It would be nice to compare all packets dumped by system and check if there are any unmatching packets running from your computer that were not sent by OS but a closed source hardware inside like Intel ME
riknos314 · 7h ago
> if possible disable encryption, then you can profit from not only timing pattern (of white noise), but also listen in on the plaintext payload. the NSA loves plaintext.
Haha, incredible.
On a more serious note this is a really cool idea. Would be interesting to listen to the same origin traffic in different network conditions to hear things like TCP rate control.
Yes kinda, I would say network activity rather then traffic. Audio signal is going to be in scale of 48Khz while measuring ethernet signal at scale of 100Mhz. At that rate it wouldn't even get more then 1 sample from a full size packet. So really it's polling 48Khz whether or not there was activity during that period. The gimmick is that it uses some analog components. Fully digital you could craft a meaningful audio signal that represents traffic.
echelon · 1h ago
This is a fun demonstration of the principle.
"every website sounds different" - that's super cool.
The bitmap images sent at the end of the video also sound really cool.
jll29 · 5h ago
In NSA parlance, a "selector" primarily is a string that semi-uniquely identifies and addresses a persons intercepted data, such as
- an IP address,
- an email address,
- a phone number,
- a SIM card's MSIN
- a person's social security number,
- a national ID card number,
- a passport number,
- a social media handle etc.
(elsewhere also known as "accessor", "key", "handle" or "index")
tantalor · 2h ago
That doesn't tell me why this is called selector.
Fnoord · 1h ago
> In CSS, selectors are patterns used to match, or select, the elements you want to style. Selectors are also used in JavaScript to enable selecting the DOM nodes to return as a NodeList.
From [1]. This nomenclature was also used way before CSS even existed; in SQL.
That doesn't help at all. What do SQL or CSS have to do with it
jonathanstrange · 5h ago
They are interesting because combining and updating them is a non-trivial problem, as I've realized today while implementing a user ban system.
Terr_ · 4h ago
There's a certain system I work with where random unauthenticated visitors on the internet end up supplying data like name/phone/email, with no validation... And of course, the business wants to somehow convert that into a list of "real people" and start correlating it to other records.
I've been trying to stop anything too terrible from happening by asking them to clarify their business requirements, e.g. what should happen when there is malicious impersonation, or the expected result should be when inconsistencies and overlaps exist.
It's not like there's no value to the data... but I'm afraid they don't really understand the problem are are hoping the magic computer can somehow *poof* garbage into fine cuisine.
transcriptase · 2h ago
“Enrichment” is what they actually want. People think it’s Google, Amazon, Facebook etc selling their data when in reality they are simply letting people target based on it.
On the other hand there are hundreds of companies nobody has ever heard of that do buy, collate, clean, and sell access to the data that apps, browser extensions, windows apps, loyalty card programs, branded credit cards, retailers, and companies that scrape LinkedIn etc will happily sell.
You provide what you have and for a price these “enrichment” services will provide what is essentially a dossier of everything that can be even remotely inferred from the thousands of datapoints they have based on your email/name/phone.
What most people think big tech is doing is actually being done in ways that are far more unsettling by companies with cutesy names and vague services that major companies sign contracts with to improve their signal to noise ratio.
grues-dinner · 2h ago
Everyone in countries with data protection laws: concern.
dylan604 · 4h ago
Since he's building a sequencer, I'm almost disappointed it wasn't named Selecta.
Rewind Bo Selecta!!
tptacek · 7h ago
There used to be a thing on SunOS (I think) where you'd get `ping` to write to /dev/audio so you could diagnose network stuff by sound.
schoen · 6h ago
You can "ping -a" nowadays to get beeps for each reply, but it's not quite as cool!
fuddy · 7h ago
One of the funnier parameters to encounter in the snoop manpage.
monster_truck · 6h ago
You can still do this with /dev/dsp or similar. Might need sudo these days
`cat /dev/urandom > /dev/dsp`
rfl890 · 2h ago
For a more modern approach, try ffplay: cat /dev/urandom | ffplay -f s16le -
jdthedisciple · 5h ago
thanks this almost crashed my pc
dylan604 · 5h ago
some people learn the hard way that blindly copying and pasting things from the interweb directly to a terminal is not always the best of ideas. some times, they're bloody brilliant
dgfitz · 5h ago
curl $url | bash is probably the only worse culprit.
0xbadcafebee · 4h ago
This one saves files to disk more efficiently by skipping the OS's bloated slow filesystem drivers and metadata. The bigger the file and faster the connection, the more efficient it is!
