Slashdot Mirror
Enhanced Carnivore To Crack Encryption Via Virus
suqur writes: "MSNBC has a story about a new Carnivore feature, dubbed 'Magic Lantern,' which arrives on a victim's computer in the form of a virus through email or well-known vulnerabilities. Magic Lantern uses keylogging to extract keys typed in, and sends them off to the FBI. This is similar to a story reported on previously, but taken one step further, allowing computers to be compromised remotely."
Does this mean it will now be illegal to use a secure system? Having any type of security/virus protection will be circumvention of law-enforcing software.
And what happens if this "happens" to get installed on a foreign government's computer? Can we say "espionage"?
I can't say that I don't give a fuck. I've just run out of fuck to give.
Bob Sullivan, I am offended. "The software, known as "Magic Lantern," enables agents to read data that had been scrambled, a tactic often employed by criminals to hide information and evade law enforcement." Nobody I know uses encryption to hide illegal actions. Even the people I've caught doing illegal things don't do this.
I would love to meet the guy who thought this up.
What are the odds that antivirus software could be updated to find this virus? It obviously couldn't be cross-platform either. And if the gov't somehow manages to pressure a/v companies into not including it in virus defs, what would happen if some malicious kiddie got hold of the code, and unleashed a much more destructive version, knowing full well that most machines were not protected? Who would be liable in that case?
Where's my lobbyist? Right here.
Is it just me, or would any one else start to wonder about the aplication trying to get out through ZoneAlarm? any simple firewall would catch that trying to send data to the FBI and alert the person to the spying. Just watch how fast the system gets scrubbed when the 'crook' sees something like that. once again they forget that the people who are a real danger will have no truble getting around thier snooping, and worce, this one will alert them to the fact that they are being checked out.
Question reality.
In other news today, the FBI was arrested en masse for violating numerous newly legislated anti-terrorist laws prohibiting compromising remote computers...
of the case against Microsoft by disgruntled federal employees.
Mail-virus attachments are best contracted via Outlook or web mail clients; anybody with advanced security will not have a problem here.
Unless the government starts persecuting people on Linux and *BSD systems, because they are inimical to the FBI's spying methods.
Foucault's Panopticon, here we come..
Goat sex free since 2001
Please make the fix available as soon as possible, or there will be consequence - know what I mean?
Joe Soprano
a) The FBI kicks in your door and installs Outlook
b) You always open email with the subject "Snow White and the 7 FBI Agents"
c) You run the attachment called "FBILOVESYOU.VBS" (and you run Windows, Outlook, etc)
Blah, dumb communist FBI
Abuse my rationalization of rhetoric as either metaphor or monotomy.
If it spreads in virus form, wouldn't that constitute an illegal search or wiretap? If it lands in a foreign government machine, wouldn't that constitute espionage?
Does this mean that those not running windows will now be "suspicious persons" ?
Cheers,
-- RLJ
So now and then I see a conspiracy theorist say that the government is suspicious of nonconformist OS users...
So what happens when it becomes virtually impossible to use M$ OSs for terrorism?
Right, it makes us alternate OS users look suspicious.
Mind you, I'm generally not that paranoid, but if you ever read the Washington Post check out today's (11/20) article about Bush's consolidation of executive power and think about his family *cough*dad's CIA*cough* and friends, and tell me it isn't a little worrisome.
-- Still waiting for the Nike endorsement
It watches for a suspect to start a popular encryption program called Pretty Good Privacy. It then logs the passphrase used to start the program, essentially given agents access to keys needed to decrypt files.
If this is true, then it would seem all you need to do to foil this latest slightly-hare-brained-scheme would be to rename pgp to something else, such as goawayfbi.
Thanks to the FBI, a whole new market is now being pushed into exploring the world of alternative operating systems.
Talk about a boon to the Open Source movement! Show the people (not just the bad guys) that Microsoft's numerous vulnerabilities can be used by Big Brother to monitor them. I can't think of a better way to boost Linux distro sales.
The first thing that comes to mind is a flagrant violation of the DCMA.
:P. That was easy to get around.
How does the government expect to work around this one? There are so many things that can go wrong...
1. Probably OS-dependent. Remember: virii for one platform (i.e., Win) will probably not work for others. That was not hard to get around
2. Human link involved. This virus will presumably be propagated via email, or some other form of trojan. Those who tend to use encryption tend to block this type of thing from happening to their machine anyway. Yet another reason not to open email/attachments from an addresser named "CIA"
3. Network link involved. Those who use encryption are usually savvy enough to detect extra packets flying from their machine to some unknown address, which would easily be identified in a reverse-lookup.
My goodness, they are getting desperate, aren't they.
We can't do it, we can be jailed by showing a proof of concept, we're called terrorists if we give out proof of concept code, but the same people jailing us and calling us terrorists are doing it on purpose....
That makes me think of alcoholic parents telling their kids not to drink while they are wasted 24hrs a day. Well even that's more logical, at least the kid CAN STILL make a choice, either be like his parent or be the total opposite..... whereas here...
--- Metamoderating abusive downgraders since my 300th post.
So, would running Linux avoid this problem?
