Smuggling USB Sticks

http://shkspr.mobi/blog/2012/11/smuggling-usb-sticks/

by edent • 14 years ago

219 93 14 years ago

dexter3132• 14 years ago

It takes about 2,89 days on a 1 Mbit connection to download 32 GBytes.

4ad2• 14 years ago

It's about upload, not download. Download in Iran is usually restricted to 128kbps, upload probably is significantly less.

Also, you completely missed the point of the article.

pyre• 14 years ago

Getting information into Iran is probably just as important as getting information out though. While the specific example would be about upload speed from Iran, the over-arching issue is about upload and download speed.

eknkc2• 14 years ago

I'm currently uploading my iPhoto backup to Amazon S3. It will take 2 more days. Would be glad to have an option to mail the files in a card or something like that.

cbr• 14 years ago

http://aws.amazon.com/importexport/

objclxt2• 14 years ago

You can - http://aws.amazon.com/importexport/

Well, not a SD card, but you can mail Amazon a HD and they'll transfer it over for you. It may not suit your particular use case, but people do use it.

eknkc2• 14 years ago

Yes I've seen that but I belive it's more suitable for high volume data, say, tens of terabytes or more. As the prices are high for something like my personal backup.

tomerv• 14 years ago

Also known as "Sneakernet" (http://en.wikipedia.org/wiki/Sneakernet)

bigiain2• 14 years ago

And the old "never underestimate the bandwidth of a station wagon full of backup tapes"

(and the modern version of that calculation, a station wagon fill of microsd cards, is calculated at 500gig per second here: http://www.dansdata.com/gz105.htm )

craigmoore• 14 years ago

Love that term, "Sneakernet". Would love to see an analysis of a modern day sneakernet. This article just seems to remind us that it is possible.

zokier• 14 years ago

32 gigabytes for 20 "high definition" movies? That's 1.6GB per movie. Seems awfully low, compared to eg Blu-Ray. Afaik movies on blurays are in the 20GB range, ie. an order of magnitude larger than the presented 1.6GB. Even movies downscaled to 720p are usually sized to fit a DVD5, 4.3 GB, still much larger than 1.6GB.

Point being that movie files are still quite huge.

Also, transferring 32GB over fairly modest 10Mbps line takes roughly 7 hours, far less time than what it'd take via post service.

dexter3132• 14 years ago

I don't that cubans have many 10Mbps connections.

icebraining• 14 years ago

Due to the asymmetric nature of most end-user lines, 10Mbps of upload bandwidth seem far from modest. Around here you'd need a 100mbps (download) line, which is available but pricey, and as far as I know they're not even available in most of the world.

If you're talking about countries where this censorship is common, even a 10/1 line is probably not affordable by anyone except an elite.

edent• 14 years ago

Very true. I'm on "Superfast" broadband in the UK. That means 16Mbps down, 1.3Mbps up. The only way to get 10Mbps up is to be on fibre-to-the-premises. And even then only if you live in one of the blessed areas.

electromagnetic3• 14 years ago

I think in censored countries, a 10/1 line is essentially non-censored. The only people who would be getting that are government officials or company executives who are in bed with the government.

I think the premise of the article is flawed, because I have a 16/2 connection. I recently express mailed an envelope across country (GTA to Vancouver) and it took approximately 4 business days and cost me ~$12. To do this through the internet, we're looking at 1.5 days for my internet connection (assuming upload is the speed issue). Even at the average 10/1 connection, we're talking 3 days. Still beats mail, and god forbid you mail on a thursday and it takes 6-7 days to get the mail through. What about from Canada to Australia? Well an express letter, you're looking at 2 weeks if you're lucky.

Remember, this is only a product of our lazy ISPs happy to keep service where it is whilst bumping up prices. If Google Fibre has an effect on the market this discussion is meaningless. Up to 1gbps up and down. This discussion is meaningless if it only attains 10mbps upload, it won't even leave the post office in the time it would take to transfer.

The notion that SOPA et al will destroy the internet is a little absurd, all it will do is expand the darknet, which will cause rapid expansion.

