Re: [Full-Disclosure] Re: [PAPER] Juggling with packets: floating data storage

[Valdis.Kletnieks@vt.edu]

--==_Exmh_-765350396P
Content-Type: text/plain; charset=us-ascii

On Wed, 08 Oct 2003 12:03:20 PDT, Nicholas Weaver said:

> If my external link is "ONLY" 100 Mb, and the latency/refresh time is
> 1 minute, thats 768 MB of data.
>
> So who cares? Why juggle when shelves hold so much more?

Well.. sometimes, you need to store a small amount of data (20-30K of 0day
exploit or encryption key or similar, perhaps?) where people perusing the
bookshelf won't notice it.

I know of somebody who worked out a filesystem that used the "dead space"
between end-of-file and end-of-block to store data. Who cares? Somebody who
doesn't want it noticed.....



--==_Exmh_-765350396P
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQE/hGxecC3lWbTT17ARAvJ6AJ9rLMycZKoJ/1AIoXGi0EloB7xg4ACeMk/G
18zF4hyIEywiZlIpnz7XqCQ=
=vc8f
-----END PGP SIGNATURE-----

--==_Exmh_-765350396P--

[Eugen Leitl]

--98e8jtXdkpgskNou
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Wed, Oct 08, 2003 at 12:03:20PM -0700, Nicholas Weaver wrote:
>=20
> There is a hypothetical Gb optical network link between here and the
> moon, used for storage.

There's a considerable mileage of GBit/s (3 bit/m) fiber present, with
10 GBit/s (30 bit/m) consumer-grade networking in the pipeline, and ~TBit/s
(3 kBit/m) data rates feasible. =20
=20
> So who cares? Why juggle when shelves hold so much more?

Fiber is perfect FIFO for packets in photonically switched networks.
That way you avoid costly photon-electron-photon conversion, and
can even achieve relativistic cut-through routing/switching with
proper header layout.

-- Eugen* Leitl <a href=3D"http://leitl.org">leitl</a>
__________________________________________________ ____________
ICBM: 48.07078, 11.61144 http://www.leitl.org
8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

--98e8jtXdkpgskNou
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux)

iD8DBQE/hG/adbAkQ4sp9r4RAt4mAKCxT01t+8QzsHuGPeGox5VmTQxj0gCfU LdK
cMEOjxKinkbWD6SgvARg1AQ=
=bsr0
-----END PGP SIGNATURE-----

--98e8jtXdkpgskNou--

[Doug Moen]

From: "Rick Wash" <rwash@citi.umich.edu>
> This technique has one advantage that I can see being very useful -- it is
> easy to delete large amounts of data quickly. Imagine you hear the feds
> knocking on your door -- you just unplug your fiber, and let all the light
> (aka your data) fly out into the room. Your data is gone, permanently.
> If the latency is a minute, then it only takes a minute to delete
everything
> -- all 6.5 GB of data according to your calculations. Show me another
> method that can delete 6.5 GB a data in a completely unrecoverable manner
> that quickly.

A ramdisk.

Doug Moen.

[Michal Zalewski]

On Wed, 8 Oct 2003, Nicholas Weaver wrote:

> There is a hypothetical Gb optical network link between here and the
> moon, used for storage. Thus you could store a whopping 2 Gb of data, in
> a perfect network, or 256 MB. My desktop at home has more DRAM, and has
> far better access behavior. So the network layer juggling is pointless.

I think you have missed the point. Carrier media level juggling is
pointless, indeed, and we're not claiming otherwise; quite the opposite,
we consider it to be silly and we are not focusing on it. Network-level
juggling is much more interesting, because packet-processing latencies are
far higher; how much longer? There are some surprises.

> The higher level juggling is still pointless. Lets assume I still have
> the 1 Gb link to the outside world, and the data round trip latency is a
> minute (the amount of time data can be stored externally before it comes
> back to me). Thats still just 60 Gb of data, or 7.5 GB. And I'm having
> to burn a 1 Gb link to do it!

Should you actually read the paper, it would be easier to comprehend the
idea. The paper proposes several approaches that do not require you to
send the data back and forth all the time; in some cases, you can achieve
near-infinite latency with a very low "sustaining traffic" necessary to
prevent the data from being discarded. Besides, the storage size is not
the main point, the entire approach is much more interesting from the
limited deniability high-privacy storage point of view.