Since it's vulnerablities in windows that seem to allow the FBI to get in, would linux be ok?
In addition, is this legal? To break in using vulnerablities? Wouldn't that make the FBI in essence doing illegal things?
This only works then because windows has security holes eh?
From: Bill@Slashdot.org
To: Fred@Slashdot.org
Subject: Magic Lantern.doc.pif
Hi! How are you?
I send you this file in order to have your advice.
See you later. Thanks
-- Dan
A CERT advisory about 1337 h4x0rz in the FBI who are attacking the net with email worms...
;)
I wonder if mcafee etc will be updated to catch these viruses
If the FBI virus gets out of hand and e.g. destroys corporate, governmental, or military data, could the FBI be held criminally liable?
Which individuals are writing this software anyway? That's what I'd really like to know.
Software doesn't write itself, individual programmers do. So who are these individuals?
My guess is they're hiding under a rock somewhere, too cowardly and ashamed to show their faces in public.
Being a bit pedantic here, but do they mean a trojan or a virus? I would be very worried if it were a virus as viruses propogate - in criminals it could spread from one criminal to another, so no problem there. But if it passed to an innocent user, who then passed it onto friends, I'm sure there would be a civil liberties outcry.
I'm sure trojans must have been used for keylogging before. But won't using this mean getting a wiretap order? I also don't know how this system will cross jurisdictions: can the FBI infect a user in another country to get secrets? Sounds like spying to me, and it would ensure countermeasures from other governments and a change in computing systems to defeat the virus.
I'm hoping that some antivirus company makes a scanning system to detect this 'virus' and eliminate it. Otherwise its a change to a more secure OS, or using GNUpg (they did only mention it working on PGP, didn't they?) could do the trick.
You guys coming?
:-)
But if the software is a virus (or trojan, or some other malware), wouldn't that make it a tool of terrorism?
Does that mean we can have a military tribunal for the MIB?
This is sickening.
Please, please, PLEASE, somebody tell me that someone will write a program to watch for this "Magic Lantern" and disable it, or at least warn the user that it's installed.
Hmm...
Oh, and by the by... To anyone who wants to make that "if you're not doing anything wrong..." argument, please send me pictures of your wife naked. Just put my address on the back of a 3x5 print, along with your credit and checking account numbers.
Oh, that's private?
Then f**k off and don't let me hear you say it again until you're willing to put your money where your mouth is.
Quite rightly, I don't think that it's anyone's business to see the data on my computer, unless they have a real warrant and show up at my house with it. On the same token, I think that keyloggers should fall under wiretapping regulations. (Does anyone know if they do or not? Last I heard the FBI was trying to say that it didn't.)
It's going to take a LONG time to fix the damage our government is doing. If we're lucky, some of us will live to see something akin to real freedom again. If we're not, well, we'll just have to make sure that the stories get passed down to our children.
Maybe soneday I'll take the time to cohesively form my thoughts on this, but at any rate, I think y'all get the idea.
Pax, Ardax
I'm also wondering if you could rename/recompile PGP or other encryption software so that Magic Lantern won't trigger when it's activated. Also, entering a key without the keyboard (mouse clicks, off a .TXT file on a floppy, whatever...) would make keyboard logging useless.
Other ideas?
"Prepare for the worst - hope for the best."
Are there any cases involving damage done to personal property in eavesdropping operations? That is, legal taps? Any lawyers here? I gotta imagine that this would be a very very dangerous thing for the government to get into. Not only could it cause damage to personal property, but if the suspect is smart enough to encrypt their stuff, they're going to be smart enough to know when they've been h4x0red by an email virus.
This story makes a lot more sense if you remove every reference to "our sources" and replace it with "my little brother." I believe *that*.
There are no trails. There are no trees out here.
Not to mention that older versions of pine (up to 4.2.1) are vulnerable to a remote exploit by simply opening your mailbox
4.1 was vulnerable
http://www.securityfocus.com/archive/1/16269
and I know that 4.21 was vulnerable to a different exploit, but cant find the URL atm
|>
Store the encryption software on a non-networked machine (the encryption machine).
Store the encryption keys on removable media that is never left with the encryption machine when encryption/decryption is not actively being done.
Data in encrypted/decrypted form must be brought to the encryption machine via good old sneakernet (diskette).
Extra bonus points if the entire operating system and software suite on the encryption machine lives on read only media, such as a CD-Rom.
FBI Chief: What happen?
FBI Grunt: Someone set up us the disk.
Note to self: build auto-gpg-encryption into xP.
The feds already used a third-party keylogger that could be delivered via email. It is called DIRT.
I suspect the feature that makes this new keylogger more useful is that it is incorporated in their "DragonWare" suite of software, just like carnivore's lesser known post-processing programs Packeteer and CoolMiner.
"Weapons should be hardy rather than decorative" - Miyamoto Musashi
I think that goes for OS's too
Allthough I do think we should remain open for news like this I also think it becomes a bit boring. I mean hasn't it allready been proven that if you need (tight) security you should not use Windows ?
