Follow Slashdot stories on Twitter


Forgot your password?
Security Communications Privacy The Internet

What We Know About the FBI's CIPAV Spyware 207

StonyandCher writes "What is CIPAV? CIPAV stands for 'Computer and Internet Protocol Address Verifier'; a lengthy term for powerful spyware the Federal Bureau of Investigation can bring to bear on web-based crime. It was used last month in a case where someone was emailing bomb threats regularly to a Washington high school. An affidavit by an FBI agent revealed some of the workings of CIPAV. 'According to the court filing, this is [some of] what the CIPAV collects from the infected computer: IP address, Media Access Control address for the network card, List of open TCP and UDP ports, List of running programs ... Last visited URL. Once that initial inventory is conducted, the CIPAV slips into the background and silently monitors all outbound communication, logging every IP address to which the computer connects, and time and date stamping each.' In a Computerworld article, the author attempts to dissect CIPAV's purpose and raises a number of questions such as: What happens to the data the CIPAV collects? Does the CIPAV capture keystrokes? Can the CIPAV spread on its own to other computers, either purposefully or by accident? Does it erase itself after its job is done?"
This discussion has been archived. No new comments can be posted.

What We Know About the FBI's CIPAV Spyware

Comments Filter:
  • does it... (Score:5, Interesting)

    by russ1337 ( 938915 ) on Wednesday August 01, 2007 @01:44PM (#20074271)

    What happens to the data the CIPAV collects? Does the CIPAV capture keystrokes? Can the CIPAV spread on its own to other computers, either purposefully or by accident? Does it erase itself after its job is done?"

    Does it run on Linux?

    sorry, couldn't help myself.... but seriously..... does it?
    • by HaeMaker ( 221642 ) on Wednesday August 01, 2007 @01:57PM (#20074535) Homepage
      Let's find out...

      "Mr. Gman from Quantico, VA has sent you an eGreetingCard from Flowers By Irene! Just open this P.D.F. file to view..."
    • Re: (Score:3, Interesting)

      by TWX ( 665546 )

      Does it run on Linux?
      Even if it does, if you find one of those last-generation Motorola 68000 machines and compile your entire OS from scratch I doubt that they'll have a binary-compatible version to install on it...

      Of course, be prepared to have one SETI@Home packet take about four weeks to process, and to have a bogomips rating of something like 16.9...
      • Re:does it... (Score:4, Informative)

        by OrangeTide ( 124937 ) on Wednesday August 01, 2007 @02:11PM (#20074785) Homepage Journal
        insert a new system call in the middle of your syscall list, and recompile everything for it. it will break all static binaries and shell code :)

        My Sparc Classic would takes minutes to establish an SSH2 connection. those big keys take a while, SSH1 was nice and fast. (50MHz no cache, no FPU)
        • That's a cool idea, but wouldn't it only break shell code that called syscalls after the one you inserted? Shouldn't you put the new one at the very beginning?

          IIRC, execve() is syscall #11, so wouldn't your inserted syscall have to be before that to do prevent shellcode from executing arbitrary commands?

          • sure. you ought to put it to break things like clone, execve, socket, open, etc.

            you could even be worse and just shuffle them around randomly.
    • by mpapet ( 761907 )
      My desktop distro-of-choice doesn't allow exec privileges to email attachments. They'd have a problem with my browser if they sent an evil url too.

      You bring up a good question with a very practical answer. This software was developed like all software, with time and budget constraints. If it's home-grown or COTS it definitely does the bare minimum so the fear mongering is likely unfounded. That is, until version 2.0. Aaaahhhh!!!
    • by Jeff Carr ( 684298 ) <<> <at> <>> on Wednesday August 01, 2007 @02:18PM (#20074895) Homepage
      $sudo apt-get remove cipav
      Reading package lists... Done
      Building dependency tree
      Reading state information... Done
      E: Couldn't find package cipav

      Whew, safe!
  • by Reziac ( 43301 ) * on Wednesday August 01, 2007 @01:45PM (#20074289) Homepage Journal
    What happens when zombied computers are used to email such threats? who gets the blame in that case? How do you distinguish the innocent zombied-user from the trojan or virus? Would being infected constitute defense? If so, how do you prove intent??

