What We Know About the FBI's CIPAV Spyware 207
StonyandCher writes "What is CIPAV? CIPAV stands for 'Computer and Internet Protocol Address Verifier'; a lengthy term for powerful spyware the Federal Bureau of Investigation can bring to bear on web-based crime. It was used last month in a case where someone was emailing bomb threats regularly to a Washington high school. An affidavit by an FBI agent revealed some of the workings of CIPAV. 'According to the court filing, this is [some of] what the CIPAV collects from the infected computer: IP address, Media Access Control address for the network card, List of open TCP and UDP ports, List of running programs ... Last visited URL. Once that initial inventory is conducted, the CIPAV slips into the background and silently monitors all outbound communication, logging every IP address to which the computer connects, and time and date stamping each.' In a Computerworld article, the author attempts to dissect CIPAV's purpose and raises a number of questions such as: What happens to the data the CIPAV collects? Does the CIPAV capture keystrokes? Can the CIPAV spread on its own to other computers, either purposefully or by accident? Does it erase itself after its job is done?"
does it... (Score:5, Interesting)
Does it run on Linux?
sorry, couldn't help myself.... but seriously..... does it?
Re:does it... (Score:5, Funny)
"Mr. Gman from Quantico, VA has sent you an eGreetingCard from Flowers By Irene! Just open this P.D.F. file to view..."
Re: (Score:3, Interesting)
Of course, be prepared to have one SETI@Home packet take about four weeks to process, and to have a bogomips rating of something like 16.9...
Re:does it... (Score:4, Informative)
My Sparc Classic would takes minutes to establish an SSH2 connection. those big keys take a while, SSH1 was nice and fast. (50MHz no cache, no FPU)
Re: (Score:2)
IIRC, execve() is syscall #11, so wouldn't your inserted syscall have to be before that to do prevent shellcode from executing arbitrary commands?
Re: (Score:2)
you could even be worse and just shuffle them around randomly.
Re: (Score:2)
You bring up a good question with a very practical answer. This software was developed like all software, with time and budget constraints. If it's home-grown or COTS it definitely does the bare minimum so the fear mongering is likely unfounded. That is, until version 2.0. Aaaahhhh!!!
Re:does it... (Score:4, Funny)
oh no - it's going to have Ajax and a drop shadow!
Let's check... (Score:5, Funny)
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package cipav
Whew, safe!
Re: (Score:2)
Also, you can purchase vendor [ecomstation.com] support for OS/2, as well.
That said, I'll stick with Ubuntu.
Re: (Score:2)
This isn't 1994, there really isn't any advantage to running OS/2 instead of Linux or BSD or hell, even Solaris.... (all of which are free, and all of which are more current than the long-abandoned OS/2).
Re: (Score:2, Funny)
Re:does it... (Score:5, Insightful)
Mod parent down. SELinux is support for more fine-grained rights management in Linux. It's a mandatory access control policy system, basically. Unless parent has proof that there is a back door in there somewhere, I'm pretty sure parent is full of it.
Just because the software is partially paid for by the government, it does not necessarily follow that it's a back door. Take off the tinfoil hat.
This is Slashdot, people! (Score:2, Funny)
Re: (Score:2)
What about zombies? (Score:5, Insightful)
So many questions raised by this... I'm sure others can think of many more.
Re:What about zombies? (Score:5, Interesting)
Re: (Score:3)
Point being, I'm wondering just how solid this evidence really would be in the eyes of the courts, with or without tech-savvy judges and lawyers.
Re:What about zombies? (Score:4, Interesting)
Otherwise, who knows. Maybe their software has to wipe out other possible malware to be effective (wouldn't want that data they're collecting, or even the software they installed going overseas, right?). You'd hope that they would have to show that it was someone typing out the emails locally vs. remotely. But then, who's to say it wasn't the person's little brother writing the email? It doesn't seem like they'd have a lot to stand on...there should be a lot of supporting evidence going with what they collect with that software.
But in the end, don't they pretty much just have to say "We're the FBI. That's what happened." anyway?
Re: (Score:2)
Re: (Score:2, Informative)
1) re: duration of evidence kept:
This is either a troll or a rhetorical question.
Why would they need to erase it? how could you prove they didn't delete it?
I remember sitting in a Computer Law class in the early 80s. One of the things which arose (aside from writing briefs which the chair from the department and a group of landsharks would pick pieces apart & continue until it looked reasonable) One of the things discussed at that time was you could force the FBI to ensure your information is c
Zombie or not, one specimen WILL be found. (Score:5, Interesting)
Re: (Score:2)
I'm reminded of this old jape:
"If the enemy is in range... SO ARE YOU!"
