Slashdot Log In
What We Know About the FBI's CIPAV Spyware
Posted by
Zonk
on Wed Aug 01, 2007 12:42 PM
from the i-always-feel-like-somebody's-watching-me dept.
from the i-always-feel-like-somebody's-watching-me dept.
StonyandCher writes "What is CIPAV? CIPAV stands for 'Computer and Internet Protocol Address Verifier'; a lengthy term for powerful spyware the Federal Bureau of Investigation can bring to bear on web-based crime. It was used last month in a case where someone was emailing bomb threats regularly to a Washington high school. An affidavit by an FBI agent revealed some of the workings of CIPAV. 'According to the court filing, this is [some of] what the CIPAV collects from the infected computer: IP address, Media Access Control address for the network card, List of open TCP and UDP ports, List of running programs ... Last visited URL. Once that initial inventory is conducted, the CIPAV slips into the background and silently monitors all outbound communication, logging every IP address to which the computer connects, and time and date stamping each.' In a Computerworld article, the author attempts to dissect CIPAV's purpose and raises a number of questions such as: What happens to the data the CIPAV collects? Does the CIPAV capture keystrokes? Can the CIPAV spread on its own to other computers, either purposefully or by accident? Does it erase itself after its job is done?"
Related Stories
[+]
Your Rights Online: FBI Remotely Installs Spyware to Trace Bomb Threat 325 comments
cnet-declan writes "There have been rumors for years about the FBI remotely installing spyware via e-mail or by exploiting an operating system vulnerability from afar — and now there's confirmation. Last month, the FBI obtained a federal court order to remotely install spyware called CIPAV (Computer and Internet Protocol Address Verifier) to find out who was behind a MySpace account linked to bomb threats sent to a high school near Olympia, Wash. News.com has posted a PDF of the FBI affidavit, which makes for interesting reading, and a summary of the CIPAV results that the FBI submitted to a magistrate judge. It seems as though CIPAV was installed via e-mail, as an article back in 2004 hinted was the case. In addition to reporting the computer's IP address, MAC address, and registry information, it also gave the FBI updates on which IP addresses the user(s) visited. But how did the FBI get the spyware activated and past anti-virus defenses? Two obvious ways are for the Feds to find and exploit their own operating system backdoors, or to compromise security vendors..."
[+]
FBI Used Spyware for Online Search 79 comments
juct writes "The FBI has used PC spyware for the first time to reveal the identity of an offender who sent bomb threats to a high school in Washington state. According to heise Security, a declaration from the FBI official who applied for the search warrant describes the mode of operation of the spyware which the FBI is using under the abbreviation CIPAV (Computer and Internet Protocol Address Verifier)."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
does it... (Score:5, Interesting)
Does it run on Linux?
sorry, couldn't help myself.... but seriously..... does it?
Re:does it... (Score:5, Funny)
"Mr. Gman from Quantico, VA has sent you an eGreetingCard from Flowers By Irene! Just open this P.D.F. file to view..."
Let's check... (Score:5, Funny)
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package cipav
Whew, safe!
Re:does it... (Score:4, Informative)
My Sparc Classic would takes minutes to establish an SSH2 connection. those big keys take a while, SSH1 was nice and fast. (50MHz no cache, no FPU)
Re:does it... (Score:5, Insightful)
Mod parent down. SELinux is support for more fine-grained rights management in Linux. It's a mandatory access control policy system, basically. Unless parent has proof that there is a back door in there somewhere, I'm pretty sure parent is full of it.
Just because the software is partially paid for by the government, it does not necessarily follow that it's a back door. Take off the tinfoil hat.
What about zombies? (Score:5, Insightful)
So many questions raised by this... I'm sure others can think of many more.
Re:What about zombies? (Score:5, Interesting)
Re:What about zombies? (Score:4, Interesting)
Otherwise, who knows. Maybe their software has to wipe out other possible malware to be effective (wouldn't want that data they're collecting, or even the software they installed going overseas, right?). You'd hope that they would have to show that it was someone typing out the emails locally vs. remotely. But then, who's to say it wasn't the person's little brother writing the email? It doesn't seem like they'd have a lot to stand on...there should be a lot of supporting evidence going with what they collect with that software.
But in the end, don't they pretty much just have to say "We're the FBI. That's what happened." anyway?
Zombie or not, one specimen WILL be found. (Score:5, Interesting)
address is 192.168.0.100 (Score:4, Funny)
It most do a trace route/phone home or somthing to actually get a useful address
Re:address is 192.168.0.100 (Score:5, Funny)
It most do a trace route/phone home or somthing to actually get a useful address
As opposed to the guy at 127.0.0.1! I hacked into his machine once, but that bastard had some sort of active defense daemon running that wiped my drive at the same time I was trying to wipe his!
