To be fair, this makes perfect sense. It allows compliance
| with wiretap warrants. Which are perfectly reasonable.
| salawat wrote:
| They are not. This is broadband. This goes far beyond pen-
| registers.
|
| This is bloody everything from a particular endpoint, and
| not in an application specific manner. There is very little
| but storage reqs and someone getting uppity keeping this
| from becoming a dragnet type of surveillance mechanism.
| kube-system wrote:
| The warrant is part that makes it not a dragnet.
| jaywalk wrote:
| Depends on how specific and difficult the warrants are.
| tablespoon wrote:
| > why not ? i believe it is especially as i imagine most
| people are not aware that such things exist in freedom lands
|
| Do you mean firewall rules? Because firewall rules definitely
| exist in "freedom lands."
|
| A lot of the comments here seem to show an eagerness to
| misunderstand this. Even in a "freedom land" law enforcement
| still needs the power to intrusively investigate criminal
| suspects, because ineffective law enforcement is a bad thing
| and a threat to liberty.
| medo-bear wrote:
| in freedom land people generally believe that things they
| own will not call the cops on them. in contrast in soviet
| russia people generally belived everything they owned
| called the cops on them
| jaywalk wrote:
| Just to be clear, this has nothing to do with a thing
| someone owns calling the cops on them. A CALEA intercept
| would be implemented before the data reaches the end
| user.
| medo-bear wrote:
| im taking the liberty to talk figuratively. but yeah the
| thing you own instead of calling the cops will _by design
| and purpose_ snitch on you when they come knocking
| jaywalk wrote:
| How so? Unless you own a router with CALEA capabilities
| and specifically configure it to log all of your data,
| it's not going to snitch on you.
| medo-bear wrote:
| > router with CALEA capabilities and specifically
| configure it to log all of your data
|
| the point is that in the US this [the device you own
| snitching on you] is required by law
|
| https://en.m.wikipedia.org/wiki/Communications_Assistance
| _fo...
| jaywalk wrote:
| You're misinterpreting it. CALEA requires that _service
| providers_ have the capability to do interceptions when
| requested by law enforcement. It has absolutely nothing
| to do with end-user devices.
| medo-bear wrote:
| > It has absolutely nothing to do with end-user devices.
|
| absolutely nothing ? are you sure about that
| throwaway307423 wrote:
| nisegami wrote:
| >don't blame the cops (because: if you get ripped off on eBay
| or your child goes missing, you do want some kind of
| resolution, right?)
|
| I'm not sure where you live, but in my neck of the woods, going
| to the cops in these scenarios might even be slightly worse
| than not going to them, let alone better.
| [deleted]
| tomrod wrote:
| I see now why my cybersecurity friends source router hardware
| that allows them own the OS.
|
| Is there any way to not have a backdoor built into my router?
| tjohns wrote:
| To be clear, this is not a "backdoor" in the traditional sense.
| Nobody can log into your router without your consent.
|
| This is a way for the router administrator (you) to manually
| give the police access to a copy of traffic in response to a
| warrant. The assumption here is that this router is being run
| at an ISP, and you're a netadmin responsible for handling legal
| compliance requests.
| orangepurple wrote:
| This is put into place before it hits your router
| salawat wrote:
| Welp. That's news to me. Thought it was just Telco's and not
| bleedy every bloody Networking equipment vendor out there. And
| especially not on every MitM VoiP providers. This clinches the
| death of Skype though. This is why we can't have nice things.
|
| I need to stop reading these things. I just become more and more
| misanthropic as days go by.
| NickRandom wrote:
| I feel you. But don't give up hope. The guy behind the I2P
| protocol has some thoughts about the free internet on his blog
| https://medium.com/@zlatinbalevsky/im-not-a-prophet-but-i-pl...
| 1970-01-01 wrote:
| Good! It's important for you to understand how privacy is never
| guaranteed. Sniffing and tracking _who you are talking to_ is
| the oldest page in the FBI, CIA, and NSA playbook.
| [deleted]
| Terry_Roll wrote:
| So they can watch everything that you do and then punish you if
| you look on the wrong parts of the internet instead of blocking
| the wrongs parts of the internet and tackling the root of the
| problem in the first place.
|
| That process says more about the people in power than the people
| using the internet especially when you see how leading search
| engines can be with their results, its like they want you to fail
| in order to consolidate their top tier position in society,
| intellectual feudalism.
| djanogo wrote:
| Might be dumb question, but won't this configuration need admin
| ssh access to add required rules and local server to log that
| traffic?
| qwertox wrote:
| Not admin access:
|
| > Calea provided options are available only for specific
| RouterOS user, as Calea server configuration as "tap"
| configuration. Specific user should have 'sniff' policy enabled
| at RouterOS user configuration
|
| So the admin has to set up a user account on the device.
| vetinari wrote:
| On RouterOS, the default 'admin' user is a member of the
| 'full' group, which has 'sniff' policy enabled.
|
| So it can be both - dedicated user with the appropriate
| permission, or admin himself.
| bombcar wrote:
| The whole point of the law was to add the _ability_ to tap in,
| which is what this is. You still need someone to log into the
| router and setup the account which can do the tap, it can 't be
| remotely activated by spooks.
|
| Though if there are other remote access vulnerabilities,
| someone may be able to use the feature maliciously once they're
| in.
| reflexe wrote:
| "This page was last edited on 28 May 2012, at 07:46."