Think what Tor would be if every computer in the world was on it and acting as a proxy. This is what governments will force to happen with restrictive legislation and our "controlled freedom" will become uncontrollable freedom.

optimo• 14 years ago

DVD/Bluray typically use MPEG2- for the sake of discussion this is 'uncompressed' because studios don't make raw video data available. Many consumer videos are transcoded into a more compact MP4 format - of course you need a specialized device or a PC to watch MP4. Most media players nowadays can support mp4 decoding, however. It's not the same quality as mpeg2, but passable to the casual viewing audience, mp4 uses predictive motion encoding, spatial and temporal compression, and reduced chroma sampling sometimes. Modern video streaming services now all probably use moderate-complexity mpeg4 encoding, resulting in a lower bandwidth. (movies rented from Apple, amazon, netflix, etc). A 1.6 Gbyte mp4 file is decent 720p depending on the scene contents and length of the video, at a fixed bitrate.

edit: and it's worth noting that these small video files will typically strip the multi-channel audio and favor a remixed stereo-only sound track. saves more bytes.

edit: kudos to poster below for clarifying my half-baked explanation.

eigenvector• 14 years ago

MP4 is a container format, MPEG2 is a compression algorithm. A variety of video and audio compression algorithms can be used inside the MP4 container although H.264 is probably the most common.

DVD does use MPEG2. Blu-ray supports a variety of algorithms for video and audio with the BDAV container (.m2ts), commonly MPEG2, H.264 (AVC) and VC1 for video and DTS-HD MA, Dolby TrueHD and garden-variety LPCM for lossless audio.

Today, most Blu-rays are being authored with H.264 or VC1 encoding for video. That being said, space savings are achieved by trans-coding the raw .m2ts to much lower bitrate H.264 and downmixing the audio to, say, 620kbps DD5.1 or even just stereo.

Hupo• 14 years ago

To add to the clarification, both DVD and Blu-ray content is basically always sampled as YUV 4:2:0, and basically no transcode ever changes that. Masters generally have higher chroma sampling (eg. 4:2:2) but this is reduced to 4:2:0 when the content is put on DVD/BD, not by encoders further down the chain. Masters can also have a higher bit depth (eg. 10-bit) per channel which is then converted to 8-bit for DVD/BD.

Also, multi-channel is rarely downmixed to stereo in case of HD content - for Blu-ray rips, however, only the core from Dolby TrueHD (640kbps AC3) or DTS-MA (1536kbps DTS) is generally used (at least in case of western content) instead of the full lossless audio (and in cases where lossless audio is used it is generally converted to FLAC because it compresses better).

Just because rips have drastically smaller filesizes doesn't mean that they're going to have drastically lower quality, though - Blu-ray has limitations in the amount of H.264 features that can be used, and encoding applications also matter. x264, which is a FOSS H.264 encoder, is generally recognized as the best H.264 encoder in the world. If you use x264 and go above Blu-ray limits, hell even H.264 level 4.1 limits, or even encode in 10-bit, it's not uncommon that you'll be able to shave off over 50% of the file's original size or more (compared to the original .m2ts file on the BD) with no discernible loss in video or audio quality. In case of western content, people tend to mostly stick to level 4.1 8-bit H.264, though, because of hardware compatibility. 5.1 DTS/AC3 core is used instead of say, 5.1 AAC is used for compatibility reasons as well - because S/PDIF can't do 24-bit 5.1 LPCM.

There is one scene that cares very little about hardware compatibility, though: the anime scene. You can find pretty much the most advanced video, audio and subtitle formats in use there, with 10-bit H.264 video going up to level 5.1, AAC/FLAC audio, very complex ASS subtitles, Matroska ordered chapters... it's quite fascinating, really.

4ad2• 14 years ago

For a very expensive, not modest, line in Iran download is restricted to 128kbps while upload is probably less than that.

But you completely missed the point the article is trying to make...

objclxt2• 14 years ago

I used to work in a Middle Eastern country that fairly aggressively filtered the net and where officially most DVDs, games, and books were banned.

Of course, unofficially you just had to pop down to the souks where you could get anything (pornography included) burnt to DVD. I used my time there as an excuse to digitise my DVD collection, since they certainly weren't going to let me get away with bringing them into the country, whereas a USD hard-drive went pretty much un-noticed.

It seems to me that whilst there are a few countries which enforce a totalitarian approach to censorship (like North Korea), others really just do it for 'appearances', because to not do so would be culturally unacceptable. Certainly pretty much everyone I met was circumventing censorship (both in net and print).

EliRivers• 14 years ago

This is by design; when you set up a situation where everyone is a criminal, any time you decide you want to haul someone in or stick someone in jail, you'll have no trouble finding something they're guilty of.

seanmcdirmid5• 14 years ago

Everyone is guilty of something is pretty much how China works, they even have contradicting laws on the book to ensure this.