Since this is sponsored by the government, and obviously is something that would be instantly picked up by anti-virus software, what are the possibilities of the government making deals with anti-virus companies to NOT detect Magic Lantern? After all, if one "victim" is running active virus protection, bye bye magic lantern.
What about a search warrant?
Random thought: There is probably already a back door built into windows for this purpose... the result of many meetings between the DOD, FBI, CIA, and microsoft.
Skiers and Riders -- http://www.snowjournal.com
I don't think I'd be all that impressed-- this isn't exactly rocket science (or even sweet cryptography). The basics of virus technology are getting easier by the day. In the old days you had to modify an executable and get the thing to travel without the internet. Now a "virus" is nothing more than a script for an overpowered email client. Frankly, if you're smart enough to encrypt your data, I think you're also smart enough to think of some good ways to prevent electronic intrusions. So what? The FBI will just go back to good, old-fashioned raids, video cameeras, and wirtetaps.
.docs-- of course, it's hard to infect a JPEG with malicious macro code. *sigh*
Now getting random strangers to send me potentially embarrassing documents off their hard drive? Now that's impressive. I just wish SirCam had focused on sending me pictures rather than
I do not have a signature
Even though this sort of curcumvention measure is illegal under the DMCA for a private citizen, the DMCA also includes language that makes law enforcement exempt from these very laws.
covertly inserting code to gather information (or otherwise bash their box) onto someone's computer without their consent or knowledge is protected by our Bill of Rights!
They need a warrant (last I checked) to search someone's house. They need a warrant to use wiretaps.
Why is it that they think they can insert a 'virus' to log keystrokes? if this goes into the realm of Van Eck phreaking then I could understand (since van eck just picks up the stray emissions from your box...hmm, tempest anyone?), however, I still stand by the fact that *they need a warrant*
if they want to check out my files on my computer, knock on my door, present a _proper_ warrant, and proceed. That's the lawful way. Dumping a virus on someone's box is just uncool, and in fact, should render anything gathered from said box inadmissable.
of course IANAL...which is said all too frequently around these parts, any real lawyers care to comment?
What worries me is how long has this been out there?! I mean, this could have been out there for months, and if the US Government has leaned on the various Anti-Virus program makers in the US...this could have been going on for many months now.
ttyl
Farrell
CAN-CON 2019 - Ottawa's only book oriented Science Fiction Convention! October 18-20, Sheraton Hotel, Ottawa, Canada h
This certainly explains why the gov't backed off of the MS case (beyond the economy-in-the-bucket angle). Combine this, the DMCA, the SSSCA, and the FBI not being held to be in line with the DMCA and SSSCA, and you have this:
Only OSes with gov't-licensed security and DRM standards installed can be sold/installed/run legally. This means Microsoft, and possibly Mac. (I'm sure *BSD and Linux will be able to get certified, after going through a many-month/year-long certification obstable course and re-programming cycle). Backdoors will be inserted (if Magic Lantern isn't installed outright as a feature...)
And naturally, reverse engineering any of this (to close the backdoor, fix/change crypto, remove the MAgic Lantern virus, etc.) is highly illegal.
Anyone remember the sample dialog from a game included in the Paranoia! RPG? Let's revise:
Hacker 1: "The MS Crypto API uses ROT13!"
Hacker 2: "No way it could be ROT13! You lie! COMMIE!" *zap zap zap* (Hacker 1 dies)
Hacker 3: "How can you know it wasn't ROT13?? You looked! COMMIEE!" *zap zap zap* (Hacker 2 dies)
Hacker 4: "How do you know what ROT13 is? COMMIE!!" *zap zap zap* (Hacker 3 dies)
Hacker 5: "How do you know that ROT13 is even cryptographic? COMMIE!!" *zap zap zap* (Hacker 4 dies)
Hacker 6: "Ubj qb lbh xabj gung vg'f abg? PBZZVR!!" *zap zap zap* (Hacker 5 dies)
Hacker 7: "You are SO dead." *zap zap zap* (Hacker 6 dies)
(and so on)
Returned Peace Corps IT Volunteer
And of course if you find that your system has been infected and you run an AV program on it, you are arrested for violating national security.
That's like saying that the police have the right to break your window and then look inside from across the street. While a dozen other people climb through it, of course.
--GrouchoMarx
Card-carrying member of the EFF, FSF, and ACLU. Are you?
If the FBI is going to use methods like this,
how long before the next Windows System Pack
saves them the work by logging PGP passwords
and sends them off by some mechanism pre-arranged
with the FBI?
Can anyone tell me how having my passphrase obtained via keylogging will allow the FBI to unencrypt my private messages? Unless I'm much mistaken, you need my (well ok, the message receivers) private key in order to do that. I have never actually *typed* a private key, it is generated by gpg. If all this tool is doing is keylogging, they can't actually use the information gained to crack a key unless a) they get physical access to my machine or b) they install some other kind of virus that will start sending pgp data files as well.
I guess they could just do a secret search of my house if they obtained the passphrase, but that's about it. If they did I would have those fsckers in court quick as a limpet.
std::disclaimer<std::legalese> sig=new std::disclaimer; sig->dump(); delete sig;
Keyloggers and trojans are not impressive, Every hacker knows about this
however i suppose the average fool who happens to be usnig encryption doesnt.
