It is mentioned in almost every where that very strong agencies, and governments are able to watch the online activity of the people. Aside from techniques like attacking computer networks, and installing spyware on them, like the toolkits the Hackingteam provides, what techniques can be used to see your VPN or SSH traffic (again aside from the techniques like contracting the SSH server provider, or installing some kind of spyware on it or that sort of thing).

I am mostly interested in the science of it all and how these techniques work from a scientific point of view.

  • man in the middle at the ISP level. They perform the handshake and provide the site's certificate. Simple. It's well known that the US stores all internet traffic unencrypted. If the entity does not have access to ISPs, things get a little harder. It's pretty popular to install shells on servers to compromise them. They just detailed this in the guv'ment report on the Chinese hacking of Equifax: justice.gov/opa/press-release/file/1246891/download – pcalkins Feb 12 at 23:56

You seem to exclude quite a number of attack vectors. To summarize (an correct me if I'm wrong), out of scope:

  • Compromise of the client
  • Compromise of the SSH or VPN server
  • Comprise of network infrastructure
  • Collaboration of the VPN provider or SSH server administrators

I do believe the problem is over simplified by not considering these attacks. Certainly, the government agencies use these techniques to eavesdrop on your communication.

If the government has collaboration from your ISP or has a monitoring device in the network, they are still able to see source and destination of SSH and VPN traffic. So they know what VPN provider you are using. What bandwidth is being used and what the timing of this traffic is. Some information can be gained from this. A user browsing a website will had a low throughput whereas an attacker ex-filtrating data over SCP will have a high throughput which is fairly consistent over time. Agencies have knowledge of certain IP ranges owned by certain ISPs, countries, companies. This helps them in determining the goal of the traffic.

| improve this answer | |
  • Certainly, obviously the most obvious way for a government is to directly gain access to user devices or ISP, or hack or somehow contract the SSH or VPN provider and server. It is obvious, but just like I said I was mostly looking for technical mostly science related stuff. I was hinting on if it was possible for governments to attack the protocols directly. like how will they know which YouTube video you are watching on Tor network, by only watching your traffic? – JackBixuis Jan 18 '19 at 21:52
  • It's very difficult to know which YouTube video is being watched by only watching traffic unless the video is popular enough that the set of possible traffic patterns is low. – forest Feb 17 '19 at 10:07
  • if they are at the ISP level, they see what you send out and what comes back... it doesn't matter how many proxies it hits in between. – pcalkins Feb 12 at 23:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.