    So many questions raised by this... I'm sure others can think of many more.

    • by toleraen ( 831634 ) on Wednesday August 01, 2007 @01:53PM (#20074453)
      I think the obvious question would be "How does it get installed?"
      • by Reziac ( 43301 ) *
        How do you prove that you're the innocent victim of a zombie installer, vs. having surreptitiously zombied your own machine? the installer works the same way regardless, and ISTM it's not too difficult to determine and target your own IP address. (Or for that matter, for the gov't to do so.)

        Point being, I'm wondering just how solid this evidence really would be in the eyes of the courts, with or without tech-savvy judges and lawyers.

        • by toleraen ( 831634 ) on Wednesday August 01, 2007 @02:58PM (#20075553)
          I was referring more to the question of how the FBI installs the software on your machine. For some reason picturing a guy in a black suit wearing dark sunglasses sending "OMG Pony Screensaver Inside!!1" emails doesn't cut it. If they're going for computer evidence, it seems likely that their targets would be a bit more computer literate: more up to date on patches, firewalls, etc.

          Otherwise, who knows. Maybe their software has to wipe out other possible malware to be effective (wouldn't want that data they're collecting, or even the software they installed going overseas, right?). You'd hope that they would have to show that it was someone typing out the emails locally vs. remotely. But then, who's to say it wasn't the person's little brother writing the email? It doesn't seem like they'd have a lot to stand on...there should be a lot of supporting evidence going with what they collect with that software.

          But in the end, don't they pretty much just have to say "We're the FBI. That's what happened." anyway?
      • My guess is a Windows Update or whatever the Mac and Linux versions are. So everybody's probably already got it, waiting to be activated.
    • Re: (Score:2, Informative)

      by Anonymous Coward

      1) re: duration of evidence kept:

      This is either a troll or a rhetorical question.

      Why would they need to erase it? how could you prove they didn't delete it?

      I remember sitting in a Computer Law class in the early 80s. One of the things which arose (aside from writing briefs which the chair from the department and a group of landsharks would pick pieces apart & continue until it looked reasonable) One of the things discussed at that time was you could force the FBI to ensure your information is c
    • by arth1 ( 260657 ) on Wednesday August 01, 2007 @04:24PM (#20076963) Homepage Journal
      Another worry is if someone finds it, how good precautions are there that it's immune to subversion, in multiple ways:
      • Sending false data to the feds. With my knowledge of the bureau, I doubt they would ever question the data they receive. (The healthy paranoid people who might ask questions either get fired, or end up in different government branches).
      • Using the app or information in it to launch an attack to the fed's own clandestine systems. This could include modifying the data sent to try to trigger a buffer over/underflow, or simply brute force DoS the target destination through a botnet.
      • If it contains backdoor functionality, replace it with a honeypot and gain access to passwords and client info of the feds trying to access it.
      • Modifying the app too send data not to the feds but to somewhere else. This would be the holy grail of trojans, as it's likely that most AV software have specific exceptions for ignoring software from the government.

      • by Reziac ( 43301 ) *
        Good questions all. I've no doubt there are hackers out there who are good enough to disassemble and subvert such an app.

        I'm reminded of this old jape:

        "If the enemy is in range... SO ARE YOU!"

      • Re: (Score:3, Funny)

        by ScrewMaster ( 602015 )
        I'm sure they've accounted for the possibilities you've raised (excellent points, by the way.) And, if you were to actually ask the FBI about those issues, I'm sure the conversation would go something like this:

        Brody: The CIPAV is a source of unspeakable power and it has to be researched!

        Eaton: And it will be, I assure you Dr. Brody, Dr. Jones. We have top men working on it right now.

        Jones: Who?