Re: (Score:3, Funny)
Brody: The CIPAV is a source of unspeakable power and it has to be researched!
Eaton: And it will be, I assure you Dr. Brody, Dr. Jones. We have top men working on it right now.
Jones: Who?
Eaton: Top men.
Re: (Score:3, Insightful)
Let's up the ante and get this thing going - I'll throw in $10 to the first slashdotter who contains and publishes the 'bins' and/or reverse engineers this piece of code. $20 if you can isolate the signature of executables that it's binded to with a high degree of success (say, =>75% confidence). It's $10 well spent to sleep at night, IMO. I kinda' want to play with this thing and I'm willing to fund the hunt for it. Anyone else wanna' throw in?
How to identify? (Score:2, Interesting)
Re: (Score:3, Interesting)
You can go ahead and force every program you run to load a DLL of yours, which hooks the relevant calls and alerts you should an application that's not supposed to tries to access things it has no business in. At least that's how I did it.
It does slow the system down considerably, though, so you might want to use it on a separate machine (real or VM) that you use to do your internet stuff.
address is 192.168.0.100 (Score:4, Funny)
It most do a trace route/phone home or somthing to actually get a useful address
Yes... millions of taxpayer dollars have been... (Score:3, Funny)
Re:address is 192.168.0.100 (Score:5, Funny)
It most do a trace route/phone home or somthing to actually get a useful address
As opposed to the guy at 127.0.0.1! I hacked into his machine once, but that bastard had some sort of active defense daemon running that wiped my drive at the same time I was trying to wipe his!
Fortunately, I was able to see the porno pics of his wife before I was hit. Man! That bitch was FUGLY!
Re: (Score:2)
The real threat of "government spyware" (Score:5, Interesting)
Either the feds don't give AV vendors a heads-up when they plan to use a trojan, i.e. they risk being found. Now, this would double as the "hey stoopid, the feds are onto you" warning.
So it's likely they do require AV vendors to avoid finding them. This, in turn, would mean, though, that all a potential virus writer has to do is to get his program to match the fed trojan in behaviour and shape, possibly in signature.
I needn't write more, I guess? Why bother coming up with a rootkit if there are governmental-assisted ways to create undetectable malware?
Re: (Score:3, Funny)
Re: (Score:2)
Re:The real threat of "government spyware" (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Funny)
No, but that would be awsome. Maybe some of the open source antivirus kits out there (I know there's at least one) should use that as the name if they ever manage to get a signature of CIPAV.
Re: (Score:2)
What about people with strong firewalls which monitor outbound traffic?
I have a hard time believing the USGov is competent enough to do this well.
Re: (Score:2)
Re: (Score:2)
Er, what if AV programs are configured to ignore programs that connect to (and only connect to) cipav.fbi.gov or somesuch?
Re: (Score:3, Insightful)
I think it's fairly secure to assume that one of them would have used a security hole like this in the meantime, e.g. by rewriting the hosts-file, then sending to the (rerouted) cipav.fbi.gov and the AV tool would let it be.
And this, in turn, would have been detected immediately by an AV company (who is competing with the AV company that lets this le
Re: (Score:2)
Besides, that only serves as a better way to detect it. I give it 2 days 'til the first detector circulates that looks for exactly THIS crypto key signature.
Re: (Score:2)
Re: (Score:2, Informative)
Re: (Score:2, Informative)
Afraid that Great Britain is more than happy to employ Microsoft software in their warships.
See this: http://www.theregister.co.uk/2007/02/26/windows_bo xes_at_sea/ [theregister.co.uk]
and this:
http://en.wikipedia.org/wiki/Type_45_destroyer [wikipedia.org]
Re:The real threat of "government spyware" (Score:4, Informative)
One of the differences between the virus that your bog-standard AV will detect and this critter from the FBI is the number of instances out there in the wild. Keep in mind that this FBI thing is intentionally sent to specific targets, and I suspect that it is used sparingly in order to prevent it from being found easily.
Nearly all AV programs rely on signatures. The way they obtain the signatures is first to obtain samples, and then determine how they can identify the program accurately (Hashes, etc). I've discovered new malware and forwarded it to the proper channels, as have others that I know.
Therefore, the following (simplified) steps must occur:
1. become infected with the malware
2. suspect that the machine is infected
3. correctly isolate the malware (find its parts, etc)
Then, once those happen one must also do the following in order to hope that protection will be offered to others:
4. send the sample to one or more anti-malware application support teams for inclusion
5. wait until the AV/AM team can create a signature
6. wait until the AV/AM team distribute the signature
7. wait until people update their AV/AM signature databases.