> If my external link is "ONLY" 100 Mb, and the latency/refresh time is 1
> minute, thats 768 MB of data.

Your latency can be much higher, that's the first observation of the
paper, and it is possible without increasing access times in many cases.
Funny.

The second observation is that not all the data has to be send back and
forth all the time. Interesting.

The third observation is that there are some interesting applications of
this approach other than storing warez. Could there be?

So, while I hate to say this, reading the paper is usually a good idea
before ridiculing it...

Cheers,
--
------------------------- bash$ :(){ :|:&};: --
Michal Zalewski * [http://lcamtuf.coredump.cx]
Did you know that clones never use mirrors?
--------------------------- 2003-10-08 20:11 --

http://lcamtuf.coredump.cx/photo/current/

[David Heigl]

You know, this topic is quickly getting out of hand, but I can't help but
wonder what you were doing spewing 6.5 gigabytes of incriminating data
around on a link with a minute of latency, just so you wouldn't have to
store it locally... Or perhaps you meant that you have a ~11 million mile
long reel of fiber in your basement?

Dave Heigl
erst-while troll and nay-sayer


----- Original Message -----
From: "Rick Wash" <rwash@citi.umich.edu>
To: "Nicholas Weaver" <nweaver@CS.berkeley.edu>
Cc: "Alun Jones" <alun@texis.com>; "'Wojciech Purczynski'" <cliph@isec.pl>;
"'Michal Zalewski'" <lcamtuf@coredump.cx>; <bugtraq@securityfocus.com>;
<secpapers@securityfocus.com>; <vulnwatch@vulnwatch.org>;
<vulndiscuss@vulnwatch.org>; <full-disclosure@netsys.com>
Sent: Wednesday, October 08, 2003 2:46 PM
Subject: Re: [PAPER] Juggling with packets: floating data storage


> On Wed, Oct 08, 2003 at 12:03:20PM -0700, Nicholas Weaver wrote:
> > So who cares? Why juggle when shelves hold so much more?
>
> Just because you and I don't have a use for this doesn't make it useless.
>
> This technique has one advantage that I can see being very useful -- it is
> easy to delete large amounts of data quickly. Imagine you hear the feds
> knocking on your door -- you just unplug your fiber, and let all the light
> (aka your data) fly out into the room. Your data is gone, permanently.
> If the latency is a minute, then it only takes a minute to delete
everything
> -- all 6.5 GB of data according to your calculations. Show me another
> method that can delete 6.5 GB a data in a completely unrecoverable manner
> that quickly. Hard drives need to be overwritten many times, but even
then
> they can still likely be recovered with enough money put toward it.
>
> Rick

[Michal Zalewski]

On Wed, 8 Oct 2003, Doug Moen wrote:

> A ramdisk.

Quite expensive, though, not to mention the data or its parts are quite
likely to get swapped out at some point. Our calculations indicate that
you can store much more data than Nicholas suggested, although with some
caveats, so paying $40 for a DSL line may be a cheaper alternative to
buying gigabytes of RAM.

There is only a limited deniability, of course, as someone might have been
sniffing on you; thankfully, some of the methods we describe are actually
"send-once, deliver keep alives later on", so it might be easier to deny
the presence of any data.

The purpose of the paper was precisely to provoke a discussion on more
ambitious uses of this media, not to announce there is a new way to store
your 1 TB mp3 collection.

That said, I'd prefer to refrain from getting into a flame war and
defending the paper by all means - you are free to judge it and to
disagree; I would simply prefer if you could give it a chance.

Cheers,
--
------------------------- bash$ :(){ :|:&};: --
Michal Zalewski * [http://lcamtuf.coredump.cx]
Did you know that clones never use mirrors?
--------------------------- 2003-10-08 22:20 --

http://lcamtuf.coredump.cx/photo/current/

[Adeel Hussain]

In-Reply-To: <75a101c38dd8$40064170$1200a70a@watdougmoen>

Show me another
>> method that can delete 6.5 GB a data in a completely unrecoverable manner
>> that quickly.
>
>A ramdisk.
>
>Doug Moen.
>
>

Section 7 of Peter Gutman's paper "Secure Deletion of Data from Magnetic and Solid-State Memory" touches on the fact that data can be retreived from RAM with varying degrees of success.