        Eaton: Top men.
      • Re: (Score:3, Insightful)

        by Gazzonyx ( 982402 )
        Thanks, I didn't want to sleep tonight, anyways.

        Let's up the ante and get this thing going - I'll throw in $10 to the first slashdotter who contains and publishes the 'bins' and/or reverse engineers this piece of code. $20 if you can isolate the signature of executables that it's binded to with a high degree of success (say, =>75% confidence). It's $10 well spent to sleep at night, IMO. I kinda' want to play with this thing and I'm willing to fund the hunt for it. Anyone else wanna' throw in?

  • How to identify? (Score:2, Interesting)

    I did read the article, but did not see anything about identification. Other than ensuring there is no spyware running on your machine, anyone have an idea how to detect this particular program?
    • Re: (Score:3, Interesting)

      by Opportunist ( 166417 )
      Well, there are some ways. Some of them used by trojans, some used by AV kits, some by both.

      You can go ahead and force every program you run to load a DLL of yours, which hooks the relevant calls and alerts you should an application that's not supposed to tries to access things it has no business in. At least that's how I did it.

      It does slow the system down considerably, though, so you might want to use it on a separate machine (real or VM) that you use to do your internet stuff.
  • by maxwells_deamon ( 221474 ) on Wednesday August 01, 2007 @01:47PM (#20074315) Homepage
    Just look for the guy with that address!

    It most do a trace route/phone home or somthing to actually get a useful address
  • by Opportunist ( 166417 ) on Wednesday August 01, 2007 @01:48PM (#20074347)
    The core problem is, surprisingly, its correlation with antivirus tools.

    Either the feds don't give AV vendors a heads-up when they plan to use a trojan, i.e. they risk being found. Now, this would double as the "hey stoopid, the feds are onto you" warning.

    So it's likely they do require AV vendors to avoid finding them. This, in turn, would mean, though, that all a potential virus writer has to do is to get his program to match the fed trojan in behaviour and shape, possibly in signature.

    I needn't write more, I guess? Why bother coming up with a rootkit if there are governmental-assisted ways to create undetectable malware?
    • Re: (Score:3, Funny)

      by robogun ( 466062 )
      The AV could just take the middle ground with a generic description like "Suspicious Program: E-card Viewer", it is unlikely it will display as "W.32CIPAV j00 R SO FEDERALLY PWNED"
      • How long do you think 'til you can get a "Warning: Trojan.Crypt.Whatever is a CIA/FBI trojan!" from various mailing lists and boards?
      • Re: (Score:3, Funny)

        by orclevegam ( 940336 )

        it is unlikely it will display as "W.32CIPAV j00 R SO FEDERALLY PWNED"

        No, but that would be awsome. Maybe some of the open source antivirus kits out there (I know there's at least one) should use that as the name if they ever manage to get a signature of CIPAV.

    • by griffjon ( 14945 )
      What about heuristics engines? Will they get a huge "unless" clause tagged on to them?

      What about people with strong firewalls which monitor outbound traffic?

      I have a hard time believing the USGov is competent enough to do this well.
      • As soon as they catch anything but teenagers with it, I will start thinking about it. Until then, I say they have no better tools available than the average trojan writer. Probably they are less free in their choice of tools, rather.
    • This, in turn, would mean, though, that all a potential virus writer has to do is to get his program to match the fed trojan in behaviour and shape, possibly in signature.

      Er, what if AV programs are configured to ignore programs that connect to (and only connect to) or somesuch? :-)
      • Re: (Score:3, Insightful)

        by Opportunist ( 166417 )
        AV programs are amongst the most reversed programs in existance. Malware writers spend hours, days and weeks dissecting AV tools and finding weaknesses in them.

        I think it's fairly secure to assume that one of them would have used a security hole like this in the meantime, e.g. by rewriting the hosts-file, then sending to the (rerouted) and the AV tool would let it be.