If you use Linux, please help development of Autopac
The FBI doesn't need a virus to do this, all they need to do is tell Microsoft they'll drop the charges against them if they agree to secretly include code to do whatever the FBI wants. How hard would it be to add a keylogger to Windows XP's millions of lines of code? Not hard. The hardest part would be transmitting the data, but with most people being computer-security ignorant that won't be a problem.
What this really is is a way for the FBI to catch petty criminals. It will do absolutely nothing against professionals or anyone else who has a clue...
Of course, anyone who would be vulnerabe to this is either a moron or doesn't feel that they have anything to hide, so it seems kind of pointless.
Of course, the truely paranoid communicate with their computer using morse code with their space bar and scroll lock LED. I can see it now:
Head of Investigation: "What have we got from the J Random Hacker log file?"
Computer Specialist: "84,365,928 spaces, sir"
Under capitalism man exploits man. Under communism it's the other way around.
After it's renamed and loaded with the ATI drivers, PGP will encrypt things twice as fast, but side-by-side inspection will reveal it's algorithm to have switched to XOR.
write it so it disables the zone alarm notify process.
Now zona alarm simply will be "INFECTED" with the virus itself and shut down
of course theres many ways of doing it, disable it, or clone it so the user never knows its shut down, simply have a little "fake" zone alarm process, fake zone alarm in the system tray and everything the only diffrence is its not zone alarm, its the virus.
This is just too easy, this is basic hacking stuff that every programmer or hacker knows.
of course, to the average person, this is magic, this is serious hacking.
If you use Linux, please help development of Autopac
I guess they aren't if you are the fbi...
Got Freedom?
Thinking?
Step 1: Be an FBI stool pidgeon and send an infected document to your Mafia Boss.
Step 2: His custom anti-virus software detects the virus.
Step 3: You are fitted for some new cement loafers.
Are they serious!?!?
just = (My)Opinion.toCents();
Some people have said to use two computers, on on the net, and the other not connected. Encrypt and decrypt on the unconnected system, and use floppy or zip disks to move files to and from the connected system.
But really, as long as the system you read email on isn't doing the actual en-/decrypting, they can both be on the net. Read email on one computer. Transfer files from and to the encrypting system over the network. This keylogging program, Magic Lantern, only works if the machine it infects runs the PGP program. It's useless if only the computer next to it runs PGP. Magic Lantern would still be installed on the email machine, but since it never runs PGP, it can't do anything. It can't perform keylogging on the encrypting computer, even if the two are networked. No need to use floppies.
The bad news is sooner or later some idiot is going to lable Open Source a terrorist movement....
Idea: Come up with an app that sits on the SMB port (139, is it?) and acts like a Windows box... I believe the word is "honey pot"? One could port-redirect one's firewall to an old 486 running this thing, so as not to overload the firewall itself, and use QoS to keep the bandwidth down... sort of a LaBrea... well, not sort of, I consider ANYBODY trying to sniff around my computers a criminal, badge or no.
--
Keep your laws off my Internet
simply kill the process while launching a tricky "fake" firewall process so the user doesnt notice
set it to kill and replace the firewall when the computers been idle for more than an hour
If you use Linux, please help development of Autopac
I received an email with the subject "Good Times", and I opened it. My browser popped open, and sent me to a site that had the headline, "See what really happens 'behind closed doors' when John Ashcroft and George Bush get together." My firewall picked up something weird, but I don't know anything about that, because I was already getting ready to format my disk.
The truth about Scientology, Xenu, and you: Operation Clambake
No matter what they do they can't get at a non-networked box unless they physicaly break in and hack it and then again to retrieve the data (or transmit via radio waves). As for the networked box it never sees anything but cyphertext, no passphrases are used, and anything it puts on the floppy doesn't matter cause even if it gets on the sandbox it can't get anywhere.
Oh sure they could get tricky, do things with floppy boot sector virii that will run in the sandbox, log and save to the floppy, then re-run once it detects a network connection, but to this non-programmer that seems 1) problematic and 2) pretty easy to avoid. maybe even use CD-R or CD-RW.
Comments?
If you can't be good, be good at it!
Running a client OS is no defense, especially not MacOS- your going to download your email with some closed-source app, and thats when you get trojanned.
On the other hand its possible to build a stripped down linux box running only a command line program like xmail- which you built yourself from source (add openssh and gpg). Plus you'd want a stripped down kernel with only the simplest possible feature set that runs on your hardware.
You could even wrap the box, moniter, peripherals and cables in aluminum foil, if youre super-paranoid
Cant do that with windows/macos or any large graphical modern proprietary os, period, because
you cant trust the os, and you cant trust PGP commercial version.
Think about this for a minute (beyond what you've already been thinking, if you've been thinking at all
Various viruses have caused billions of dollars worth of economic damage to countries, both inside and outside the United States. These are costs which are solely borne by the companies themselves.
Microsoft has finally tried to ramp up their security awareness, and default settings, so there is some progress being made, however small. Meanwhile, companies are realizing the costs of viral attacks (and worm attacks) and are at the least paying to fix existing holes.
