Mark Lim’s Blog Page

Here’s one of my more interesting posts. Do you live in America? Know about the FBI? Heard about their “Carnivore” surveillance computer program? Well, if you answered ‘no‘ to any of the above questions, then you’ve come to the right place! In a nutshell, Carnivore is a controversial Internet surveillance computer program that the FBI have been using to ’sniff’ the network activities of criminals. Carnivore was developed in-house by the FBI and has been used for quite a few years (at least since 2000 or futher back) until this year (2005) when the FBI decommissioned the project. Apparently the FBI is dropping the project in preference to using off-the-shelf commercial network ’sniffing’ products since the commercial products have more features and work better.

For further reading or listening on Carnivore, check out the following links:

• Bruce Schneier’s Weblog on Carnivore
• Real Video recording of NANOG Meeting, discussing about Carnivore. (This is THE BEST place to find out about how Carnivore works. A representative of the FBI is the presenter in this video and the discussion gets to a very heated debate near the end of it. VERY INTERESTING to watch!!)
• The IIT Research Institute Independent Technical Review of the Carnivore System - Final Report. (Excellent document to refer to. Has some nice screenshots of Carnivore. Best to read this after watching the video in the previous link.)

If you’re a University student reading this and have access to the Science or Law libraries, or have access to the IEEE Digital Library, you might want to check out the following articles which give a basic overview of what Carnivore does:

• J. S. Stratford and J. Stratford, “Computerized and Networked Government Information. Carnivore,” Journal of Government Information, vol. 28, no. 1, pp. 109-112, 2001.
• D. L. Sobel, “Will Carnivore Devour Online Privacy?,” Computer, vol. 34, no. 5, pp. 87-88, 2001. (This is a IEEE Computer Magazine publication. An excellent article that gives a good overview of what Carnivore does and the issues surrounding its use.)
• T. Nabbali and M. Perry, “Going for the Throat: Carnivore in an ECHELON World. Part I,” Computer Law and Security Report, vol. 19, no. 6, pp. 456-467, 2003. (Provides a good basic overview of Carnivore)
• T. Nabbali and M. Perry, “Going for the Throat: Carnivore in an ECHELON world. Part II,” Computer Law and Security Report, vol. 20, no. 2, pp. 84-97, 2004. (Not such a good article to read. Focuses more on the law/legal side of Carnivore usage).

In relation to Carnivore, there is another electronic surveillance system being in use called ECHELON. Apparently ECHELON is an electronic surveillance system that monitors all kinds of communications and is being set up by different countries around the world. ECHELON is also supposed to be extremely top secret, so it’s basically impossible to find out information from the Internet about how it actually works (you’d expect that if they can monitor all electronic communications, anyone who was exposing information on how ECHELON actually works would get caught and cut off…..). However, you can get a taste of what ECHELON is supposed to do by going to the following links:

• Bruce Schneier Cryptogram article on ECHELON, 15th December 1999. (A nice light overview of what ECHELON is. )
• Exposing the Global Surveillance System, by Media Filter. (Excellent source of information on ECHELON. Provides good information about the history of ECHELON.)

PS: Hope the FBI don’t mind me putting this post here (if they happen to stumble across this). I’m only mentioning about Carnivore because it’s relevant to my research, in terms of being able to observe people’s on-line behaviour.

If you’re a really paranoid person (like myself - only on bad days) who is really unsure about whether documents that you receive are virus infected, you might want to visit the VirusTotal web site. At VirusTotal, they provide a free service where you can e-mail them a file which you suspect might be virus infected and they will scan it for you using several anti-virus engines. They then send you back an e-mail with a report on whether the file you sent was infected. It’s a really great free service to use if you’re not sure about whether your anti-virus software is up-to-date, because VirusTotal will use a variety of anti-virus scanners to make sure your document does not contain any of the latest known viruses.

There’s a really neat web-based application on the Internet called “ShieldsUp!“, which allows you to test out how safe your computer is from intruders on the Internet. When you run the program, it scans all of your Internet ports to check which ones are open and displays a report to show how secure your computer or network is from intruders. It’s a very safe program to use and was designed by Gibson Research Corporation.

Gibson Research Corporation also designs other interesting free security software, which are worth checking out.

At the moment I’m trialling ZoneLab’s ZoneAlarm Pro version 6.0 Firewall. It has all the features of previous ZoneAlarm Pro versions (i.e. port level firewall, program access firewall, e-mail security, identity theft protection) plus some new features such as:

• Operating System Level Firewall
• Spyware Scanner
• Wireless PC Protection

Initially I had some frustrations with the new Operating System Level Firewall, since it stopped some legitimate programs (e.g. Adobe Distiller and Microsoft Word) from working properly. However, after a bit of fiddling around with the settings, I eventually learned how to make use of the Operating System Level Firewall and am now quite happy of the new feature introduced by ZoneLabs. The OS Firewall is a new feature in ZoneAlarm Pro and is designed prevent malicious programs such as viruses, worms, trojan horses and spyware from harming your computer. The OS Firewall triggers an alarm everytime a program wants to do an operating system level action and allows the user to choose whether to allow the program to go ahead with its task or block it. ZoneAlarm Pro learns from what programs you allow/block to access for and automatically blocks or allows access for programs you have previously specified.

ZoneAlarm Pro has a whole heap of other features I could review, but that would be too much for me to write. If you’re interested in ZoneAlarm Pro, head to the ZoneLabs website to try out a trial version of the software before deciding on whether to purchase it. Its definitely a good idea to try out software before you buy!!

While on the topic of firewalls, you might want to check out the book: “Building Internet Firewalls“, authored by Elizabeth Zwicky, et al., published by O’Reilly, 2000. It’s a pretty good book covering the basics about how firewalls operate and provides quite some good advice on how to set-up your computer network to defend against hackers and worms from the Internet.