As you can see, there are several places where this process can fail. Think of it like phishing, but sort of in reverse. Phishers send out a large number of messages in hope that even if only a very small percentage of recipients (1/100th of one percent, for example) fall for it, they will be able to profit.
That works just fine if you send out a few hundred thousand messages.
If you send out only one message, or ten, or twenty, your odds are very close to zero that even one person will "bite".
This is the critical difference. I doubt that this program is out there on thousands of machines, or hundreds of thousands of machines all over the place. It is "placed" (I know - some victim effort is required) on specific machines.
Therefore you have a very small victim base. The odds of this being discovered are quite small, even without collusion from the AV vendors.
This is more like "spearphishing" (who dreams up these phrases?), being specially targeted for one individual. This increases the odds of that one individual falling for the ruse, and since only one person was the target, this works well.
Things like this make the lives of us who work in security full time much more complicated.
-Q
Re: (Score:2)
The chance that such a program end
Re: (Score:2)
Nice acronym but... (Score:5, Funny)
Do they still get spam? (Score:3, Interesting)
Re:Do they still get spam? (Score:4, Funny)
Re: (Score:2)
So, if you're a criminal.... (Score:2, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Interesting)
There is this Japanese urban legend that when a corporation or Yakuza wants to off someone, they have the sucker win a trip to Indonesia. Then at the airport they slip some drugs in his bag and then give an anonymous tip to the Indonesian authorities.
The thing is... The penalty for drug possession in Indonesia is deat
Re: (Score:2)
If they can get you to go to the site, what it looks like doesn't matter anymore.
But how do they install it?!?! (Score:5, Interesting)
Do they get a warrant, sneak into your home in the dead of night, and install software on your computer?
Do they mail it to you as a virus, perhaps cleverly disguised as a Nigerian spam scam?
Do they use the back door that Microsoft agreed to put in all their software in return for being granted Most-Favored Monopoly status by the government?
Or something else? "You are a suspected pedophile. To clear your name, please click here to install the FBI's internet spyware on your computer"?
Anyone know?
Re:But how do they install it?!?! (Score:4, Interesting)
Re: (Score:2, Funny)
Yes.
Maybe... (Score:2)
Re: (Score:2, Informative)
Re: (Score:3, Funny)
try{
getTarget().addUncostitutionalSpyware();
}
catch (SomebodyFoundOutException e){
getTarget().accuse( new Excuse( Excuse.paedophile , Excuse.terrorist ));
}
finally{
profit();
}
Better question (Score:4, Interesting)
5 bucks says they get a visit from big men in serious black suits and then are never seen again.
Re:Better question (Score:4, Insightful)
Re: (Score:3, Insightful)
Yeah, because the US government has never grabbed someone who is on foreign soil and whisked them away in an airplane late at night when nobody was looking. (No, really [usatoday.com].)
If they want you bad enough, they will send someone to retrieve you. Domestic and international laws be damned. Now, they won't do it for sending spa
typical hysterical twit (Score:2)
what is this, humor? does anyone actually believe this represents a fair depiction of how dissent, spying, and enemies of the state are handled by the usa, and *laugh* other governments in the world?
the usa has plenty of problems, don't get me wrong. but if you analyze any other country and the way they handle spying and rights, guess what? the usa doesn't look so bad
does this excuse the usa? no
Re: (Score:2)
i understand (Score:2)
http://www.nytimes.com/2007/08/02/world/middleeast
how do you feel about this story this morning?
i mean, do you care about the universal human issue of basic human rights? or does the concept only enter your mind when the usa is involved somehow?
do you have a human conscience? or an american conscience
you sound upset about that (Score:2)
do you have a human conscience on the issues of basic human rights?
or do you just have an american conscience?
the world doesn't revolve around the usa. why do you?
so let me get this straight (Score:2)
so when the usa moves a yard down that road, you are going to get your panties in a twist and scream bloody murder
but when other countries are a MILE down that road, we're not going to say one peep
that's my problem with you
http://www.nytimes.com/2007/08/02/world/middleeast
just picked that story from this morning, out of many i could have picked over many days and many countries
how do you
let's see if you can (Score:2)
the only morally and intellectually defensible position on human rights is a global one
because we're talking about human rights. not american rights. not iranian rights
so when you criticize one country more than another, and the former does far less abuses than the latter, you don't have a human conscience. your level of criticism must match the level of abuse
otherwise, you have an american conscience: an obsession with america... which is fine, actually. just admit that y
got it (Score:2)
better scream high holy indignation
look, that other guy is stabbing someone
but i can't criticize him, because that guy is a little further away from me
i have a human conscience
Re: (Score:2)
Is this really a reliable tool for the FBI? (Score:5, Interesting)
Better yet, if programs like CIPAV become more common as a tool for Federal Investigations, does it become a requirement that said programs allow CIPAV and its successors to do their work?