        And this, in turn, would have been detected immediately by an AV company (who is competing with the AV company that lets this le
  • by Statecraftsman ( 718862 ) * on Wednesday August 01, 2007 @01:52PM (#20074431) Homepage
    can't we just continue calling this Vista?
  • by 192939495969798999 ( 58312 ) <info&devinmoore,com> on Wednesday August 01, 2007 @01:53PM (#20074469) Homepage Journal
    If they have this amazing tool for tracking people down, do they still get spam at HQ? If so, why not use this to catch the spammers and make them stop? Is it because they're all beyond jurisdiction now?
    • by It doesn't come easy ( 695416 ) * on Wednesday August 01, 2007 @03:51PM (#20076383) Journal
      In the grand scheme of things, spam doesn't rate very high when compared to a bomb threat. Resource limitations dictate that the FBI concentrate on music downloading, bomb threats, and spam, in that order ;)...
      • On the other hand, if we're talking about big corporate influence on law enforcement priorities, the bandwidth cost of spam is pretty damn high. You would think this would encourage the big boys (the telcos and Comcasts of the country) to spread some money around Washington to motivate the Feds appropriately. They've got more money than God, and AT&T knows its way around Washington like nobody else. That would be one of the few cases where I'd be on the lobbyists' side.
  • MySpace accounts can't receive traditional e-mail, so one hacker standard -- attach the CIPAV to a message and hope the recipient is stupid enough to launch it -- wasn't available. Instead, the most likely tactic would have been to send a URL to the suspect account using MySpace's own instant messaging and/or Web mail system. If the suspect clicked on the link -- it would have had to be enticing, so use your imagination here -- and visited the FBI-owned malicious site, an exploit for a zero-day vulnerabilit
    • Well, then I guess they wouldn't really need to install a trojan in your box anymore, would they? They already proved that you tried to access material that's not suitable for you.
      • The idea wouldn't be to stop just the perp but to enbolden them. See who they refer, follow the path of files downloaded as they are redistributed by interested parties. Corrolate time spent hunting for that stuff with time they are on their home computer with the lights off and the curtains closed. Package together a completely undeniable case against them. And if they don't distribute or become brave enough to upload their stash (for the sake of image-hash generating algorithms to quickly let software fin
  • by Daneboy ( 315359 ) on Wednesday August 01, 2007 @01:56PM (#20074503) Journal
    How, exactly, do the Men In Black install this uber-spyware on a target system?

    Do they get a warrant, sneak into your home in the dead of night, and install software on your computer?

    Do they mail it to you as a virus, perhaps cleverly disguised as a Nigerian spam scam?

    Do they use the back door that Microsoft agreed to put in all their software in return for being granted Most-Favored Monopoly status by the government?

    Or something else? "You are a suspected pedophile. To clear your name, please click here to install the FBI's internet spyware on your computer"?

    Anyone know?

    • by Opportunist ( 166417 ) on Wednesday August 01, 2007 @02:13PM (#20074811)
      Maybe it's just a variant of the way MPack infects. Slipping code into inconspicuous pages, redirecting you to an iframe containing an exploit, suitable for your browser, and presto.
    • Re: (Score:2, Funny)

      by Anonymous Coward

      Do they get a warrant, sneak into your home in the dead of night, and install software on your computer?

    • "Always trust sofware from" is turned on by default in some browsers?
    • Re: (Score:2, Informative)

      by mogasm ( 818130 )
      They have gotten court orders in the past to break into the house for the purpose of installing the spyware
    • Re: (Score:3, Funny)

      by BlueParrot ( 965239 )

      Do they get a warrant, sneak into your home in the dead of night, and install software on your computer?
      You still think they would need a warrant to do so? It is more like:
      catch (SomebodyFoundOutException e){
      getTarget().accuse( new Excuse( Excuse.paedophile , Excuse.terrorist ));
  • Better question (Score:4, Interesting)

    by grasshoppa ( 657393 ) <skennedy@AAAtpno ... inus threevowels> on Wednesday August 01, 2007 @02:01PM (#20074595) Homepage
    What happens to the first person to get a hold of this software and fully analyze it?

