Slashdot Log In
Enhanced Carnivore To Crack Encryption Via Virus
Posted by
timothy
on Tue Nov 20, 2001 05:36 PM
from the trust-us-once-again-ma'am dept.
from the trust-us-once-again-ma'am dept.
suqur writes: "MSNBC has a story about a new Carnivore feature, dubbed 'Magic Lantern,' which arrives on a victim's computer in the form of a virus through email or well-known vulnerabilities. Magic Lantern uses keylogging to extract keys typed in, and sends them off to the FBI. This is similar to a story reported on previously, but taken one step further, allowing computers to be compromised remotely."
Related Stories
[+]
Your Rights Online: FBI Remotely Installs Spyware to Trace Bomb Threat 325 comments
cnet-declan writes "There have been rumors for years about the FBI remotely installing spyware via e-mail or by exploiting an operating system vulnerability from afar — and now there's confirmation. Last month, the FBI obtained a federal court order to remotely install spyware called CIPAV (Computer and Internet Protocol Address Verifier) to find out who was behind a MySpace account linked to bomb threats sent to a high school near Olympia, Wash. News.com has posted a PDF of the FBI affidavit, which makes for interesting reading, and a summary of the CIPAV results that the FBI submitted to a magistrate judge. It seems as though CIPAV was installed via e-mail, as an article back in 2004 hinted was the case. In addition to reporting the computer's IP address, MAC address, and registry information, it also gave the FBI updates on which IP addresses the user(s) visited. But how did the FBI get the spyware activated and past anti-virus defenses? Two obvious ways are for the Feds to find and exploit their own operating system backdoors, or to compromise security vendors..."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Legal? (Score:5, Insightful)
And what happens if this "happens" to get installed on a foreign government's computer? Can we say "espionage"?
Re:Legal? (Score:5, Insightful)
Could someone go to jail simply for NOT running an e-mail virus?
Could Microsoft, RedHat, Apple or Sun get in trubble for fixing a defect?
Could the government ask Microsoft to install a back door then on descovery when Symantic patches Windows to CLOSE the back door or if BugTrap discovers it and a third party patches it.. Would the government sue for discovery or patch?
And Linux hacks have been known to exist that (for security reasons) pretend to be known Windows back doors to employ known defects in script kiddy toolkits.
The defects themselfs could be easy to discover just in the way the backdoor works.. "Ahh here the script kiddy has a file reception system were I can send ANY file I want... any size.. oh and a typical redundency compression system.... Let's see compression code.. repeate "0" for 16 gig.. ok thats 6 bytes than expand into 16 gig.. He's dead.."
On the inverse...
"In todays news known terrorist Al Be Dumbby was set free on a legal technicallity.
The terrorist group 'born stupid' is now counter suing for infecting Al Be Dumbbys computer...
Many suggest this lawsute is an act of intelegence and disproves the groups contention that the terrorists have an inherent right to be stupid.
Others point out had Al Be Dumbby not clicked on the virus or used Windows to start with this wouldn't be an issue"
Parent
Re:Legal? (Score:5, Interesting)
I don't think it'll be illegal to use a secure system due to this, but I *do* think they're really asking for trouble if this thing "flies".
WARNING: The remainder of this post may in fact be advocating "terrorism" under the new definitions put forth by the U.S. gov with respect to "computer crimes". Why am I logged in? Because, quite simply, they can kiss my A$$.
Do you really think tens thousands of server admins would let this go without retribution? I for one sure as hell wouldn't. Invasion of my servers is, in my book, precisely the same as invading my home (maybe even worse). Okay, so how do we fix their little red wagon?
Go HoneyPot on their asses. Set up a bunch up of machines all over the place to get compromised, and have firewall software monitoring the destination of the nasty outgoing packets. From there, use a P2P model to distribute the destinations of such data, and D-E-N-Y the living hell out of their servers. For added flair, you could always include repetitious, highly profane strings in your denial actions (use your imagination).
I would especially advocate this concept for all technies living in various foreign nations whose citizens might get "bugged" by the our wonderful boys in blue. Yes, I am openly advocating retaliatory strikes against this sort of disgusting behavior.