Re:willfull ignorance by anti-malware vendors (Score:2)
1) Even under the threat of Star Chamber "justice",
Re: (Score:2)
Also
Re: (Score:3, Interesting)
What happens to the data collected? (Score:3, Funny)
Duh.
I wouldn't mind running this (Score:2)
What if Crackers modify it for themselves? (Score:4, Interesting)
what if the virus and worm writers of today get a hold of this and modify it for their own purposes?
A lot of effort for 90 days detention. (Score:4, Insightful)
They spent a log of money on that. Sounds to me like it was actually a "test run" to make sure things work as expected. And now that they know it will work...
Re: (Score:2)
Actually, it works much better than locking someone up for life. 90 days detention is *far* cheaper than 1 year, or 20. The cost of an investigation and court case is probably dwarfed by incarceration costs after just 5 or 10 years.
You've heard that adage that crime doesn't pay, right? Well, neither does justice. It's horribly expensive. In econom
Comment removed (Score:4, Funny)
Is it copy-protected? (Score:2)
Wow, people are worried about it spreading itself to other computers, deliberately or accidentally. It seems like the FBI has a bigger problem here: they're giving a spying tool to exactly the kind of people who, in the FBI's opinion, are less trustworthy than the average citizen. They give it to them, in the hopes that the suspected criminal will install it on their own machine instead of someone else's.
Think about this series of events: FBI looks into a kiddie porn / pedophile ring, and tries to trick t
Moral to this story? (Score:3, Insightful)
Re: (Score:2)
Oh, I just had another idea. Does anyone know of a list of most of these government sites? Why not just block them at the firewall level? Or for n00bs use something like PeerGuardian.
Re: (Score:3, Informative)
As for MS Windows, if there is an unknown exploit, maybe MS would leave it there with a little nudge and wink from the FBI?
As for OS X, the core is op
Some More Speculation on Installation Methods (Score:5, Interesting)
http://blog.misec.net/2007/07/31/3/ [misec.net]
Specifically, it looks like the FBI may have several ready-made exploits, each targeting a different OS/web browser combination. An interesting question, then, is what they would do if they encountered a system that is fully patched and running a more secure browser such as Firefox. Does the FBI have access to their own zero-day exploits that they can whip out to install this trojan? If so, is it possible they have their own team of hackers set out to find such exploits?
Re: (Score:2)
In a word? Duh.
They probably don't have their own but call on another 3 letter agency for them. The NSA are the monster intel agency, and they provide many tools and services for the other 3 letter folks. They've made trojan'd printers etc before for invasions of other countries networks. Finding holes in, or clandestinely adding them to software/OSs is probably the full time work of a good sized team.
Re: (Score:2)
Not My Question (Score:2)
How about: Which anti-virus/anti-spyware programs detect and remove it?
And which firewalls successfully block it? (Be funny of PeerGuardian takes it out.)
I can answer that ... (Score:2)
No, it stands for "Covert Information Poaching Automated Virus"
If you find an infected web site ... (Score:2)
1) Get a couple of 'virgin' PCs. Get them infected.
2) Make up some plausible identities as various members of the Defense Department.
3) E-Mail back and forth about your plans for the pending military coup. Specifically, how you are going to have to neutralize the FBI.
4) Sit back and watch the fireworks.
Re: (Score:2)
Then, is this how they brought down mob bosses a few years ago? What is so special about this today than a few years ago?
Or did they simply use RF/EM surveillance against the keystrokes of that enforcer/boss?
I've been wondering if a port sniffer/protocol analyzer/keystroke counter were sneaked in via a maintenance person, or flown in by one of those DARPA critters...
OTOH, depending on the building layout, maybe an "occupant" flushed a stringed bug that deployed lodging a
Re: (Score:2)
IIRC, the keyloggers involved there were _hardware_, installed surreptitiously by the FBI.
Re: (Score:2)
Also, keyboards are cheap, (exposed) wiring is cheap, and many peripherals are, too. Either toss them or get them "debugged".
Then, turn the premises into a Faraday cage or whatever it takes to keep unwanted, contemptable fracks out ("unwanted, contemptable" being defined by those w
Re: (Score:2)
The poor have always been the targets of the government, for whatever socio-political reasons there may be. Everyone knows that rich people rarely get convicted of crimes, as they are least suspect and can afford good lawyers. Poor people are more likely to use PCs, which means "criminals" are more likely to u
Re: (Score:2)