    5 bucks says they get a visit from big men in serious black suits and then are never seen again.
    • Re:Better question (Score:4, Insightful)

      by Mattintosh ( 758112 ) on Wednesday August 01, 2007 @02:10PM (#20074773)
      That depends on whether they're in the USA or not. If you're in the USA, enjoy your stay at the Gitmo Hilton. If you're not, well, you might not be bothered at all, but don't fly to the USA. Ever.
      • Re: (Score:3, Insightful)

        by gstoddart ( 321705 )

        That depends on whether they're in the USA or not. If you're in the USA, enjoy your stay at the Gitmo Hilton. If you're not, well, you might not be bothered at all, but don't fly to the USA.

        Yeah, because the US government has never grabbed someone who is on foreign soil and whisked them away in an airplane late at night when nobody was looking. (No, really [].)

        If they want you bad enough, they will send someone to retrieve you. Domestic and international laws be damned. Now, they won't do it for sending spa

      • "If you're in the USA, enjoy your stay at the Gitmo Hilton. If you're not, well, you might not be bothered at all"

        what is this, humor? does anyone actually believe this represents a fair depiction of how dissent, spying, and enemies of the state are handled by the usa, and *laugh* other governments in the world?

        the usa has plenty of problems, don't get me wrong. but if you analyze any other country and the way they handle spying and rights, guess what? the usa doesn't look so bad

        does this excuse the usa? no
        • I think that he still made a valid point. Whether other countries are any better is debatable, but the USA has crossed several boundaries by holding people in Gitmo without due legal process of any kind. There is no justification for it at all. I do not think that the FBI are quite there yet but, from the outside, there doesn't seem to be much that will stop them if that is what they want to do. But the FBI are breaking the law - it is illegal to put software on someone else's computer without their per
          • there is a road to fascism and ignoring human rights. and although some countries are a mile down that road, we're going to scream bloody murder only because the usa has moved a yard down that road

   /02iran.html []

            how do you feel about this story this morning?

            i mean, do you care about the universal human issue of basic human rights? or does the concept only enter your mind when the usa is involved somehow?

            do you have a human conscience? or an american conscience
    • I'd hold that bet, but it's illegal here to engage in bets when you already know the outcome...
  • by Vokkyt ( 739289 ) on Wednesday August 01, 2007 @02:01PM (#20074609)
    There are many programs out there, such as LittleSnitch for Mac, which are rather adamant about making sure you know everything that is phoning home on your computer. Does the CIPAV have a method of circumventing these road blocks or would the FBI be stumped by the same software that is intended to keep computers safe from malicious software? While I could certainly understand them working with larger developers like Symantec and Microsoft to ensure that their anti-spyware and virus protection software dutifully ignores a product like CIPAV, what about machines running protection applications from smaller developers, or even open source protection, like the ClamAV project?

    Better yet, if programs like CIPAV become more common as a tool for Federal Investigations, does it become a requirement that said programs allow CIPAV and its successors to do their work?
    • What you said made me think of a (somewhat) related topic. Several people have posted about the possibility of the big AV vendors and such excluding "official" malware from detection signature libraries. Several mechanisms have been suggested, ranging from voluntary participation to being required by secret Homeland Security legislation. I see several potential problems with the idea of the AV crowd secretly ignoring *any* official malware for *any* reason.
      1) Even under the threat of Star Chamber "justice",
  • by WillAffleckUW ( 858324 ) on Wednesday August 01, 2007 @02:01PM (#20074613) Homepage Journal
    It's sold to commercial firms so they can advertise to you.

  • Well, if they took out the phone home aspect - other than that it seems to be a fairly useful monitoring tool.
  • by denis-The-menace ( 471988 ) on Wednesday August 01, 2007 @02:10PM (#20074771)
    If AV companies do let the FBI version go through unchecked,
    what if the virus and worm writers of today get a hold of this and modify it for their own purposes?

