Hacker News Reader

Comment by derf_ | Hacker News Reader

To me, by far the most interesting bit is this:

GCHQ developed a system called NOCTURNAL SURGE to search for particular engineers and system administrators by finding their IP addresses...

The confirmation came in the form of Google, Yahoo, and LinkedIn “cookies,” tiny unique files that are automatically placed on computers to identify and sometimes track people browsing the Internet, often for advertising purposes. GCHQ maintains a huge repository named MUTANT BROTH that stores billions of these intercepted cookies, which it uses to correlate with IP addresses to determine the identity of a person.

Hope you aren't sending cookies to an http site. Ever.

View on HN

HTTPS was no protection.

GCHQ (via NSA) had access to the non-encrypted traffic between the front end HTTPS servers and the backend for at least Google and Yahoo[1].

Google started a crash program to encrypt that traffic[2] (see also the famous "fuck you" post on G+[2]). Not sure what Yahoo has done.

[1] http://www.thewire.com/politics/2013/10/nsa-hacked-google-an...

[2] http://www.washingtonpost.com/business/technology/google-enc...

[3] https://plus.google.com/+MikeHearn/posts/LW1DXJ2BK8k

Also note "GCHQ developed a system called NOCTURNAL SURGE to search for particular engineers and system administrators by finding their IP addresses, unique identifiers that are allocated to computers when they connect to the internet."

Then the screenshot shows some queries of TELNET / SSH connections, which can mean: whoever uses SSH stands out from the crowd.

Wow.

Ever used SSH?

Do companies using Git tend to use it over SSH like personal github/Bitbucket works? If so, that's presumably a lot of noise in this genius detection scheme.

Do you have an example where such a bit "bigger coverage" makes any problem for such attackers? I can't imagine it.

There would be very different traffic patterns. Git over SSH would be a shortlived session with high data speeds, an interactive shell is longer with lower throughput changing in fits and starts. The popularity and hostnames of ssh servers also give some hints. Noise in detection would all depends on how intricate the monitoring is and how well it can be queried.

Is there a way to disable http cookies in the browser without disabling https cookies? It seems like with the recent push towards https this should be viable.

Score one for adblockers. At least that will get rid of some of the most frequently used ones that in the case of google also tie into your real world identity.

Reply on news.ycombinator.com