Fortunately, I was able to see the porno pics of his wife before I was hit. Man! That bitch was FUGLY!
The real threat of "government spyware" (Score:5, Interesting)
Either the feds don't give AV vendors a heads-up when they plan to use a trojan, i.e. they risk being found. Now, this would double as the "hey stoopid, the feds are onto you" warning.
So it's likely they do require AV vendors to avoid finding them. This, in turn, would mean, though, that all a potential virus writer has to do is to get his program to match the fed trojan in behaviour and shape, possibly in signature.
I needn't write more, I guess? Why bother coming up with a rootkit if there are governmental-assisted ways to create undetectable malware?
Re:The real threat of "government spyware" (Score:4, Insightful)
Re:The real threat of "government spyware" (Score:4, Informative)
One of the differences between the virus that your bog-standard AV will detect and this critter from the FBI is the number of instances out there in the wild. Keep in mind that this FBI thing is intentionally sent to specific targets, and I suspect that it is used sparingly in order to prevent it from being found easily.
Nearly all AV programs rely on signatures. The way they obtain the signatures is first to obtain samples, and then determine how they can identify the program accurately (Hashes, etc). I've discovered new malware and forwarded it to the proper channels, as have others that I know.
Therefore, the following (simplified) steps must occur:
1. become infected with the malware
2. suspect that the machine is infected
3. correctly isolate the malware (find its parts, etc)
Then, once those happen one must also do the following in order to hope that protection will be offered to others:
4. send the sample to one or more anti-malware application support teams for inclusion
5. wait until the AV/AM team can create a signature
6. wait until the AV/AM team distribute the signature
7. wait until people update their AV/AM signature databases.
As you can see, there are several places where this process can fail. Think of it like phishing, but sort of in reverse. Phishers send out a large number of messages in hope that even if only a very small percentage of recipients (1/100th of one percent, for example) fall for it, they will be able to profit.
That works just fine if you send out a few hundred thousand messages.
If you send out only one message, or ten, or twenty, your odds are very close to zero that even one person will "bite".
This is the critical difference. I doubt that this program is out there on thousands of machines, or hundreds of thousands of machines all over the place. It is "placed" (I know - some victim effort is required) on specific machines.
Therefore you have a very small victim base. The odds of this being discovered are quite small, even without collusion from the AV vendors.
This is more like "spearphishing" (who dreams up these phrases?), being specially targeted for one individual. This increases the odds of that one individual falling for the ruse, and since only one person was the target, this works well.
Things like this make the lives of us who work in security full time much more complicated.
-Q
Nice acronym but... (Score:5, Funny)
But how do they install it?!?! (Score:5, Interesting)
Do they get a warrant, sneak into your home in the dead of night, and install software on your computer?
Do they mail it to you as a virus, perhaps cleverly disguised as a Nigerian spam scam?
Do they use the back door that Microsoft agreed to put in all their software in return for being granted Most-Favored Monopoly status by the government?
Or something else? "You are a suspected pedophile. To clear your name, please click here to install the FBI's internet spyware on your computer"?
Anyone know?
Re:But how do they install it?!?! (Score:4, Interesting)
Better question (Score:4, Interesting)
5 bucks says they get a visit from big men in serious black suits and then are never seen again.
Re:Better question (Score:4, Insightful)
Is this really a reliable tool for the FBI? (Score:5, Interesting)
Better yet, if programs like CIPAV become more common as a tool for Federal Investigations, does it become a requirement that said programs allow CIPAV and its successors to do their work?
What if Crackers modify it for themselves? (Score:4, Interesting)
what if the virus and worm writers of today get a hold of this and modify it for their own purposes?
A lot of effort for 90 days detention. (Score:4, Insightful)
They spent a log of money on that. Sounds to me like it was actually a "test run" to make sure things work as expected. And now that they know it will work...
Hey, this is no fair. (Score:4, Funny)
Some More Speculation on Installation Methods (Score:5, Interesting)
http://blog.misec.net/2007/07/31/3/ [misec.net]
Specifically, it looks like the FBI may have several ready-made exploits, each targeting a different OS/web browser combination. An interesting question, then, is what they would do if they encountered a system that is fully patched and running a more secure browser such as Firefox. Does the FBI have access to their own zero-day exploits that they can whip out to install this trojan? If so, is it possible they have their own team of hackers set out to find such exploits?
Re:Do they still get spam? (Score:4, Funny)