Data brokers sell access to the backbone of the internet • Hacker News Board

Re: Data brokers sell access to the backbone of the internet

#11

Post by missedthecue » Wed, Aug 25, 2021, 5:22 PM UTC

atok1 wrote: post #9

Why is it not illegal to sell this type of data everywhere?

"The information, known as netflow data, is a useful tool for digital investigators. They can use it to identify servers being used by hackers, or to follow data as it is stolen."

Doesn't look like they're selling 'atok1 loves to browse hacker news' type data.

Re: Data brokers sell access to the backbone of the internet

#12

Post by CarelessExpert » Wed, Aug 25, 2021, 5:37 PM UTC

MrWiffles wrote: post #6

Cycl0ps wrote: post #5

I'm still not sure how this compromises VPN use. ISP routes the connection so of course they can see when I use my VPN. From there I would assume the VPN works as a mixer and handles multiple connections through the same exit point, so you couldn't tell my traffic from another users. Is that not the case?

I’m wondering the same thing. The only thing I can think of is being able to correlate times, ports, and traffic volume from some origin, to some VPN node, then look for near identical data coming from that node to an ISP, and then on down the chain to identify the victi-err, I mean “person” accused of being a bad actor. So I wonder: would the copyright nazis be able to use this kind of data corollary in court agains…

> I’m wondering the same thing. The only thing I can think of is being able to correlate times, ports, and traffic volume from some origin, to some VPN node, then look for near identical data coming from that node to an ISP, and then on down the chain to identify the victi-err, I mean “person” accused of being a bad actor.

Exactly that. As with Tor, if you can observe the entry and exit flows you can deanonymize the traffic.

Re: Data brokers sell access to the backbone of the internet

#13

Post by atok1 » Wed, Aug 25, 2021, 5:43 PM UTC

missedthecue wrote: post #11

atok1 wrote: post #9

Why is it not illegal to sell this type of data everywhere?

" The information, known as netflow data, is a useful tool for digital investigators. They can use it to identify servers being used by hackers, or to follow data as it is stolen. " Doesn't look like they're selling 'atok1 loves to browse hacker news' type data.

Even if that may be the case, on the surface, we have no control over what is done using secret agreements and decisions.

Re: Data brokers sell access to the backbone of the internet

#14

Post by sixothree » Wed, Aug 25, 2021, 5:49 PM UTC

missedthecue wrote: post #11

atok1 wrote: post #9

Why is it not illegal to sell this type of data everywhere?

" The information, known as netflow data, is a useful tool for digital investigators. They can use it to identify servers being used by hackers, or to follow data as it is stolen. " Doesn't look like they're selling 'atok1 loves to browse hacker news' type data.

Can I have your netflow data?

Re: Data brokers sell access to the backbone of the internet

#15

Post by andrewmcwatters » Wed, Aug 25, 2021, 6:11 PM UTC

Can someone explain to me why anyone would use a consumer VPN versus SSH tunneling through to a nation with secure data privacy laws if you know what you're doing, other than convenience or the number of countries you can connect to for Netflix purposes maybe?

Re: Data brokers sell access to the backbone of the internet

#16

Post by tdeck » Wed, Aug 25, 2021, 6:22 PM UTC

andrewmcwatters wrote: post #15

Can someone explain to me why anyone would use a consumer VPN versus SSH tunneling through to a nation with secure data privacy laws if you know what you're doing, other than convenience or the number of countries you can connect to for Netflix purposes maybe?

Possibly because the former option is advertised constantly and most people aren't aware of the latter.

Re: Data brokers sell access to the backbone of the internet

#17

Post by fulafel » Wed, Aug 25, 2021, 6:45 PM UTC

Cycl0ps wrote: post #5

I'm still not sure how this compromises VPN use. ISP routes the connection so of course they can see when I use my VPN. From there I would assume the VPN works as a mixer and handles multiple connections through the same exit point, so you couldn't tell my traffic from another users. Is that not the case?

An adversary who can see your vpn traffic can use traffic analysis [1] to correlate known protocol packet patterns and timestamps to netflow traces to known destinations serving known content with matching timestamps from vpn termination points.

[1] https://en.m.wikipedia.org/wiki/Traffic_analysis

Re: Data brokers sell access to the backbone of the internet

#18

Post by 0x0A1B2C » Wed, Aug 25, 2021, 7:28 PM UTC

This is nothing new in terms of technology, ISPs have a legitimate reason to want to analyze traffic in that context. There is a fairly competitive market for software that ties it all together with DNS monitoring and metadata done through internet scans (Kentic, Deepfield).

The fact that ISPs are monetizing it and letting this data out of their control is utterly terrifying, and in the United States, specifically permitted by law.

Re: Data brokers sell access to the backbone of the internet

#19

Post by OminousWeapons » Wed, Aug 25, 2021, 8:12 PM UTC

fulafel wrote: post #17

Cycl0ps wrote: post #5

I'm still not sure how this compromises VPN use. ISP routes the connection so of course they can see when I use my VPN. From there I would assume the VPN works as a mixer and handles multiple connections through the same exit point, so you couldn't tell my traffic from another users. Is that not the case?

An adversary who can see your vpn traffic can use traffic analysis [1] to correlate known protocol packet patterns and timestamps to netflow traces to known destinations serving known content with matching timestamps from vpn termination points. [1] https://en.m.wikipedia.org/wiki/Traffic_analysis

Would this still be an effective attack if you used a single VPN provider with multiple hops and your adversary was not someone like a nation state? Alternatively, what if you did basic VPN chaining (e.g. you vpn to a pfsense instance or something on a VPS and configure outbound traffic on that server to be routed through a commercial VPN)?

Re: Data brokers sell access to the backbone of the internet

#20

Post by wmf » Wed, Aug 25, 2021, 8:14 PM UTC

missedthecue wrote: post #11

atok1 wrote: post #9

Why is it not illegal to sell this type of data everywhere?

" The information, known as netflow data, is a useful tool for digital investigators. They can use it to identify servers being used by hackers, or to follow data as it is stolen. " Doesn't look like they're selling 'atok1 loves to browse hacker news' type data.

We saw the same pattern with phone location data. ISPs are selling the data in bulk ("don't worry, they're not selling your data, they're selling everyone's data!") to "responsible" companies who then re-sell the ability to data-mine specific IPs. The result is that, yes, people in the know can pay to find out whether atok1 loves to browse hacker news.