And I think it's damned well warranted.
Web hosting by geeks, for geeks. Now starting at $4/month (USD)! [trilucid.com]
Yes, this is my protest to the sig char limit
Parent
Re:Legal? (Score:3, Funny)
Re:Legal? (Score:5, Insightful)
IF they do eventually make it illegal to block the virus then 'terrorist virus writers' can be guaranteed a hole in every system.
And it is not far-fetched that they would make it illegal to block it. For instance, it is illegal to wear a bullet-proof vest if you are in a situation where the police want to shoot you.
--jeff
Parent
Re:Legal? (Score:3)
Criminals? (Score:2, Interesting)
Awesome (Score:2)
I would love to meet the guy who thought this up.
AV software. (Score:5, Insightful)
Re:AV software. (Score:3, Insightful)
I think you have to look a lot deeper than that. Even if Symantec tells me that they're protecting me against this "virus", can I really believe them? And what happens after that, does Uncle Sam release version 2? If you're Symantec, do you really want to draw the wrath of the government to fight a virus that isn't, and get into a codefight with government agencies? AV companies might have some deep pockets, but they're no match for our tax dollars, if Ashcroft decides he wants to spend our money this way.
This is the time when a foreign virus detection has the opportunity to jump into the limelight and steal some serious business from the big US AV companies.
Re:AV software. (Score:4, Interesting)
I doubt it would happen that way. Chances are, the "virus" wouldn't be self-replicating, at least the government's version wouldn't. If it were, there'd be no effective way to control it. So, if the only people who are sent this thing are people the feds want to bug, the AV companies most likely wouldn't see it.
However, all this goes out the window if someone gets hold of this thing somehow and modifies it. They could do several things. First, they could attempt to decompile it and then post the source for all to see. If they wanted to get more, um, creative, they could modify it so it becomes a truly self-replicating virus. Not only would this turn the thing loose on the Net at large, it'd also have the possible effect of taking out whatever computer the original virus was supposed to "phone home" to. How long could a machine set up to handle data from several thousand of these things last when it's getting bombarded with data from a few million? Finally, there's the possibility that it could be modified to seek out and attack computers owned by the government. Once it got in, it would sit there and spy on whoever was using that machine. Results could be sent anywhere. Protecting all those government computers would be a massive undertaking. Even if the feds had custom software to do it, distributing it in any meaningful way to locations around the country would almost guarantee that it'd leak out within a few days. But the truth is that federal computers are running the same software that everyone else is, and the people using them can be just as easily deceived as the average home user. All it'll take is for one programmer with talent, a chip on his shoulder, a good deal of free time, and access to the right tools to decide to fight code with code. If he gets hold of the feds' virus, he could use that. If not, well, he'd most likely roll his own.
This is a superbly stupid idea the feds are pursuing. If they write crappy code, only the truly moronic will allow this to get installed. If they write a really sophisticated piece of software, they could very well end up creating a monster that will turn around and bite them in the ass.
Parent
Firewall (Score:2, Interesting)
Re:Firewall (Score:2)
In other news... (Score:5, Funny)
Re:In other news... (Score:3, Informative)
Assuming this applies:
No. That's... well, I'm not sure what that is, but it doesn't sound like a warrant to me.
well i guess this is a continuation (Score:3, Informative)
Mail-virus attachments are best contracted via Outlook or web mail clients; anybody with advanced security will not have a problem here.
Unless the government starts persecuting people on Linux and *BSD systems, because they are inimical to the FBI's spying methods.
Foucault's Panopticon, here we come..
Dear Symantec (Score:2)
Please make the fix available as soon as possible, or there will be consequence - know what I mean?
Joe Soprano
This only works if.... (Score:5, Funny)
b) You always open email with the subject "Snow White and the 7 FBI Agents"
c) You run the attachment called "FBILOVESYOU.VBS" (and you run Windows, Outlook, etc)
Blah, dumb communist FBI
Illegal search? (Score:2, Interesting)
Re:Illegal search? (Score:2, Interesting)
free advertising (Score:2)
Does this mean that those not running windows will now be "suspicious persons" ?
