Legal Wiretap Mechanisms May Be Open to Abuse Within ISPs

LAS VEGAS — The built-in mechanism that lets many Internet providers tap communications for law enforcement agencies is susceptible to abuse by insiders who work for the ISPs, Black Hat 2010 was told.

How to DDoS a federal wiretap

The result could be eavesdropping on communications by parties who don’t have court approval to do so, says Tom Cross, the research director for IBM’s X-Force Research.

Founder: Black Hat Reflects a Changing Industry

Cisco routers that use inside provider networks have a weakness in that they don’t generate traps when bad passwords are used over and over as would be the case if someone were trying to brute-force the password. That leaves the machines open to the attacks and gives network administrators no warning. In addition, logs that would record when the routers gather traffic for a tap can be shut off so there is no audit trail, leaving no record of the tap being placed, Cross says.

“To me this is bizarre,” Cross says, because it makes it impossible to demonstrate that someone has tapped communication illegally. He says he understands law enforcement officials want the feature because it prevents insiders at the ISPs from checking the logs to spot what the cops are tapping and tipping off the parties being investigated. But still, “There’s no way to see if a person is lying if they say they didn’t tap a line,” he says.

Another weakness is that the router can send the tapped data anywhere it is told to, not just to the mediation device in the ISP network that is supposed to gather tap information, he says.

Getting access to the key routers is difficult to do from outside the service provider networks, but people with access to the ISP LAN could do so relatively easily, he says. “This meets the hackers halfway,” Cross says. “It makes it easier to use and cheaper and more likely to happen,” he says.

The problem is more complex, he says, because many of the devices used in wiretap schemes aren’t open to public scrutiny. Cross says he gained knowledge about the Cisco implementation because Cisco made it open to public review by submitting it as a standard to the IETF. Other devices don’t have to meet standards and the way they work is kept secret, he says.

Read more about wide area network in Network World’s Wide Area Network section.