Black Hat DC 2010: Exploiting Lawful Intercept to Wiretap the Internet 1/6

Clip 1/6
Speaker: Tom Cross

Many governments require telecommunications companies to provide interfaces that law enforcement can use to monitor their customer's communications. If these interfaces are poorly designed, implemented, or managed they can provide a backdoor for attackers to perform surveillance without lawful authorization. Most lawful intercept technology is proprietary and difficult to peer review. Fortunately, Cisco has published the core architecture of it's lawful intercept technology in an Internet Draft and a number of public configuration guides.

This talk will review Cisco's architecture for lawful intercept from a security perspective. The talk will explain how a number of different weaknesses in its design coupled with publicly disclosed security vulnerabilities could enable a malicious person to access the interface and spy on communications without leaving a trace. The talk will explain what steps network operators need to take to protect this interface. The talk will also provide a set of recommendations for the redesign of the interface as well as SNMP authentication in general to better mitigate the security risks.

For more information go to the BlackHat 2010 DC archive http://bit.ly/aNhakO

Category:

Science & Technology

Tags:

• Black
• Hat
• DC
• 2010:
• Exploiting
• Lawful
• Intercept
• to
• Wiretap
• the
• Internet
• clip1

[bigdav123456]

none of this should be posible until a criminal offense by the person being monitored has been proved.! Until that time this is unlawful.!

[tuseroni]

well guilty til proven innocent is the model of security, but not the model of freedom. the two are opposed.

if everyone is considered guilty and suspect, then everything can be monitored and nothing missed (the white list model, only trusted things can be exempt) if everyone is considered innocent how do you determine who is guilty.

wire tapping is terrible, censoring the internet is terrible, and i will take freedom over security and safety any day!

[joe80dman]

So, we're all GUILTY UNTIL PROVEN INNOCENT? We're all potential CRIMINALS unless we're continually monitored? The 4th Amendment is null & void? Why is Cisco mentioning European laws? Europeans have their laws, and we have our 4th, and 5th Amendments.