Cheers,
-- RLJ
And what suspicion, pray tell, on *nix/Mac/etc? (Score:2)
So what happens when it becomes virtually impossible to use M$ OSs for terrorism?
Right, it makes us alternate OS users look suspicious.
Mind you, I'm generally not that paranoid, but if you ever read the Washington Post [washingtonpost.com] check out today's (11/20) article about Bush's consolidation of executive power and think about his family *cough*dad's CIA*cough* and friends, and tell me it isn't a little worrisome.
Encryption program name (Score:4, Informative)
If this is true, then it would seem all you need to do to foil this latest slightly-hare-brained-scheme would be to rename pgp to something else, such as goawayfbi.
Re:Encryption program name (Score:2)
Sorry, cheep shot at the recent ATI driver thing...
Cheers,
-- RLJ
Re:Encryption program name (Score:2)
Shaun
Re:Encryption program name (Score:5, Funny)
Parent
Don't rename it Quake! (Score:5, Funny)
Parent
Way to go, FBI! (Score:5, Funny)
Talk about a boon to the Open Source movement! Show the people (not just the bad guys) that Microsoft's numerous vulnerabilities can be used by Big Brother to monitor them. I can't think of a better way to boost Linux distro sales.
DCMA violation? (Score:5, Funny)
How does the government expect to work around this one? There are so many things that can go wrong...
1. Probably OS-dependent. Remember: virii for one platform (i.e., Win) will probably not work for others. That was not hard to get around
2. Human link involved. This virus will presumably be propagated via email, or some other form of trojan. Those who tend to use encryption tend to block this type of thing from happening to their machine anyway. Yet another reason not to open email/attachments from an addresser named "CIA"
3. Network link involved. Those who use encryption are usually savvy enough to detect extra packets flying from their machine to some unknown address, which would easily be identified in a reverse-lookup.
My goodness, they are getting desperate, aren't they.
Nice example.. (Score:2)
That makes me think of alcoholic parents telling their kids not to drink while they are wasted 24hrs a day. Well even that's more logical, at least the kid CAN STILL make a choice, either be like his parent or be the total opposite..... whereas here...
Linux? (Score:2, Insightful)
Since it's vulnerablities in windows that seem to allow the FBI to get in, would linux be ok?
In addition, is this legal? To break in using vulnerablities? Wouldn't that make the FBI in essence doing illegal things?
This only works then because windows has security holes eh?
Re:Short Answer: Yes (Score:5, Interesting)
Parent
Virus Email (Score:5, Funny)
From: Bill@Slashdot.org
To: Fred@Slashdot.org
Subject: Magic Lantern.doc.pif
Hi! How are you?
I send you this file in order to have your advice.
See you later. Thanks
I can just see it now... (Score:2)
I wonder if mcafee etc will be updated to catch these viruses
If the FBI virus gets out of hand and e.g. destroys corporate, governmental, or military data, could the FBI be held criminally liable?
Which individuals are writing this software anyway? That's what I'd really like to know.
Software doesn't write itself, individual programmers do. So who are these individuals?
My guess is they're hiding under a rock somewhere, too cowardly and ashamed to show their faces in public.
Virus or trojan? (Score:2, Insightful)
I'm sure trojans must have been used for keylogging before. But won't using this mean getting a wiretap order? I also don't know how this system will cross jurisdictions: can the FBI infect a user in another country to get secrets? Sounds like spying to me, and it would ensure countermeasures from other governments and a change in computing systems to defeat the virus.
I'm hoping that some antivirus company makes a scanning system to detect this 'virus' and eliminate it. Otherwise its a change to a more secure OS, or using GNUpg (they did only mention it working on PGP, didn't they?) could do the trick.
Heading to Canada... (Score:2, Insightful)
But if the software is a virus (or trojan, or some other malware), wouldn't that make it a tool of terrorism?
Does that mean we can have a military tribunal for the MIB?
This is sickening.
Please, please, PLEASE, somebody tell me that someone will write a program to watch for this "Magic Lantern" and disable it, or at least warn the user that it's installed.