A related interesting effect with respect to corruption: any official is corrupt, and can be brought down at anytime because of that. Squeaky clean officials are not trusted because the "nuclear option" won't work on them, so they aren't promoted, leading to a downward spiral in quality.

A reasonable fair legal system is very important, I feel like we take it for granted in the west that things could be much worse.

dharmach• 14 years ago

Traffic laws work the same way. Put such speed limit (for example) that almost all drivers are breaking the law, and then pick and choose.

stephengillie• 14 years ago

Likewise, when you need someone to inform or plant something, you can tell the person "We know you did X, but we'll ignore it if you do Y for us."

scrrr• 14 years ago

The article the author points to on Cuba is very good. I have been to Cuba and I find it quite accurate. Indeed, the news also spread via USB stick. If you ever go to Cuba why not bring some data. Be it music, video or pages of the Spanish Wikipedia..

chimeracoder4• 14 years ago

> If you ever go to Cuba why not bring some data. Be it music, video or pages of the Spanish Wikipedia..

I'd certainly hope that they already have a copy of that, given that an entire dump is <32 GB[1], depending on how much meta-info (edit history, etc.) you want to include.

From there, all you have to do is smuggle in the diffs every now and then, which should be minuscule.

[1]http://dumps.wikimedia.org/eswiki/20110911/

DanBC• 14 years ago

It'd be great to think that things like Usenet, FIDOnet or similar are still being used with people sneakernetting USBsticks around.

gbog3• 14 years ago

Another bucket of fuel to my pool of reasons to think the "Cloud" is misguided.

Last time in a Pycon conference in Beijing, 5/4 speeches were about new cloud offers (it was advertising actually). This makes no sense.

People should not do their stuff in free apps running on devices they don't really own, and these apps should not store that stuff in a cloud vaguely rented by the app maker.

Instead, people should use open tools, running on devices they own, storing things on some storage they own and control.

On my bed, I can use my tablet to browse pics I have taken with my phone, while listening to music I have ripped on my desktop long time ago. It seems necessary to be able to do so, but it is not necessary to hand over all your stuff to Apple or Google or Dropbox to do so. (And all your things should be right there even if you ISP is down.)

The obvious solution I used is a "local cloud" (just a samba server on a little Raspberry Pi actually). But on Android strangely only very few media players on devices acknowledge this need and let my slide pics, listen to music or watch video from the LAN. (I have no idea on iOS, I suppose it is even worse, do they have VLC on iOS?)

edit: clarify

uptown• 14 years ago

VLC was available on the App Store for a very limited time. It was pulled over licensing issues:

http://obamapacman.com/2011/01/vicious-nokia-employee-gets-v...

crististm• 14 years ago

This makes it even more important that people should not trust Trojan horses in the form of "clouds". I happen to agree with the EFF position on this.

rmc2• 14 years ago

Wow that's a biased and skewed article. The truth is Apple do not allow GPLed software on the App Store, and hence do not allow easy install of GPL software on iOS (iPad & iPhone). Microsoft are fine with people installing GPL software on MS Windows OSs. The problem is Apple's strict rules about licencing and software installation, not a "vicious Nokia employee who just doing it because Apple & Nokia are compeditors". I assure you, there are many Free Software/Open Source developers who are ethically and morally opposed to the App Store idea.

ebiester3• 14 years ago

Two (sets of) questions.

1. What do you do if your house burns down? What happens to the documents you care about most? Do you keep a USB drive in a safety deposit box and retrieve it regularly?

(I have a local USB backup, and I have a remote backup through the cloud.)

2. Do you have this local cloud poked out to the outside? How do you handle security? Is there a simple web interface that you can get to something when you're away from the house and your personal equipment?

meaty• 14 years ago

What I do:

1. fire safe. 200kg one. Usb stick in it, although I'm considering switching to DLT. USB stick in my bag. Both encrypted with truecrypt at moment.

2. Do without it. Got a moleskin with everything useful in it.

note: I use a film camera and have cds so my media load is quite low. Negatives live in the fire safe and I have a list of cds in a text file so will just buy them again. I also bin emails. My data volume is approximately 800mb. Not much.

mbell2• 14 years ago

> 1. What do you do if your house burns down?

I backup important stuff encrypted to S3 with a script.

