Having mapped out the attacking network, you can make your own estimates of latency times. You wouldn't have to create a map of the entire network (your point #3), but just the part that's actually connecting you to the beacons. Based on that, you could intelligently adapt your ping response delays to apparently shift your location elsewhere on the Net.

This is a good point, and makes Defense Class #3 more tractable. However, keep in mind that the attacker can 'beacon' using widely different network nodes, it doesn't take much resource. The attacker can also Proxy-up as well- and if he is Big Brother, he can throw up an army of proxies. With a lot of pinging (or whatever) beacons, spread widely through the net, you can attack with more and more routes through the Internet Graph.

But I guess the final hops will nearly always be the same, and those are the important ones. So you may have a point.

Traceroute returns the time to each intermediate node in the packet's journey, so a long or varying delay at the final hop--to your computer--would show up as an anomaly.

Indeed. But it doesn't need to be a very long spoofed latency for Class #2 work, just a 'constant' within expected latencies, that could be toggled after each 'network area' scan... As long as it is adequately timed and within the expected distribution of latencies, then you can always be at a 'new' latency after the 'old' is captured. But then its achillies heel as we both know is 'how do you know when your being scanned'. Change it during a scan, and the 'take the minimum' blunt-trauma method will getcha.

Scans can also be fragmented, random and/or continuous and iterative, thus masking the scan events and making defense harder.

"Disabling ping on your computer, for the same reason, still allows them to get your general area from the penultimate nodes."

Yeah, pulling services from your computer is not going to work. If you pull all the services, then your offline, and as long as you have A service OR a mac'd ISP modem, then you are visible for this attack.

"But I'm supposed to think like a Hacker...so, how about I write a virus that goes around and surreptitiously installs proxies all around the world. Then I'd have such a wealth of proxies that I could rotate randomly through them like one of those spread-spectrum radios."

This, I imagine, is probably already part of the payload of a lot of DNS-ATTACK zombie viruses/worms. But yeah. This is simmilar to old-school data security- have your transmission float through frequencies (very narrow band transmissions) according to an algo. that you only give out to your 'buddies', who can then follow your signal trough the frequencies. Everyone else on fixed requencies just gets a 'static blip'

Note that the attacker can always proxy-up against #3 class defenses as above, rendering latency spoofs based on reverse-attacks meaningless.

"Or, just a thought, instead of spreading the virus surreptitiously, I might go public and appeal for all people concerned about privacy to voluntarily download the proxy software and participate in a countermeasure network that would benefit all participants. Kind of an open-source + peer-to-peer approach."

Agreed. peer-to-peer network centric prvacy for peer-to-peer network centric Big Brother A certain appealing symmetry. Sort of lke that distributed cryptographic OS I heard about a few years back. Even if you could decode the local stache, you only have 'shattered' fragments of data.

"you know when you're being pinged."

Well, I get pinged, ssh attempts, telnet attempts, ftp attempts, etc, all day long where I worked- all by Attack Bots looking for some sort of sloppily-opened door. I'm not sure I could tell a location-sniffing attack from a 'script kiddie in Tai-Wan' attack. and there is still an awful lot that could be done to hide the attack (flood the 'useful' sampling pings with extra random noise, etc)

Hehehe. another clever 'mass defense' would be a peer-to-peer service that switches EVERYONES latency ever second, uniformly, to a new fixed constant.

DL