Hmm...
Oh, and by the by... To anyone who wants to make that "if you're not doing anything wrong..." argument, please send me pictures of your wife naked. Just put my address on the back of a 3x5 print, along with your credit and checking account numbers.
Oh, that's private?
Then f**k off and don't let me hear you say it again until you're willing to put your money where your mouth is.
Quite rightly, I don't think that it's anyone's business to see the data on my computer, unless they have a real warrant and show up at my house with it. On the same token, I think that keyloggers should fall under wiretapping regulations. (Does anyone know if they do or not? Last I heard the FBI was trying to say that it didn't.)
It's going to take a LONG time to fix the damage our government is doing. If we're lucky, some of us will live to see something akin to real freedom again. If we're not, well, we'll just have to make sure that the stories get passed down to our children.
Maybe soneday I'll take the time to cohesively form my thoughts on this, but at any rate, I think y'all get the idea.
You have got to be kidding. (Score:5, Funny)
Are there any cases involving damage done to personal property in eavesdropping operations? That is, legal taps? Any lawyers here? I gotta imagine that this would be a very very dangerous thing for the government to get into. Not only could it cause damage to personal property, but if the suspect is smart enough to encrypt their stuff, they're going to be smart enough to know when they've been h4x0red by an email virus.
This story makes a lot more sense if you remove every reference to "our sources" and replace it with "my little brother." I believe *that*.
I've got no problem with this... (Score:4, Funny)
Of course, anyone who would be vulnerabe to this is either a moron or doesn't feel that they have anything to hide, so it seems kind of pointless.
Of course, the truely paranoid communicate with their computer using morse code with their space bar and scroll lock LED. I can see it now:
Head of Investigation: "What have we got from the J Random Hacker log file?"
Computer Specialist: "84,365,928 spaces, sir"
I've got a huge problem with this (Score:3, Informative)
No, you're missing the point. If the FBI could get a warrant on you, they'd just require you to give them your passphrase, or just subpeona the information that was encrypted in the first place. The reason that the FBI needs this is because they know that they can't get warrants for what they want to do, because it's illegal and they have no probable cause for sticking their noses in your business.
You know that if the FBI can't get a warrant for the information in the first place, they won't be able to get a warrant for this either, so what would they plan to do with it, other than break the law?
Good news, bad news (Score:3, Insightful)
The bad news is sooner or later some idiot is going to lable Open Source a terrorist movement....
Idea: Come up with an app that sits on the SMB port (139, is it?) and acts like a Windows box... I believe the word is "honey pot"? One could port-redirect one's firewall to an old 486 running this thing, so as not to overload the firewall itself, and use QoS to keep the bandwidth down... sort of a LaBrea... well, not sort of, I consider ANYBODY trying to sniff around my computers a criminal, badge or no.
--
Keep your laws off my Internet
They sent it to me! (Score:5, Funny)
Sand box system? (Score:3, Insightful)
No matter what they do they can't get at a non-networked box unless they physicaly break in and hack it and then again to retrieve the data (or transmit via radio waves). As for the networked box it never sees anything but cyphertext, no passphrases are used, and anything it puts on the floppy doesn't matter cause even if it gets on the sandbox it can't get anywhere.
Oh sure they could get tricky, do things with floppy boot sector virii that will run in the sandbox, log and save to the floppy, then re-run once it detects a network connection, but to this non-programmer that seems 1) problematic and 2) pretty easy to avoid. maybe even use CD-R or CD-RW.
Comments?
Easier Than I Thought (Score:5, Insightful)
recently seen in #anti-trust:
*** BillG is now known as GMoney ***
<GMoney> How can we get out of this DOJ crap?
<FBI> I have this "security patch" I'd like you to distributed through Windows Update. Say it fixes some hole using malformed URLs in IE5 and IE6. No one will blink twice. I'm not even sure most XP users can read.
<GMoney> Will you put in a good word for me with the DOJ?
<FBI> Sure.
<FBI> DOJ: Let Microsoft go scott-free, or I post incriminating pictures of John Ahscroft and Hilary Rosen to usenet.
