Computer surveillance
|
|
Computer surveillance is the act of surveiling people's computer activity without their knowledge, by accessing the computer itself.
Computers make excellent surveillance tools because they can do things without their owners' knowledge or consent. Most computers have connections to networks, which can be exploited (through security cracking) to gain access to any confidential data that may be stored on the computer. Additionally, if someone is able to install certain types of software on a system, they can turn it into a surveillance device.
| Contents |
Surveillance techniques
Packet sniffing is the monitoring of data traffic into and out of a computer or network. In some networks, data transmissions are sent only to the machine they are intended for, while in others, transmissions are broadcast to all machines connected, but processed only by the target computer. In the latter cases, it is possible to packet-sniff a computer using only another computer on the same network, without placing any software or equipment on the surveiled machine.
A surveillance program installed on a computer can search the contents of the hard drive for suspicious data, can monitor computer use, collect passwords, and even report back to its operator through the Internet connection. The most common, surely, are commercial spyware designed to collect marketing data. But, such programs are not limited merely to data collection; they can also use more malicious tactics, such as removing or modifying the data. These last are often called viruses, logic bombs, and, generally, malware.
Physical (hardware) surveillance devices ("bugs") are also possible. A relatively simple bug is a keystroke logger implanted in the keyboard. More sophisticated (and more easily detected) devices with access to more information can also, in theory, be inserted into or onto the computer itself. The disadvantage of hardware devices is that placement and retrieval requires physical entry into the place where the computer is stored, and thus almost entirely restricted (legally) to law enforcement agencies equipped with search warrants. In the US, statute and precedent have also given an employer very wide latitude to gather data about employee's use of computers.
It has been shown that it is possible to surveil a computer from a distance, with only commercially available equipment, by receiving the radiation emitted by the CRT monitor. And it has been shown, by Adi Shamir et al, that even the noise emitted by a CPU includes some information about the instructions being executed.
Installing the surveillance software
The simplest way to place surveillance software on a computer is to gain entry to the place where the computer is stored and install it from a compact disc or floppy disk. This method shares a disadvantage with hardware devices in that it requires physical access to the computer.
A more difficult method is to package the software as a computer virus or Trojan horse. This tactic has the advantage of potentially subjecting multiple computers to surveillance. However, if the virus is allowed to proliferate, it will become a target of antivirus programs, which will allow the software's removal from affected computers.
Another method is to use security cracking to gain access to the computer over a network. An attacker can then install surveillance software remotely. Servers and computers with permanent broadband connections are most vulnerable to this type of attack.
Protection against surveillance
A firewall controls network access to a computer, offering some protection against crackers if properly configured. Unless it controls outbound communication as well, this offers only very limited protection against surveillance even when otherwise properly configured and operating.
A highly attractive surveillance target may face highly skilled attempts at physical entry to install software or hardware. Thus, to be truly protected, such targers should take measures such as reinforcing doors, windows and other potential entry points. Password protection can also be effective, particularly if provided by the BIOS during booting.
Protection against remote surveillance of radiation emissions is more difficult. The United States government's TEMPEST program is a standard of protection against eavesdropping of this nature. Non-CRT displays (such as LCD's or plasma displays) may be impossible to surveil in the manner. Some software (Soft TEMPEST) has been designed to alter fonts to minimize radiation. The only certain measure at other than exorbinant cost is the purchase of a specially shielded monitor. In the extreme, Faraday cage techniques to prevent escape of electromagentic radiation from equipment out of a physical volume (eg a room) is possible, though expensive.
Cables can be a serious security problem. They carry signals (eg, printing and display devices, modems, etc) from a computer to other devices, and from other devices (eg, keyboards, mice, scanners, modems, etc) to a computer. They also carry signals between computers (eg, network traffic, file transfers, security and control information, etc). Some cables can be remotely tapped without physical contact, some can be tapped with physical access to the cable, and so on. That cables are often installed in such a manner as to be invisible throughout much of their run (eg, in plenum spaces, within walls, between floors, etc), they are more vulnerable to physical tapping than is commonly appreciated.
Wireless connections between computers, between computer components (eg, keyboards, mice, printers, modems, ...) are an even larger security problem. Many wireless installations are improperly configured at installation and remain unchanged for long periods. This has inspired such things a war driving and Internet lists of insecure wireless access locations. Still worse in some sense, some wireless security protocols are fundamentally flawed, and so are insecure, even when 'properly' configured (eg, WEP, Bluetooth). As new wireless standards are developed with greater range and higher speeds, the requirement for more secure protocols and proper configuration of them will increase.
Other side channel attacks are possible and must be dealt with individually. For instance, power monitoring can provide information about computer use and power monitoring of the CPU itself can provide a good bit more. Filtering and conditioning of power lines can help (as with a continuous duty UPS), as can physical isolation of hardware preventing installation of power monitoring devices for the CPU, disk drives, etc.