  • by AltGrendel ( 175092 ) <> on Wednesday August 01, 2007 @02:15PM (#20074851) Homepage
    ...Monday, June 18. On July 15, after he pleaded guilty in juvenile court to charges of identity theft and making bomb threats, the teen was sentenced to 90 days' detention.

    They spent a log of money on that. Sounds to me like it was actually a "test run" to make sure things work as expected. And now that they know it will work...

    • They spent a log of money on that. Sounds to me like it was actually a "test run" to make sure things work as expected. And now that they know it will work...

      Actually, it works much better than locking someone up for life. 90 days detention is *far* cheaper than 1 year, or 20. The cost of an investigation and court case is probably dwarfed by incarceration costs after just 5 or 10 years.

      You've heard that adage that crime doesn't pay, right? Well, neither does justice. It's horribly expensive. In econom
  • by Caspian ( 99221 ) on Wednesday August 01, 2007 @02:16PM (#20074877)
    I demand a Mac OS X port! And a Linux port! The FBI is being unfair! ;)
  • Wow, people are worried about it spreading itself to other computers, deliberately or accidentally. It seems like the FBI has a bigger problem here: they're giving a spying tool to exactly the kind of people who, in the FBI's opinion, are less trustworthy than the average citizen. They give it to them, in the hopes that the suspected criminal will install it on their own machine instead of someone else's.

    Think about this series of events: FBI looks into a kiddie porn / pedophile ring, and tries to trick t

  • by JimDaGeek ( 983925 ) on Wednesday August 01, 2007 @02:23PM (#20074987)
    Don't use a MS Windows based OS if you want to do stupid stuff. Odds are that these type of government programs are only targeting the large user base of MS Windows. Use Linux, *BSD or Mac OS X and flip the government the birdie! ;-)
    • Sorry to reply to myself. I forgot the last line:

      Use Linux, *BSD or Mac OS X and flip the government the birdie! Or don't do stupid stuff

      Oh, I just had another idea. Does anyone know of a list of most of these government sites? Why not just block them at the firewall level? Or for n00bs use something like PeerGuardian.
  • by Dreamland ( 212064 ) on Wednesday August 01, 2007 @02:34PM (#20075141)
    Some more speculation on installation methods of CIPAV can be found here: []

    Specifically, it looks like the FBI may have several ready-made exploits, each targeting a different OS/web browser combination. An interesting question, then, is what they would do if they encountered a system that is fully patched and running a more secure browser such as Firefox. Does the FBI have access to their own zero-day exploits that they can whip out to install this trojan? If so, is it possible they have their own team of hackers set out to find such exploits?
    • If so, is it possible they have their own team of hackers set out to find such exploits?

      In a word? Duh.

      They probably don't have their own but call on another 3 letter agency for them. The NSA are the monster intel agency, and they provide many tools and services for the other 3 letter folks. They've made trojan'd printers etc before for invasions of other countries networks. Finding holes in, or clandestinely adding them to software/OSs is probably the full time work of a good sized team.
  • What happens to the data the CIPAV collects? Does the CIPAV capture keystrokes? Can the CIPAV spread on its own to other computers, either purposefully or by accident? Does it erase itself after its job is done?

    How about: Which anti-virus/anti-spyware programs detect and remove it?

    And which firewalls successfully block it? (Be funny of PeerGuardian takes it out.)

  • CIPAV stands for 'Computer and Internet Protocol Address Verifier'

    No, it stands for "Covert Information Poaching Automated Virus"
  • .. don't report it or clean it off. Instead:

    1) Get a couple of 'virgin' PCs. Get them infected.
    2) Make up some plausible identities as various members of the Defense Department.
    3) E-Mail back and forth about your plans for the pending military coup. Specifically, how you are going to have to neutralize the FBI.
    4) Sit back and watch the fireworks.

Kill Ugly Processor Architectures - Karl Lehenbauer