Now, the FBI comes along and wants to use these "existing" holes to deploy their virus. But do these holes exist? Is this really an option? The FBI would have to be inventing new viruses, or Microsoft would have to leave portions of their OSes open to allow the FBI attack(s) through. Of course, that leaves room for other attacks...
And people like me will either use an alternative OS to begin with (my Mac, or my Linux box) and/or secure their Windows box (and run as a regular use). I do not run virus scanning software on my Windows 2000 machine because I have (what I think are) good security practices:
Outlook is fully patches
I keep up to date on the Windows security patches
I run as a regular user and thus cannot modify system files
Javascript, etc are disabled in my browser
I don't open README.EXE files
So assuming the FBI wants to capture my keystrokes, how exactly is it supposed to work?
Technically I think the idea has merit, but the economic cost of leaving system open for such attacks (from the FBI or script kiddies in Columbia) is going to necessitate patches which will stop the FBI's "Magic Lantern" in its tracks.
... even with an insecure operating system
1. boot diskless system from CDROM which contains image of operating system and encryption software, and your password protected private key
2. physically connect system to network
3. copy encrypted email messages to system
4. physically disconnect from network5. decrypt email
6. shutdown system
(am I missing anything?)
All your 5kR1p7 are belong to us!
All your keystroke are belong to us!
All your exploit are belong to us!
Move all keystroke, for great injustice!
Fascism starts when the efficiency of the government becomes more important than the rights of the people.
-jhp
/. -- the Free Republic of technology.
Why are we getting email from some company called "Files By Irene?"
At first I thought that this was just stupid, because no one running a reasonably secure system, keeping up to date with the latest patches, etc, would be caught by it. But then I thought: why rely on already known (and fixed) and other yet undiscovered holes, when you can roll your own?
recently seen in #anti-trust:
*** BillG is now known as GMoney ***
<GMoney> How can we get out of this DOJ crap?
<FBI> I have this "security patch" I'd like you to distributed through Windows Update. Say it fixes some hole using malformed URLs in IE5 and IE6. No one will blink twice. I'm not even sure most XP users can read.
<GMoney> Will you put in a good word for me with the DOJ?
<FBI> Sure.
<FBI> DOJ: Let Microsoft go scott-free, or I post incriminating pictures of John Ahscroft and Hilary Rosen to usenet.
<DOJ> Rokie dokie, baws.
GMoney laughs maniacally.
FBI laughs maniacally.
DOJ tries to laugh maniacally, but chokes on the pencil eraser he was chewing.
*poof*. Insta-hole. Security patches are worthless if you can't trust the source. And yes, this wouldn't work with non-MS OSes, especially decentralized open source ones. I hope.
-Puk
The FBI is evil, but not stupid. If they did it the best way possible, then their software probably replaces a key part of your operating system's networking code, so that even if you knew each and every process running and exactly what it does, you could still have their software installed and never have any way of knowing.
r ity.html is standard reading in newsgroups and on websites dedicated to privacy. It is also standard reading in newsgroups and message boards where child pornography is posted. It is probably also known to organized crime and other elements which engage in illicit activities and use computers. It explains in language most people can understand, the use of PGP, firewalls, various encryption and security software, and the threat of keyloggers and trojans and how to use software like ZoneAlarm to secure network access to only those programs you choose to authorize.
After all, it's doubtful that Microsoft would object to the FBI looking at their source code for such a project, it's doubtful that Apple would object--but even if they did, the lower levels of OS X are open-source Darwin--and of course Linux is open-source anyway. It doesn't seem too difficult for them to do.
It seems that if they were to do it the simpler way, it would be too easy to detect. If they installed it like a simple trojan, it would be trivial to detect, particularly by software such as ZoneAlarm and equivalents which monitor all attempts by programs to access the net. In fact, if it is what they used in the Scarfo case and they are using it now, if it were a simple trojan it would probably have been reported by now. People with something to hide know what software to use to protect them from such things.
For example, "Dr. Who's Encryption and Security FAQ" http://www.slack.net/~hermit/ebook/documents/secu
Call me crazy, but I think the FBI would take note of this readily available information and come up with a way to counteract it. Writing their trojan into your operating system itself seems like a damn good way to do this. Windows and Mac users and even Linux users expect certain processes to access the network, so why not exploit that to camouflage an "ultimate trojan"?
There would be only one way to counteract it, and this is mentioned in Dr. Who's FAQ: make detached PGP signatures for each important file in your OS that you'd expect not to change, and use a script to check them against the files each time you boot, or each time you choose to run it. If a file has changed, you know something is wrong.
Of course, this is very cumbersome--how many files exactly should you sign? Very tedious. I got to thinking on this some time back, and came to the conclusion that if you want the best possible security against unauthorized changes to your system, the best way might be to install your whole OS and all your apps, configure everything how you like, and immediately transfer the whole system to one file. Then, strip down your OS to the very minimal parts needed to boot and to check the signature on the "big file" and your stripped-down OS files, then decompress/mount then boot the whole OS in your "container" file. If you have lots of cheap RAM, you can decompress the file containing your OS into a RAMdisk to save some time and make the files less persistent. A lengthy process, depending on how big your OS/apps are, but if you want security there will be a price. This way, every file on your system is uncorruptable, untouchable by trojans and FBI spyware.