<DOJ> Rokie dokie, baws.
GMoney laughs maniacally.
FBI laughs maniacally.
DOJ tries to laugh maniacally, but chokes on the pencil eraser he was chewing.
*poof*. Insta-hole. Security patches are worthless if you can't trust the source. And yes, this wouldn't work with non-MS OSes, especially decentralized open source ones. I hope.
-Puk
Pedophile PATRICK NAUGHTON (Score:3, Interesting)
As you well know, Java inventor Patrick Naughton, an ADMITTED PEDOPHILE [zdnet.com] developed secret software for the FBI so he can get out of jail sooner and be out on the streets molesting girls again.
ANYONE WHO MODERATES THIS DOWN MUST ALSO BE A PEDOPHILE
Please check my facts and moderate up
Illegal Access To Electronic Device (Score:3, Insightful)
Surely they couldn't be planning on replicating it like a virus. Striking out a random and invading the computers of people they don't have authorization isn't just ethically suspect, it's a federal crime under current and highly visible law.
C//
How far will you let them go? (Score:4, Insightful)
Is a sense of security worth allowing Stalinist Russia to be reborn in America?
How many straws, America? How many?
Re:How far will you let them go? (Score:3, Funny)
Just one more! I promise.
A new espionage tool. Immune System proposal. (Score:3, Insightful)
Problem is, as government-funded tools filter out into public networks it will spark a discussion of these tools in a public forum, which once they are decompiled and attack modes are diagnosed, will give tons of people the ability to launch more sophisiticated attacks. Either it's someone who reengineers it and hands it to script kiddies, or it's other organizations or nations which will feel an imperative to grab the next escalated technology level.
Consider: the article says "levels the playing field with criminals" or something to that effect. It also means the FBI will use tools criminals use. It is easy to see this becoming espionage when used against a foreign firm by the FBI or by someone else who has appropriated their technology.
Few firms have virus-busting firewalls or antivirus packages which can handle new attacks before they cause damage or hide in archived material. Perhaps the scariest thing is that if a new variant is created for a specific "sting", it could quickly take over many computers over a large geographical area (consider Code Red graphs) before antivirus manufacturers or the public at large come up with a patch. In the past there has been a chance at getting a patch before infection.
But with the public funding a combination of email hole, pc based server, network scanner, key logger, and encryption program defeater, it seems that we are *very* quickly going to enter a much more dangerous situation than ever before.
It is not possible that this technology will never be misused by the government.
It is not possible that this technology will remain in the hands of the FBI.
It is not possible that this will not accelerate worldwide efforts to provide more and more dangerous security-breaking software/services.
Because it is so cheap to develop this kind of a weapon, it is my opinion that it is 100% likely that terrorists, multinationals, and national security organizations around the world *will* coopt this technology or will develop something identical to it (or more powerful) on their own. This is the part that scares me. No more Net! Who will ever install a binary from a public server? Who will ever trust interactive content and the plugins which it requires? Who will be trusted to hold the keys?
The FBI is moving a physical wiretap capability highly limited by timing and resources, into a software wiretap regime of high speed, exponential viral growth, widespread destablization of security prior to a court order, and extremely low cost of deployment.
This attempt to coopt the entire networked computing base as a wiretap infrastructure is the most dangerous force I can identify to the world economy and spread of the Internet in all facets of life. It is very hard to have reasonable security for most people at broadband speeds, but one could be forgiven for hoping that problems would be solved in time. Not when the crackers' growth metric takes off exponentially and leaves pro-security forces behind.
I don't think I'd mind if this was used against the people who have attacked the U.S. In fact I'd be surprised if something more powerful wasn't used already. But now we are going to start getting a trickle-down of progressively military weaponry operating silently in our homes.
The cat is out of the bag.. and the technology obviously already exists. The only choice we have is to promote some kind of open source, open science project which could have some hope of markedly improving security in general, could dampen the effects of for example thousands of concurrent Magic Lantern - style attacks from every part of the world. To me, an open, international project is the only way to protect computing in the future.