> 2. Do you have this local cloud poked out to the outside? How do you handle security? Is there a simple web interface that you can get to something when you're away from the house and your personal equipment?

I use pfSense [0] as a router / security appliance running on a Atom based micro ATX board with a 4 ethernet ports. I connect remotely using OpenVPN terminated at the pfSense box and use Viscosity [2] on the client side. File storage is on a FreeNAS [1] server. Very easy to setup if you have basic networking knowledge. The only downside is that there is no built in support for OpenVPN in iOS. There is an app that handles it if your device is jailbroken.

[0] http://www.pfsense.org/

[1] http://www.freenas.org/

[2] http://www.sparklabs.com/viscosity/

npsimons• 14 years ago

Do you keep a USB drive in a safety deposit box and retrieve it regularly?

Yes. Why don't you? It's not that hard, and a hell of a lot more reliable and secure than cloud storage.

Blah, blah, blah. This isn't the 90s, you know. We do have things like Apache/Nginx with self signed SSL certs these days (not to mention SSH, rsync, VPNs, etc, etc), and it's not that hard to setup (used to be a right of passage for geeks; these days it's considered entrance exam to the equivalent of geek pre-school). Things are also getting better everyday with projects for "personal clouds" (aka, your own file server with a web interface).

Zirro• 14 years ago

I use StreamToMe (http://projectswithlove.com/streamtome) on iOS, and there are a number of similar apps.

mbell2• 14 years ago

> (I have no idea on iOS, I suppose it is even worse, do they have VLC on iOS?)

iOS's built in players will play arbitrary media files as long as the codecs are supported, you just need to have a file browser application that can open it locally or on an SMB share. I use one named 'FileBrowser'[0] on my iPad that has worked well so far.

[0] http://www.stratospherix.com/products/filebrowser/

nzmsv• 14 years ago

I found DLNA to be a better solution than SMB for this application, though it will still need a separate app on Android. minidlna should be a good fit for the Raspberry Pi. Apple is doing things their own way (DAAP), but you could probably run a DAAP server as well to cover all clients.

aes2562• 14 years ago

DLNA is awesome. I have a DLNA server set up to share my music, films and tv shows around my home network.

All my TVs are DLNA enabled and on the network, and I just use NFS to access files from my desktop/laptop.

gbog3• 14 years ago

Yes, I think my next step is to give DLNA and UPnP a try. What I like with SMB is that it is a barebone tree of files, and so I get a better control than with tools needing a database, a protocol or anything more.

StavrosK• 14 years ago

I don't understand what the cloud has to do with the post, but you can run an HTTP server on your Raspberry Pi, and all the players I have on Android (mainly MX Player) work fine. Videos even open right from the browser in the player, without any hassle.

gbog3• 14 years ago

> what the cloud has to do with the post

These USB stick stories tell us that, in fine, "existing" data has to have one physical location (or more). The cloud is not magically breaking this "existence principle". Instead, cloud user and data owners (or are they?) are just trusting a third-party service with the physical existence of their data.

The fast that people are able to smuggle slices of the Web in SD cards should remind us that issue, as much as the next big data loss or leak.

rb2k_• 14 years ago

Should people also have their own power plants, wells, car factories and farms?

There are certain advantages when you "oursource" your basic infrastructure. As long as inter-device connections are still problematic (NAT, STUN, ...) and as long as harddrives die, I really enjoy being able to trade money for free time rather than setting up a redundant off-site backup system.

EwanG• 14 years ago

Why not?

I mean there are certainly folks doing "off the grid" experiments that are moving this way, and I can certainly see a future where you create enough power for most of your home needs locally, including using some version of a 3D printer to build common items out of stock you have around the house (once they can also accept such). Things that are too costly to build at that scale or require special feedstock could be built by a neighborhood machine (much like mills used to service their neighborhoods), with the feedstock being ordered as needed.

Yes, as long as it is massively inconvenient there is a benefit for trading money for free time. But I would like to spend some of that free time making it possible for me to have a choice of my own - rather than a choice for my provider (who likely will eventually decide they need to make a profit).

specialist• 14 years ago

Mature commodity items, services tend to be well regulated. Because it's generally better for customers and therefore economic activities.

We barely have SLA standards for uptime, privacy, data breaches, etc.

