Latest / CyberPodcast / Darknets, Cybercrime & Tor: The Anonymity Debate | Paper Breakdown #9 | CyberPodcast

Transcript

Darknets, Cybercrime & Tor: The Anonymity Debate | Paper Breakdown #9 | CyberPodcast · CyberPodcast

• 0:00
  Hey there, and welcome to this explainer.
• 0:02
  Today we're going to unpack a massive invisible machine that
• 0:05
  you use literally every single day, but probably haven't really
• 0:08
  looked under the hood of. We are talking about the
• 0:11
  Internet. We're going to deconstruct
• 0:13
  exactly how your data moves, how it's tracked and surveilled, and
• 0:17
  ultimately the really fascinating ways people use
• 0:20
  advanced technology to hide that data.
• 0:23
  OK, let's dive right into this. Here is our agenda for today.
• 0:26
  We're starting with early architecture.
• 0:28
  Then we'll move into TCP/IP and packets, explore Web 2.0 and
• 0:33
  tracking, dive into network surveillance, and wrap up with
• 0:36
  Onion Routing. Section 1, the Internet's early
• 0:39
  architecture. So the sprawling public web that
• 0:43
  we all know today. It actually started out as a
• 0:45
  highly exclusive club. Back in the 1980s, networks like
• 0:48
  NSF NET only connected a handful of elite supercomputing centers.
• 0:52
  But then in 1989, a massive shift happened at CERN when
• 0:55
  scientist Tim Berners Lee proposed a linked Information
• 0:58
  system. By 1990, he placed the very
• 1:01
  first HTML documents on a CERN server, literally the world's
• 1:05
  first website. And then, in a massive leap for
• 1:07
  public access, 1993 was the year the World Wide Web source code
• 1:11
  was just given away to the world in the public domain.
• 1:14
  Now you might be wondering, why was HTML created in the 1st
• 1:16
  place? Well, it was born purely out of
• 1:19
  practical need. See, physicists at CERN were
• 1:21
  generating just massive amounts of nuclear research data, and
• 1:25
  they were constantly dealing with computer incompatibilities
• 1:27
  that prevented them from collaborating electronically.
• 1:30
  Without a central repository, these scientists had to download
• 1:33
  massive personal libraries of material just to do their jobs.
• 1:36
  So Berners Lee created HTML to build static linked documents.
• 1:40
  It was a global hypertext system, so physicists could
• 1:43
  finally pool their information in a single space without having
• 1:46
  to download the whole shebang locally.
• 1:48
  Section 2 Teaching TCPIP and packets To understand how the
• 1:52
  Internet actually moves all this information, we really need to
• 1:56
  look at the TCP/IP protocol suite.
• 1:59
  The easiest way to think about this is using the physical mail
• 2:02
  system. When you send a massive amount
• 2:04
  of data over the Internet, it doesn't just travel as one giant
• 2:06
  clunky block. Instead, TCP slash IP breaks it
• 2:10
  down and encapsulates it into small, manageable envelopes or
• 2:13
  packets of information. These little digital envelopes
• 2:16
  are then electronically routed to a specific destination
• 2:19
  Internet Protocol or IP address. It's a brilliant method,
• 2:22
  honestly, because it enables multiple users to easily share a
• 2:25
  single communication line at the exact same time.
• 2:28
  But here is the catch. Every single one of those
• 2:31
  digital envelopes has ATCP slash IP header, and that header
• 2:35
  contains the unique IP address of both the sender and the
• 2:38
  receiver. This is an inherent
• 2:40
  vulnerability because while the data inside the packet can be
• 2:44
  heavily encrypted and hidden away safely, the header itself,
• 2:47
  the part containing the delivery addresses, remains completely
• 2:50
  unencrypted and visible to anyone observing the network.
• 2:53
  By simply examining a single TCP IP packet, an outside observer
• 2:57
  can deduce exactly who is attempting to communicate with
• 3:00
  whom. Section 3, Web 2.0 and browser
• 3:04
  tracking. Let's contrast Berners Lee's
• 3:06
  first generation web with what publisher Tim O'Reilly later
• 3:10
  popularized as Web 2.0. The early web was entirely
• 3:13
  static. You actually needed to
• 3:15
  understand the HTML programming language just to publish
• 3:18
  anything. But Web 2.0 changed the game.
• 3:21
  It brought in server side scripting and databases, making
• 3:24
  everything dynamic. A huge player here was the
• 3:27
  widespread acceptance of Cascading Style Sheets, or
• 3:29
  CSSCSS, separated the human information embedded in a web
• 3:33
  page from the machine code responsible for formatting it.
• 3:36
  Suddenly, users could easily manipulate web content through
• 3:39
  visual interfaces without needing to write a single line
• 3:42
  of code. This completely transformed the
• 3:44
  web into the highly interactive applications we use today, like
• 3:47
  Amazon or eBay. But interacting with these
• 3:50
  dynamic sites definitely leaves a trail.
• 3:53
  When you connect to a website, it records information about
• 3:56
  your interaction using cookies. Think of cookies as digital name
• 4:00
  tags. They are uniquely identifiable
• 4:03
  files placed right on your system.
• 4:05
  Every single time you click a link or enter information, the
• 4:08
  server records that action and associates it with your specific
• 4:11
  cookie. This mechanism allows servers to
• 4:14
  chain a whole series of your interactions.
• 4:16
  Together, they can dissect vast amounts of behavioral data to do
• 4:19
  things like adjust ad placements for you in real time.
• 4:23
  Now, what's really interesting about this slide is that you
• 4:26
  don't even need cookies to be tracked.
• 4:28
  Yeah, most browsers just default to handing over incredibly
• 4:31
  specific details about your computer just to display a web
• 4:34
  page properly. We're talking about your
• 4:36
  specific operating system version, the exact browser