The FBI already has plenty of tools, and there is no reason it can't improve its cyber attack capability without building such a dangerous system. I certainly don't want to protect the mafia. But unless proven otherwise I think we have to assume that things will get worse all around before they get better.
If you want to see a simulation of the "gray goo" doomsday of nanotechnolgy, simply wait a few months for the next wave of network pathogens.
We will not be safe until we have the U.S. and other governments on the side of the public, with a law against cyber-germ warfare and a well-funded infrastructure to combat cyber-pathogens which do appear with some kind of human and computer based immune system before we enter the age of the network-borne pandemic.
Re:Encryption Security (Score:5, Insightful)
Remember Ken Thompson's hack! You only get the bonus points if you compiled the OS (and CD-ROM burning software) from source on a compiler you wrote yourself ;-)
Parent
Good luck... (Score:4, Interesting)
After all, it's doubtful that Microsoft would object to the FBI looking at their source code for such a project, it's doubtful that Apple would object--but even if they did, the lower levels of OS X are open-source Darwin--and of course Linux is open-source anyway. It doesn't seem too difficult for them to do.
It seems that if they were to do it the simpler way, it would be too easy to detect. If they installed it like a simple trojan, it would be trivial to detect, particularly by software such as ZoneAlarm and equivalents which monitor all attempts by programs to access the net. In fact, if it is what they used in the Scarfo case and they are using it now, if it were a simple trojan it would probably have been reported by now. People with something to hide know what software to use to protect them from such things.
For example, "Dr. Who's Encryption and Security FAQ" http://www.slack.net/~hermit/ebook/documents/secu
Call me crazy, but I think the FBI would take note of this readily available information and come up with a way to counteract it. Writing their trojan into your operating system itself seems like a damn good way to do this. Windows and Mac users and even Linux users expect certain processes to access the network, so why not exploit that to camouflage an "ultimate trojan"?
There would be only one way to counteract it, and this is mentioned in Dr. Who's FAQ: make detached PGP signatures for each important file in your OS that you'd expect not to change, and use a script to check them against the files each time you boot, or each time you choose to run it. If a file has changed, you know something is wrong.
Of course, this is very cumbersome--how many files exactly should you sign? Very tedious. I got to thinking on this some time back, and came to the conclusion that if you want the best possible security against unauthorized changes to your system, the best way might be to install your whole OS and all your apps, configure everything how you like, and immediately transfer the whole system to one file. Then, strip down your OS to the very minimal parts needed to boot and to check the signature on the "big file" and your stripped-down OS files, then decompress/mount then boot the whole OS in your "container" file. If you have lots of cheap RAM, you can decompress the file containing your OS into a RAMdisk to save some time and make the files less persistent. A lengthy process, depending on how big your OS/apps are, but if you want security there will be a price. This way, every file on your system is uncorruptable, untouchable by trojans and FBI spyware.
I experimented with just that using Windows 98SE, and though I don't know exactly how you'd do it with Linux or WinNT/2k/XP it is definitely doable with Win9x. First I installed Windows and all my apps, then made a Zip file (using no compression at all, for speed of unzipping at boot) of the whole system. Then I deleted the system except for minimal DOS command files and a RAM disk creation tool called xmsdsk.exe and a command-line unzip tool, altered Autoexec.bat to call xmsdsk with the parameters to make a 1GB RAM disk (there were 1.5gigs on the machine), called the unzip tool to unzip the file to the RAM disk, and had the config files boot Win98 from that drive. It took fiddling a bit, but finally I got it right and it worked. When my Win98 booted, in the startup folder was a shortcut to check the PGP signatures of all the startup files and the Big File that the system was stored in.
Not ideal. Quite slow to boot up. You can see why I don't actually still do this; it was more or less an experiment. But it did work. When the system was shut down, the RAM disk went away, and so any changes at all to the system would be undone. If the Big File the system came from, or any of the boot files, were modified it would show up the next time I booted when the signatures were checked. It was unweildy, but it did provide full protection of a sort I can't think how to have otherwise.
So, does anyone else have crazy ideas on how to provide security against such intrusions? Preferably ones that don't require a boot time long enough that you can go make breakfast in the intervening minutes.
Parent