|
| Maybe better to add this date to the title.
| windexh8er wrote:
| Not sure why this is on the front page, but to clarify it's
| required by the FCC [0] for carriers. Microtik, just like every
| other network vendor, has this in their product (port mirroring
| for law enforcement) so that they can check the box. CALEA has
| been around since the 90s [1].
|
| [0] https://www.fcc.gov/public-safety-and-homeland-
| security/poli... [1]
| https://en.wikipedia.org/wiki/Communications_Assistance_for_...
| ncphil wrote:
| Specifically, _1994_, another banner year for undermining civil
| liberties and privacy, what with the passage of the new
| sentencing provisions of the federal crime bill and continuing
| effort to prevent wider use of encryption by individuals
| through action against PGP: all by a "liberal" US
| administration that would also accelerate consolidation of mass
| media in the hands of a few big corporations.
| windexh8er wrote:
| Yes, 1994 and 1996 [0] were both horrible years for bad
| "telecomm" policy. I remember debating this in my
| "Regulations" class in the early 2000s and how, even by then,
| we could see the potential longer term damages emerging. I
| think it also played a role in influencing the markets (with
| respect to tech companies) to think how they do (continuous
| growth / continuous significant increase in QoQ profits). The
| late 80s and early 90s were a wild ride of ignorance in
| policy making. The Clipper Chip, interesting takes on crypto
| export control all the way through the advent of the DMCA.
|
| Interesting times with many unfortunate decisions.
|
| [0]
| https://en.wikipedia.org/wiki/Telecommunications_Act_of_1996
| hedora wrote:
| Media consolidation was bipartisan.
|
| Regan rolled back enforcement of many rules, and the rules
| were changed to exand Clear Channel's (and other) monopolies
| under W.
| spmurrayzzz wrote:
| I found this interesting insofar as it is somewhat rare for
| endpoint CPEs to have these features baked in, in particular
| with any sort of CALEA semantics. This is almost always a
| burden pushed on the transitory service providers upstream from
| the device. Network device OEMs, in my experience running an
| ISP (in addition to both making routers and white-labeling them
| for our service), have never been held to the CALEA
| requirements historically.
|
| The wikipedia article you shared actually states this pretty
| clearly as well:
|
| >" The IP-based "soft switches" typically do not contain a
| built-in CALEA intercept feature; and other IP-transport
| elements (routers, switches, access multiplexers) almost always
| delegate the CALEA function to elements dedicated to inspecting
| and intercepting traffic. In such cases, hardware taps or
| switch/router mirror-ports are employed to deliver copies of
| all of a network's data to dedicated IP probes."
|
| (I realize that Microtik's RouterOS may end up on headend
| router devices and that is likely why this exists, but the
| implementation details here are just a little odd when you can
| just port mirror on a switch instead)
| dec0dedab0de wrote:
| It was passed in the 90s, but it wasn't required for ISPs until
| 2007. I was working at a small ISP at the time. I remember they
| picked a vendor and installed the box with a week or two to
| spare.
| ibejoeb wrote:
| Doesn't hurt to hit the front page occasionally. I'll bet
| someone is learning about CALEA for the first time from this
| post.
| Krasnol wrote:
| Exactly.
|
| I just learned bout it for the first time.
| user_7832 wrote:
| Go address some of the posters "why is the front page worthy" -
| I'm not _surprised_ that 3 letter agencies get all the data they
| want, but very often it 's very covert and not so "official".
| user_7832 wrote:
| Edit: I meant to type _To_ , not Go. Go makes no grammatical
| sense :/
| superduperuser wrote:
| "why is this on the front page?"
|
| because someone found and read this wiki and decided to share
| it with others who also found it interesting so they upvoted
| it. now here we are
| user_7832 wrote:
| No no, I'm in agreement of this post being relevant, I typoed
| :(
| formerly_proven wrote:
| Lawful interception is not for "three letter agencies", but for
| the police (TLAs have their own totally different ways to get
| this data, in the US they even have their own courts for this).
| So these are generally documented, judicial processes.
| mbg721 wrote:
| The US really needs a distinction between executive powers
| (which exist because legislative bodies grant the executive
| branch wide latitude), and legislative powers (specific
| things the legislature has said to do).
| stefan_ wrote:
| Lawful interception is precisely not made for "three letter
| agencies", since the latter derive the majority of their
| power from not spying on the law subjects of their own
| country. Although the US have of course intentionally muddled
| this with FISC and at times outright disregard for that
| simple principle.
| walterbell wrote:
| It's a small router world.
|
| Some SOHO networking devices made by Microtik, QNAP and Ubiquiti
| contain Arm SoCs made by AWS (Annapurna Labs),
| https://en.wikipedia.org/wiki/Annapurna_Labs
|
| The venerable PC Engines APU2 is a fanless x86 AMD 10W TDP router
| with 4GB ECC RAM, TPM 2.0 and GPIO pins, open schematics and
| coreboot, which can run pfSense, OPNsense, OpenBSD, Linux,
| FreeBSD and OpenWRT, with virtualization support. Constrained by
| supply chain at present. mPCIe slots for WiFi, LTE & mSATA.
|
| Ubiquiti ERLite-3 can run Linux and OpenBSD (octeon/MIPS).
|
| There are some generic Intel-based small routers,
| https://www.servethehome.com/topton-intel-j4125-4x-i225-fanl...
___________________________________________________________________
(page generated 2022-05-20 23:02 UTC)