I experimented with just that using Windows 98SE, and though I don't know exactly how you'd do it with Linux or WinNT/2k/XP it is definitely doable with Win9x. First I installed Windows and all my apps, then made a Zip file (using no compression at all, for speed of unzipping at boot) of the whole system. Then I deleted the system except for minimal DOS command files and a RAM disk creation tool called xmsdsk.exe and a command-line unzip tool, altered Autoexec.bat to call xmsdsk with the parameters to make a 1GB RAM disk (there were 1.5gigs on the machine), called the unzip tool to unzip the file to the RAM disk, and had the config files boot Win98 from that drive. It took fiddling a bit, but finally I got it right and it worked. When my Win98 booted, in the startup folder was a shortcut to check the PGP signatures of all the startup files and the Big File that the system was stored in.
Not ideal. Quite slow to boot up. You can see why I don't actually still do this; it was more or less an experiment. But it did work. When the system was shut down, the RAM disk went away, and so any changes at all to the system would be undone. If the Big File the system came from, or any of the boot files, were modified it would show up the next time I booted when the signatures were checked. It was unweildy, but it did provide full protection of a sort I can't think how to have otherwise.
So, does anyone else have crazy ideas on how to provide security against such intrusions? Preferably ones that don't require a boot time long enough that you can go make breakfast in the intervening minutes.
Chasing Amy
(We all chase Amy...)
"The more corrupt the state, the more numerous the laws"-Tacitus
As you well know, Java inventor Patrick Naughton, an ADMITTED PEDOPHILE developed secret software for the FBI so he can get out of jail sooner and be out on the streets molesting girls again.
ANYONE WHO MODERATES THIS DOWN MUST ALSO BE A PEDOPHILE
Please check my facts and moderate up
Quick! Everyone install this trojan and start typing as much as possible... Maybe we can /. the carnivore box :)
PoorMan solution - Two computers. One sends mail. The other one encrypts files. Encrypted files are always copied by floppy in one direction - to the sender.
But if a target is suspected by the FBI, you would hope that they would be clever enough to watch for backdoors, shield their machines from EMF, etc.
Obviously, speed is of the essence
(Note: for backround info on this net meme - look here.
[Insert pithy quote here]
I'm assuming a good DMZ would take care of problems such as these, as you might just as well assume that the local machine has been compromised.
Although sometimes the dmz machine gets hacked - personal experience here.
I still don't know how the machine got hacked, I restored from backups as soon as shit started going weird.
First question - anybody have some real good links for setting up a DMZ (I got hacked and I know I followed the directions exactly on one site)
Now, assuming the story is not bullshit, how would one defend against such an attack. I've heard several good ideas, such as boot/run from a cdr, creating a zip image of the HDD and restoring from it if something changes, etc...
A software solution would be really great, especially if it was an open source program.
1q2w3e4r5t6y7u8i9o0pqawsedrftgthyjukilo;p'azsxdcf
First response wasn't flamebait. I'm merely pointing out that the effa bee eye could insert this into systems with relative ease and stealth. XP Service Pack 1, anyone?. How many users are going to notice if cisvrc.exe or any of the other "mysterious" task manager entries is suddenly using 25k more ram?
We should be fighting against those who would use this software, not the software itself.
there's more than one way to do me.
Of course the old spy game still has a few twists. Try this on a proper hacker and it'd be very interesting to see the results.
;-)
I for one would enjoy spending quite a bit of my time reverse engineering the thing just so I could send them dummy information.
It's an old war trick. Break their code and feed them iffy information. They're so trusting of their technology most of those idiots wouldn't even see it coming.
This game works both ways
An anonymous coward (or, really, anyone on Slashdot) actually gets it!!
Thank you!
DFL
Never send a human to do a machine's job.
Surely they couldn't be planning on replicating it like a virus. Striking out a random and invading the computers of people they don't have authorization isn't just ethically suspect, it's a federal crime under current and highly visible law.
C//
It just occurred to me that the great deal Microsoft just got from the justice department could have included some secret quid pro quos, many of which are consistent with Microsoft including some ultimate FBI-enableable backdoors.
Note that the recent anti-terrorism legislation (USA-PATRIOT) has an express provision exempting negligent software from the Computer Fraud and Abuse Act, a bizarre provision to have thrust into that bill unless someone was negotiating protections from civil litigation for providing an undocumented backdoor.
Sure, its a conspiracy theory, but not a bad one. This package was just bundled up too prettily to be an accident.
This is beyond the reasonable powers that our government should have to monitor our lives. I don't believe that the Government is wrong to be able to wiretap a person per the USA act, as opposed to just tapping one of their devices. I don't mind that the government can intercept plaintext emails and archive them. Echelon, well, even though it exists, what kind of storage are they keeping down there? The entire textual communication over the internet, one day is several hundred TB worth. The NSA would be spending more on EMC2 storage arrays then their budget, daily.