Good for network wiring diagnostic. It would be great if it can pipe the noise to Bluetooth audio. I can pair a headphone to it, plug this into the network in another room and still can hear it while checking the line connections on the switch/router.
hnuser123456 · 5h ago
That audio port is blasting out a total bandwidth of 100 Mbps (4 bits at 25 MHz) versus 768 Kbps for BT audio, assuming a high quality codec (16 bits at 48 KHz), so not without loss.
ww520 · 2h ago
Can be downsampled for the purpose. It's just noise after all.
hottakesbun · 5h ago
The joke is on him - I used to get this functionality for free way back in the day when (what I presume was) RF noise generated during the processing of ethernet traffic would get picked up by my cheap ISA sound card and sent to the speakers. I never built a sequencer out of it though.
sevensor · 5h ago
Back in college, I would listen to AM radio while I worked on my computer. The radio would pick up electrical noise from the keyboard and the mechanical mouse. I wonder if this sounds anything like it.
anjel · 2h ago
TRS-80s were famous for bleeding over AM band. The entire AM band.
sterlind · 1h ago
I read that the FCC really started cracking down on EM interference because early microcomputers were serious offenders. I'm guessing that's why there's a humongous RF shield inside my Amiga 1200.
rurban · 6h ago
Don't forget the GHCQ which installs a mirror on each UK modem. I don't think the NSA goes to these extremes
dekhn · 3h ago
The NSA worked with GHCQ to tap Google's fiber between data centers, which at the time, was not encrypted. You can see several presentations including "SSL added and removed here" (reference to the SSL connection being terminated at the Google front end and then transmitted unencrypted to the backend in another data center), as well as an actual BigTable packet from tcpdump that included a user identifier.
If you read The Idea Factory, it shows that AT&T leadership worked closely with NSA and other governmental agencies (on a "secret schedule" so nobody would know who the execs were meeting with) to help them access US phone data.
I'd love to know the extent of what NSA has done between its founding and today; I'm sure they've pulled off some astounding things, and bolluxed up other stuff badly.
neuroelectron · 2m ago
I doubt encryption makes much of a difference, depending on the magic numbers in your implementation.
godman_8 · 6h ago
I've worked with quite a few ISPs and exchanges. I haven't set up port mirrors for the NSA but I have setup temporary mirrors for the FBI upon request.
0xbadcafebee · 4h ago
The NSA/govt gets its own dedicated floor in some DCs, esp. large interconnects
tgmatt · 2h ago
This seems hard to believe, given how many different modems from different sources you can use, as well as thirdparty ones. Source?
stavros · 4h ago
Oh man, I really hope they don't get all my TLS connections.
simpaticoder · 5h ago
Really cool, but has anyone built software to do this locally on a PC? For example:
Haha, incredible.
On a more serious note this is a really cool idea. Would be interesting to listen to the same origin traffic in different network conditions to hear things like TCP rate control.
https://www.agwa.name/blog/post/cloudflare_ssl_added_and_rem...
YouTube explainer: https://youtu.be/vfgySTaM1TI
"every website sounds different" - that's super cool.
The bitmap images sent at the end of the video also sound really cool.
- an IP address,
- an email address,
- a phone number,
- a SIM card's MSIN
- a person's social security number,
- a national ID card number,
- a passport number,
- a social media handle etc.
(elsewhere also known as "accessor", "key", "handle" or "index")
From [1]. This nomenclature was also used way before CSS even existed; in SQL.
[1] https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_selecto...
I've been trying to stop anything too terrible from happening by asking them to clarify their business requirements, e.g. what should happen when there is malicious impersonation, or the expected result should be when inconsistencies and overlaps exist.
It's not like there's no value to the data... but I'm afraid they don't really understand the problem are are hoping the magic computer can somehow *poof* garbage into fine cuisine.
On the other hand there are hundreds of companies nobody has ever heard of that do buy, collate, clean, and sell access to the data that apps, browser extensions, windows apps, loyalty card programs, branded credit cards, retailers, and companies that scrape LinkedIn etc will happily sell.
You provide what you have and for a price these “enrichment” services will provide what is essentially a dossier of everything that can be even remotely inferred from the thousands of datapoints they have based on your email/name/phone.
What most people think big tech is doing is actually being done in ways that are far more unsettling by companies with cutesy names and vague services that major companies sign contracts with to improve their signal to noise ratio.
Rewind Bo Selecta!!
`cat /dev/urandom > /dev/dsp`
If you read The Idea Factory, it shows that AT&T leadership worked closely with NSA and other governmental agencies (on a "secret schedule" so nobody would know who the execs were meeting with) to help them access US phone data.
I'd love to know the extent of what NSA has done between its founding and today; I'm sure they've pulled off some astounding things, and bolluxed up other stuff badly.
https://slashdot.org/comments.pl?sid=46328&cid=477520411
bit evil really, they shit up almost the entire 0-30mhz
but they do work...
How are you going to name this product after the NSA, and not ship to the US???
Click through, and you'll find a more expensive version that is shipped to the US. It's called TariffBox.