Corrections are always welcomed.

Paper available at:
http://www.usenix.org/publications/library/proceedings/sec96/full_papers/gutmann/

[der Mouse]

>> [...stuff about using the network as a delay-line storage
>> mechanism...]
> [...]
> So who cares? Why juggle when shelves hold so much more?

Because when you're storing something you don't want to be visibly seen
to be storing (typically something that's strong evidence of nefarious
activities - a simple example might be stolen credit card numbers) you
want a form of storage that disappears with few-to-no traces pointing
to you when law enforcement rolls through and seizes your computer.

/~\ The ASCII der Mouse
\ / Ribbon Campaign
X Against HTML mouse@rodents.montreal.qc.ca
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B

[Aron Nimzovitch]

Date: Wed, 8 Oct 2003 15:46:22 -0400
From: Rick Wash <rwash@citi.umich.edu>

On Wed, Oct 08, 2003 at 12:03:20PM -0700, Nicholas Weaver wrote:
> So who cares? Why juggle when shelves hold so much more?

easy to delete large amounts of data quickly. Imagine you hear the feds
knocking on your door -- you just unplug your fiber, and let all the light
(aka your data) fly out into the room. Your data is gone, permanently.
If the latency is a minute, then it only takes a minute to delete everything
-- all 6.5 GB of data according to your calculations. Show me another
method that can delete 6.5 GB a data in a completely unrecoverable manner
that quickly.


To continue, that works a few times, then the "doorknockers" realize
that everything they are after is freely available, thanks to you.
Fiber is dirt simple to tap. Plus the access latency in this approach
handicaps it for anything useful (see magnetic bubble memories). Oh,
and the alternate method is easy, no hard storage, i.e. everything in
RAM with a marginal power supply. Delay line storage has been around
for a long time, if it was useful, it would be commerical.

[Darren Reed]

In some mail from der Mouse, sie said:
>
> >> [...stuff about using the network as a delay-line storage
> >> mechanism...]
> > [...]
> > So who cares? Why juggle when shelves hold so much more?
>
> Because when you're storing something you don't want to be visibly seen
> to be storing (typically something that's strong evidence of nefarious
> activities - a simple example might be stolen credit card numbers) you
> want a form of storage that disappears with few-to-no traces pointing
> to you when law enforcement rolls through and seizes your computer.

deniable cryptographic storage
http://www.rubberhose.org

Darren

[Brandon Eisenmann]

I don't in principal disagree that data can be recovered even from DRAM,
even powered down DRAM. I have yet to hear of a case where it has been
performed for forensic reasons. Academically there are quite a few
examples of techniques for recovering data from DRAM not to mention
SRAM. The Peter Gutmann paper you mention does cover the topic
briefly, for further reading I would suggest a later more technical
paper from him titled "Data Remanence in Semiconductor Devices". You
can find it at http://citeseer.nj.nec.com/gutmann98data.html.

Also Sandia Labs did a lot of research on retrieving data from
semiconductors. I can't think of any paper titles off hand but I do
recall finding a paper or two in the "IEEE Transactions on Nuclear
Science"

There has also been some talk about freezing DRAM before powering it
down to help maintain state and aid in data recovery.

All very interesting but other than extreme cases involving national
security I doubt that anyone would spare the expense. Especially law
enforcement or forensics investigators.

-Brandon Eisenmann

On Thu, 2003-10-09 at 08:38, Adeel Hussain wrote:
> In-Reply-To: <75a101c38dd8$40064170$1200a70a@watdougmoen>
>
> Show me another
> >> method that can delete 6.5 GB a data in a completely unrecoverable manner
> >> that quickly.
> >
> >A ramdisk.
> >
> >Doug Moen.
> >
> >
>
> Section 7 of Peter Gutman's paper "Secure Deletion of Data from Magnetic and Solid-State Memory" touches on the fact that data can be retreived from RAM with varying degrees of success.
>
> Corrections are always welcomed.
>
> Paper available at:
> http://www.usenix.org/publications/library/proceedings/sec96/full_papers/gutmann/