I do mind that now the FBI has the power to remotely install keystroke loggers to gather encryption passphrases that are emailed to a central station. This rings similar to what the RIAA wanted to do - enter into computer systems and make sure there's no illegally copied material on them.
Since when have the "shall not infringe" and "Shall make no law" of our constitution been able to be warped into "shall do whever the hell Dubya and the Criminal Institution of America, and the National Socialist Agency, want"
Sometimes I'm ashamed to be a U.S. citizen. Really.
AN 1 Nov 20 agent213@fbi.gov (335) Hot Porn!
[enter]
Attachment: sexypix.htm.exe
Damn, I can't run it.
-Legion
How many straws will it take before the people of the United States, the people who take pride in living in the "best nation on Earth", the "land of the free," stand up and say ENOUGH?
Is a sense of security worth allowing Stalinist Russia to be reborn in America?
How many straws, America? How many?
Someday, you're going to die. Get over it.
No, you're missing the point. If the FBI could get a warrant on you, they'd just require you to give them your passphrase, or just subpeona the information that was encrypted in the first place. The reason that the FBI needs this is because they know that they can't get warrants for what they want to do, because it's illegal and they have no probable cause for sticking their noses in your business.
You know that if the FBI can't get a warrant for the information in the first place, they won't be able to get a warrant for this either, so what would they plan to do with it, other than break the law?
Join the Slashcott! Stay away entirely Feb 10 thru Feb 17! Close all tabs to prevent autorefresh!
At least you can still publish "ideas" on the net.
Bill C-36 will make it a thought crime to write terrorist thoughts on the net, among much other sweeping restructuring of freedoms. This is actually the least of my worries. For quite some time our prime minister wanted this to be permanent legislation. At least now we only have 5 years of authoritarianism at hand. At that point hopefully the Canadian people won't be so blinded by their anger at people on the other side of the earth that we will help care for our own freedom, rather than trading it to Afganistan.
Read it and weep Canada. The Taliban may be defeated soon but they shall win posthumously, even though they've never struck our homeland. They will take what they truly seek: Our freedom. This is a truly international victory for the enemy.
Nothing much makes me happy anymore, except that a few wartorn cities in Afganistan have a semblance of freedom now. I feel sad about the lost souls at the WTC, the children in Afganistan who've never seen freedom, those there who lost their freedom for so long. And now I feel sad that writing this, with words like "WTC", "Taliban", and "authoritarianism" I may soon be flagged as a possible Taliban supporter along with the many others who have carefully suppressed their rage at the Taliban in the pursuit of a logical end to all the fighting.
I submitted this story (with more links and a better writeup with less opinion) to slashdot a long time ago but I guess they have better things to do than help defend the liberties of countries outside America nowadays (ahh, I pine for the days when slashdot reported on stuff like our CD-R piracy taxes and such).
And I thought only Nixon kept lists of names.
If you could be told what you can see or read, then it follows that you could be told what to say or think - BoC
So, if some anti-virus house like Norton or McAfee updares their offering to be able to screen-out this FBI virus, do they go to jail for obstruction of justice or some DMCA related crap?
Problem is, as government-funded tools filter out into public networks it will spark a discussion of these tools in a public forum, which once they are decompiled and attack modes are diagnosed, will give tons of people the ability to launch more sophisiticated attacks. Either it's someone who reengineers it and hands it to script kiddies, or it's other organizations or nations which will feel an imperative to grab the next escalated technology level.
Consider: the article says "levels the playing field with criminals" or something to that effect. It also means the FBI will use tools criminals use. It is easy to see this becoming espionage when used against a foreign firm by the FBI or by someone else who has appropriated their technology.
Few firms have virus-busting firewalls or antivirus packages which can handle new attacks before they cause damage or hide in archived material. Perhaps the scariest thing is that if a new variant is created for a specific "sting", it could quickly take over many computers over a large geographical area (consider Code Red graphs) before antivirus manufacturers or the public at large come up with a patch. In the past there has been a chance at getting a patch before infection.
But with the public funding a combination of email hole, pc based server, network scanner, key logger, and encryption program defeater, it seems that we are *very* quickly going to enter a much more dangerous situation than ever before.
It is not possible that this technology will never be misused by the government.
It is not possible that this technology will remain in the hands of the FBI.
It is not possible that this will not accelerate worldwide efforts to provide more and more dangerous security-breaking software/services.
Because it is so cheap to develop this kind of a weapon, it is my opinion that it is 100% likely that terrorists, multinationals, and national security organizations around the world *will* coopt this technology or will develop something identical to it (or more powerful) on their own. This is the part that scares me. No more Net! Who will ever install a binary from a public server? Who will ever trust interactive content and the plugins which it requires? Who will be trusted to hold the keys?
The FBI is moving a physical wiretap capability highly limited by timing and resources, into a software wiretap regime of high speed, exponential viral growth, widespread destablization of security prior to a court order, and extremely low cost of deployment.
This attempt to coopt the entire networked computing base as a wiretap infrastructure is the most dangerous force I can identify to the world economy and spread of the Internet in all facets of life. It is very hard to have reasonable security for most people at broadband speeds, but one could be forgiven for hoping that problems would be solved in time. Not when the crackers' growth metric takes off exponentially and leaves pro-security forces behind.
