Net Neutrality and the FCC

Here is a post I did at March's SAHA! event. Note the March 4th date, and then check this link out: http://www.techpolicydaily.com/communications/title-ii-law-enforcement-and-surveillance/. The whole thing was a Prezi, but it was pointed out that may not be the best method to show it in. It's all about CALEA, Net Neutrality, and the cozy relationships between various government orgs with politically-connected corporations.

Transcript of Net Neutrality

Title I provider
What were they before?
FCC - Administrative Body
By virtue of your existence, and their regulatory purview, they don't need a warrant/reasonable suspicion/probable cause when operating in their domain (think TSA and pat downs or Terry stops)
Legal Differences
FCC+CIA+DHS+FBI
FCC, as any gov't org is wont to do, has relationships with all of the other agencies and several well-heeled corporate types.
Cozy Relationships
Can you see where this is going?
FCC Rules
DHS issues take-down notices
FBI administers DCS (a system to support CALEA)
CIA had FBIS (which worked in conjunction with FCC to tap domestic broadcasts)

https://www.cia.gov/library/center-for-the-study-of-intelligence/csi-publications/books-and-monographs/foreign-broadcast-information-service/3-FBIS-New-Service-in-FCC.pdf
Unreleased (for at most 60 days)
317 Pages
3-2 vote along party lines
ISPs are now a Title II Common Carrier
What Happened
About 10 subchapters to include LE requirements (although the CALEA stuff applied to fixed location broadband providers even though they are Title I)

Old Provisions for ISPs (very short)
https://www.law.cornell.edu/uscode/text/47/chapter-5/subchapter-II/part-I

New Provisions (very long)
https://www.law.cornell.edu/uscode/text/47/chapter-5/subchapter-II/part-I

What is the difference
“Because of its position as a working branch of FCC, FBIS was for nearly a year engaged in work other than monitoring of foreign broadcasts. It was made responsible for policing domestic foreign language broadcasts. This work was started by FCC in September 1940, a year and half before FBMS was launched. At the time there were more than 200 1I.S. broadcasting stations with programs in foreign languages, and with the war in Europe these programs continually cane under suspicion. Following a growing flood of complaints, FCC decided to monitor all foreign-language broadcasts. Under the direction of Dawson, a Foreign Language Broadcast and Translation Section was set up. At one time it employed 24 translators and a sizeable staff of typists to process the recordings delivered by FCC engineers. FCC announced on 29 July 1942 that their entire section had been transferred to FBIS. “
CIA Relationship
Net Neutrality
Agency operating in their domain sees/hears
an item of interest to LE orgs. LE orgs use
parallel construction to obscure the initial
tipper. What better than the content police
for this task?
FCC hearts Connected Companies
http://en.wikipedia.org/wiki/LightSquared#FCC_authorization

LightSquared was granted a special pass to operate in bands
others were not permitted to due to interference concerns

but wait...there's more!
Who is LightSquared, and y r they speshul?
On September 15, 2011, Representative Michael Turner (R-Ohio) asked the United States House Oversight and Government Committee to investigate LightSquared under the premise that the Federal Communications Commission waived a rule for LightSquared because Harbinger Capital's Philip Falcone had made sizable campaign contributions to President Barack Obama.

IE 10+ History Format

In keeping with my constant discovery of lost accounts and prior presentations, I just checked my Prezi and found a couple of jewels. This one is on the switch between Internet Explorer History formats. Binary to ESE database (Jet API). Enjoy

Transcript of IE 10 History (old format, new system)

IE 10 History (old format, new system)
What is ESE?
Extensible Storage Engine (ESE), also known as JET Blue, is an ISAM (Indexed Sequential Access Method) data storage technology from Microsoft.
Why should I care?
Problem
All IE versions from 4.0 - 9.0 used the index.dat binary format for internet history

IE10 changed that and now uses the JetAPI which builds upon the ESE database format

There are NO current tools to parse this new format, opensource or otherwise last I checked
Dirty Shutdowns
If the database is not shutdown cleanly, which it rarely is due to being locked ALL THE TIME by taskhostex.exe
What to do?
Microsoft's JetApi to the rescue - sort of...


- blatant wiki ripoff definition
This is where IE 10
takes off
According to GetClicky and other site stat counters IE makes up about 30% of all browser use and holding. The steady drop off in 9 and below versus the rise in 10+ is why we are interested
Where is the history file ?
C:\Users\\AppData\Local\Microsoft\WebCache\WebCachev1.0.dat
Now what?
Enumerate Process handles to find who has the db opened, then kill it:


Process Inject to Force Handle Closing:


all result in a dirty db
Options with the new file
Esentutl - Microsoft exe to restore/manage ESE dbs
usage: esentutl /p

OR!!

libesedb - brought to you by, some kind folks here:
https://code.google.com/p/libesedb/


Since esentutl's restore/recovery feature has popups and warnings about data loss, I think the forensics professional in me would rather use a parsing lib than use the M$ binary

VSS API
Volume Shadow (copy) Service allows you to take a snapshot of the file in question and then copy it over to a location of your choosing (including to memory locations)



Still results in a dirty db, but using a parser lib, I'm largely fine with this
How do I use this thing?
Compile it as a static lib, and include it in your C/C++ IR tool - traditional dev way

Add as resource and roll your own PE loader - the more awesomer way (x64 still needs some work)

Getting Over the Jitters

Every now and then I am asked to give back to the community for all that I have taken away. It happens to us all. There's something that some of us forget in these "all eyes on me" times. Each one of us started somewhere. With me, it was a series of lies, damned lies, and mild obfuscation. I had a help desk gig I managed to parlay into a security career. Now, the Ferraris  and Lambos promised to me by scorpion and every other CBS crapfest haven't exactly manifested yet, but I have some hope for the future.
I was asked to do a small pep talk for a group of students going through a coding bootcamp. I'm leaving their name out since I haven't asked for permission to single them out as a beacon in a vast sea of talent-pool regenerative darkness. Plus, I curse a lot and have a generally shitty attitude on several aspects of our field; mostly things I have to put up with regarding outreach and spreading the love.

In performing this public speaking task I noticed I was much more on-point than in the past, without really prepared notes. I had a general idea of what I wanted to touch upon, but nothing incredibly detailed. People want to hear what is going to help them regarding their careers versus some nuanced view on security. I can speak to both, however I like to give the folks what they want. The way I got over my typical jitters, though, was by doing a few open mics at a local comedy club.

Nothing gets you more nervous than trying to make it through a hack bit, in front of the surliest and most critical individuals on Earth; stand-up comics. Bombing is one of the worst feelings on the planet; especially when no one knows who you are with NO respect for your previous accomplishments. You are just a face, on a stage, with a mic, talking to the masses. For extra points, try telling a racial joke in these PC times. The amount of sweat pouring out of you due to stress, and some serious stage lights, is incomparable.

Slowly, I started to notice a small part of my nerves lifting. I was quicker on my responses to an audience. My flow was better. The points I made were more cohesive. I even managed to moderate myself for a more cultured audience. Everything simply worked better.

Long story cut extremely short, find your local Giggles/LOL/Chuckle-hut and crank out some jokes. Make them as un-PC as possible. Get out of that comfort zone. After all, most of them prohibit cameras so there's no Youtube to worry about.

xoxo,
vesh