It's cool to be a pioneer. But you're largely on your own. A trade off.

endgame• 14 years ago

The electricity company doesn't try to tell me what devices I can plug into my power points. The water company doesn't call me a thief for pouring a glass of water for my friend. The car factory doesn't weld closed the bonnet of its vehicles and the farmer doesn't whine about lost profits because I dare to have a herb garden in my back yard.

piggity• 14 years ago

Nothing wrong with using the cloud as long as you really understand what you're getting yourself into.

* Use a vendor specific extension - e.g. EBS + snapshots to mount customer data volumes - make sure you can work around it easily if you move to another provider. * Backup data inside the same cloud provider? - make sure you backup the backups in case of catastrophic cloud provider failure - not doing that? then you need to understand what your risk profile is? * Only use 1 provider? What is your strategy if they fail, temporarily or permanently? Where is your data? How do you fail if they fail?

So on and so on - these are standard considerations in a business risk analysis / disaster recovery plan - but I many IT shops in the cloud are staffed by people who are great at code, but have never dealt with the vagaries of business practice - not their "fault" - but it is a blind spot I see quite often.

nathan_long• 14 years ago

>> people should use open tools, running on devices they own, storing things on some storage they own and control.

I agree with your sentiment that "we shouldn't let others control our stuff." However, that doesn't mean you have to completely forego the advantages of cloud services.

For example, you can encrypt your data before backing it up to a storage providers. You haven't lost any freedom there; the worst case scenario is that they don't provide the reliability you paid them to provide. You can mitigate that risk by using more than one provider.

keithpeter• 14 years ago

http://deaddrops.com/

Internet without cables? Dead drops started as an art experiment...

ianlevesque• 14 years ago

> I don't know what will happen to the Internet. SOPA, DEA, and HADOPI all conspire to break the way we share knowledge - under the benign guise of copyright protection. And yet all it takes is a dozen USB sticks, a few memory cards, and very little effort to break their embargo.

For the technically savvy, yes. But by enacting these changes, governments and other interests can dramatically alter the mainstream discourse and culture negatively. Having a difficult technical means for a few to work around the damage won't prevent the overall harm.

stcredzero• 14 years ago

How about an update of Fidonet where people just have to take laptops into internet cafés, such that laptops pass such data to each other with no intervention from users? This wouldn't replace the USB Sticks, rather it would supplement the distribution. (For WPA protected networks, there may have to be some mediation to establish the first connection.)

bitwize• 14 years ago

When I saw Johnny Mnemonic again recently, I thought to myself that he could probably get more done -- at less personal risk -- by swallowing condoms full of micro-SD cards.

electromagnetic3• 14 years ago

Agreed, but I believe the original purpose is that if he's killed the data is rendered useless. For organized crime, killing you to get micro-SD cards out of your gut is probably preferable to waiting for you to pass them.

I think there's only one real reference to this in the movie. It's supposed to be a super-secure way to transfer data. However, personally if the data was that important I'd just say "you come to me", because honestly if I got the cash I wouldn't care if you got shot 5 feet outside my building.

chimeracoder4• 14 years ago

> For organized crime, killing you to get micro-SD cards out of your gut is probably preferable to waiting for you to pass them.

Not if they're encrypted well enough and the data is somewhat time-sensitive!

....have we just found the solution to this XKCD? http://xkcd.com/538/

chiph• 14 years ago

You can hide the micro-SD cards inside some of the coins sold by spy-coins.com (they're also sold by ThinkGeek). Only downside I've noticed is that when you drop one of the coins onto a hard surface it doesn't sound right - the "ring" it makes is different. But if you have it in with a handful of legit coins, it passes without notice. Just don't spend it by accident. ;)

dahlia1• 14 years ago

I smell something rotten. Hide a microSD in a cake? If security and customs missed a cake going thru you think they would manage finding it stuck in your shoe?

philip1209• 14 years ago

You could tape a micro-SD card to the bottom of your foot, under your sock, and the TSA would never find it. Just opt for the pat-down, and they have never checked the bottom of my feet before.

jmmcd• 14 years ago

Bad title! The only smuggling is of an SD card. The USB sticks in Cuba are "passed around", not smuggled.

(Everyone's being pedantic about the numbers, so I felt entitled to be pedantic about something else.)

Aissen• 14 years ago

As usual, relevant xkcd: http://xkcd.com/691/

greenyoda• 14 years ago

Smuggled USB sticks are the 21st Century version of samizdat.[1]

[1] https://en.wikipedia.org/wiki/Samizdat

Smuggling USB Sticks

Related Stories