I don't think I'd mind if this was used against the people who have attacked the U.S. In fact I'd be surprised if something more powerful wasn't used already. But now we are going to start getting a trickle-down of progressively military weaponry operating silently in our homes.
The cat is out of the bag.. and the technology obviously already exists. The only choice we have is to promote some kind of open source, open science project which could have some hope of markedly improving security in general, could dampen the effects of for example thousands of concurrent Magic Lantern - style attacks from every part of the world. To me, an open, international project is the only way to protect computing in the future.
The FBI already has plenty of tools, and there is no reason it can't improve its cyber attack capability without building such a dangerous system. I certainly don't want to protect the mafia. But unless proven otherwise I think we have to assume that things will get worse all around before they get better.
If you want to see a simulation of the "gray goo" doomsday of nanotechnolgy, simply wait a few months for the next wave of network pathogens.
We will not be safe until we have the U.S. and other governments on the side of the public, with a law against cyber-germ warfare and a well-funded infrastructure to combat cyber-pathogens which do appear with some kind of human and computer based immune system before we enter the age of the network-borne pandemic.
i guess some todo lists are going to expand...
7.30 get up
8.00 go to work
8.02 check email
8.03 reverse engineer fbi trojan
8.10 spy on everybody an his mother
.
.
.
18.30 be happy to be a l33t FB1 5upp0rt3d ha>0r
nice...
My impression is that people are too technocentric here :). I think it is more relevant, under what circumstances, by what legal procedures, under what supervision tools like these get used. Law enforcement has always tried to use latest technology and carnivore, viruses, electronic bugs and laser-microphones can all be used to intrude into your privacy. What worries me more is the possibility of these things getting used too easily, the data being gathered being stored too long, nobody supervising and controlling the people using this. It seems that lately exactly these legal issues are at stake in the US (and also here in Europe), no matter what technology they use.
What group do you think is a greater threat, wackos with guns, bombs, anthrax and kamakaze pilots, or an federally funded and empowered organization intent upon undermining the freedoms and rights that are each American's by birthright?
I don't know about you, but I fear the latter far more than the former. Two skyscrapers, a government office building, a handful of airplanes and a few thousand lives are insignifcant in comparison to the legacy of freedom that has been passed down to us. We can either be the keepers and protectors of that legacy, or we can be neglectful and discover that it is no longer there one day and that our once noble nation has become a police state, which will you choose?
The FBI needs to be reeled in hard and fast and taught a history lesson on exactly who is in charge in this country. We the people run this show and if the FBI is going to be a menace to the people then the FBI can easily be demolished. Never should the people live in fear of those who are supposed to be their servants and protectors. The day that happens is when the FBI becomes the world's foremost terrorist organization.
Lee
Muslim community leaders warn of backlash from tomorrow morning's terrorist attack.
... is that unless the FBI are playing a very deep game, then they cannot crack PGP directly. Of course if the NSA had made a major beakthorugh in factpring, they probably wouldn't have told the FBI, but I guess it's still something...
and realy InfoWorld gets a lot of ad revenue for microsoft and others with MS compatable software.
Their benchmarks have not been universaly reproduced by other testers, maybe what they are realy saying isn't so much that its slower, but that it could have something like this in it.
Apocalypse Cancelled, Sorry, No Ticket Refunds
just click no whenever you get this window popping up, an youll have no problem.
Sorry to inform you all about this, but the recently passed "Anti-Terroism bill" makes it easier for the FBI to ask england to get information on a suspected criminal, because now evidence from a "foriegn" nation is admissable in court no matter how it was retreived. so you no longer have protection against an illegal search, because our government just needs to ask someone else's government to do the breakin for them.
Also if you read the new Anti-Terroism bill you will find that the wire taping rights have been expanded, and this might not be illegal anymore.
for more information on the homeland security act check out aclu archives
Now I understand why the feds were so insistant that the Scarfo bug fell under their search warrant, and no wiretap warrant was needed. If no agent visits the premises then presumably no search warrant is required. And Scarfo establishes that no wiretap warrant is required to keylog a suspects pass phrase. So my bet is, this thing will not "phone home", but save the pass phrase on the victims hard drive. When the feds come, search warrant in hand, to collect the computer, they just happen to find the pass phrase sitting in a hidden file.
Now I'm starting to feel paranoid.
You are a trusting person.
How do you know that windows isnt simply notifying the trojan anytime ANY password Edit-box(where your keystrokes turn to *'s) gets keyevents?
It wouldnt be hard for the GOVERNMENT to get the specs the need to setup a WINDOWS HOOK in software. They may not even care if they have to sift through some of your other paswords besides just the PGP one.
Dont underestimate the gov'ts ability to get one weeks worth of sloppy programming done.
And who the hell said you'd need to change encryption schemes? If that were the case why would they *bother* with keyloggers?
Nobody has asked the important question: Is it themable?
A deep unwavering belief is a sure sign you're missing something...
here here here here and here
ipv6 is my vpn
Sadly, I can't really disagree with you about that.