• 4:39
  you're using, the number of fonts you have installed, or
• 4:42
  even your screen resolution. So without clicking anything at
• 4:45
  all, servers can combine these highly specific details to
• 4:49
  create a unique browser footprint just for you.
• 4:51
  This footprint can then be correlated with TCP/IP data to
• 4:55
  clearly and unmistakably identify you and reveal exactly
• 4:59
  what content you're viewing. That level of corporate tracking
• 5:02
  is just a daily reality for most Internet users at this point.
• 5:05
  But it brings up a huge question, What happens when this
• 5:09
  sprawling network of data is monitored and controlled on a
• 5:12
  much grander scale? We're moving away from everyday
• 5:15
  ad tracking now and into the much more complex reality of
• 5:18
  state level network surveillance and censorship.
• 5:21
  Section 4. Network surveillance and
• 5:24
  Metadata. Researchers John Palfrey and Hal
• 5:27
  Roberts categorize network surveillance into 3 distinct
• 5:30
  levels where actors can intercept and control traffic.
• 5:33
  First up is the network level, which functions basically like a
• 5:36
  wiretap in cyberspace, collecting data as it passes
• 5:38
  through central routing notes. Second is the server level,
• 5:42
  which involves the intrusive collection of your IP address,
• 5:44
  your search terms, and those cookies we were just talking
• 5:46
  about. And finally, the most invasive
• 5:48
  is the client level. This is the clandestine
• 5:51
  installation of key loggers, webcams, or hardware monitors
• 5:54
  directly onto your personal machine by a secondary actor.
• 5:58
  Now you might be thinking, well I'll just encrypt my data,
• 6:01
  Problem solved. Actually, scratch that, it
• 6:04
  doesn't completely hide your activity, and that is because of
• 6:07
  metadata analysis. Even if you encrypt your data so
• 6:11
  the contents are completely unreadable to anyone else,
• 6:13
  metadata patterns still reveal your secrets.
• 6:16
  Observers can deduce the exact type of communication taking
• 6:18
  place simply by examining the time, the duration, and the size
• 6:21
  of the data being passed. For instance, streaming a video
• 6:24
  produces A vastly different and distinct packet size pattern
• 6:26
  compared to just sending an e-mail.
• 6:28
  The encryption might hide the actual words you wrote for sure,
• 6:31
  but the metadata clearly shows the shape of your behavior.
• 6:34
  And where is all this metadata collected?
• 6:36
  It happens at centralized junctions known as Ipxs, where
• 6:40
  major Internet service providers overlap and autonomous systems
• 6:44
  or ASS that control huge banks of critical routers.
• 6:48
  These basically act as major choke points because the
• 6:51
  Internet is a massive web like MASH.
• 6:53
  All this traffic traversing these centralized nodes makes it
• 6:56
  theoretically possible for governments to monitor and
• 6:59
  perform traffic analysis on both national and international
• 7:03
  Internet data, crossing rates through their borders.
• 7:05
  ECTION 5. Onion routing and anonymity.
• 7:09
  Which brings us to the technological response to all
• 7:11
  this surveillance anonymizing networks.
• 7:14
  The most prominent of these technologies is Tor, which
• 7:16
  stands for The Onion Router. Now, Tor often receives pretty
• 7:20
  extensive media coverage for its association with virtual black
• 7:23
  markets, but looking at it purely objectively, it is an
• 7:25
  anonymity technology designed specifically to prevent
• 7:28
  electronic eavesdropping. It achieves this by encrypting
• 7:31
  the contents of packet data and masking that sender and receiver
• 7:34
  information located in the TCP IP headers we discussed earlier.
• 7:38
  It provides a really critical shield for privacy, particularly
• 7:40
  for users operating in contested Internet zones who absolutely
• 7:43
  need a tool to access information anonymously.
• 7:46
  And this brilliantly illustrates exactly how Tor defeats metadata
• 7:50
  traffic analysis. It's a three-step process.
• 7:52
  Step one, it seals the packet's ultimate destination inside 3
• 7:56
  distinct layers of encryption. Step 2, it routes this data
• 8:00
  through a constantly shifting network of thousands of
• 8:02
  dedicated relays. And Step 3, as the data passes
• 8:05
  through this network, one layer of encryption is peeled away at
• 8:08
  each relay stop. Literally just like peeling the
• 8:10
  layers of an onion, By the time the data actually reaches its
• 8:13
  destination, the original sender's identity is
• 8:15
  mathematically decoupled from the receiver.
• 8:18
  To ground this technical abstraction in reality, let's
• 8:21
  consider darknet marketplaces like the pirate market.
• 8:24
  Because Tor successfully masks the IP addresses of both the
• 8:27
  people hosting the website and the people visiting it,
• 8:30
  platforms exactly like this can offer a broad range of goods and
• 8:33
  services with complete anonymity.
• 8:35
  They operate entirely shielded from standard network
• 8:38
  surveillance, which brings us to the really complex dual nature
• 8:42
  of this technology. We've seen how tracking and
• 8:44
  metadata can completely strip away our digital privacy, right?
• 8:48
  And we've also seen how tools like Tor can mathematically
• 8:50
  restore it. But as Internet censorship and
• 8:53
  surveillance become a growing global norm, we really have to
• 8:56
  ask ourselves, is anonymity a critical shield for privacy and
• 8:59
  free speech, or is it a perilous enabler of cybercrime?
• 9:03
  It's a fascinating, deeply unresolved challenge at the very
• 9:06
  core of our modern Internet. Thank you so much for joining me
• 9:09
  for this explainer, and I hope this helped you truly understand
• 9:12
  the complex layers of the web we navigate every single day.