Slashdot Mirror
McAfee Will Ignore FBI Spyware
Drew writes: "The Washington Post is reporting on the FBI's new spyware called 'Magic Lantern.' According to their article, 'At least one antivirus software company, McAfee Corp., contacted the FBI on Wednesday to ensure its software wouldn't inadvertently detect the bureau's snooping software and alert a criminal suspect.' It is ridiculous that the software companies that are supposed to help us protect computers purposefully leave in loopholes for the FBI to operate their spyware."
Now anyone can craft their virii to look like the FBI's brood and avoid detection alltogether.
Fabulous, I hope everyone feels safer already.
--
WHO ATE MY BREAKFAST PANTS?
Uhh...why not hack McAffe to find the signature it's looking for?
The point is, these aren't loopholes for the FBI. McAfee will ignore this loophole, and that will allow CRACKERS to get into your system. This program, which is intended to prevent people from getting into your computer, will happily ignore all cracking that takes place through the same loopholes as this so-called Magic Lantern.
Oh well... Next time, use OpenBSD.
does anyone know of a URL for a well-written anti-microsoft screed that would be understood by my grandmother? something that intelligently synthesizes arguments against hailstorm/passport/closed source/key escrow/etc. and for the adoption of free software?
So I guess for linux users, the email would probably look like the following:
Dear Sir or Madam,
Please make sure you are root when you execute this file.
Thanks,
The FBI
For one thing, I wonder if this "Magic Lantern" has been ported to Linux. I tend to think not - it probably needs some pretty OS-specific code to hide itself effectively, so for now my bet would be Windows only. If you think Linux is common enough they'll want to rewrite a Magic Lantern for it soon, just continue along the path of security through (relative) obscurity, and switch to BeOS.
Another option: I wonder what a port sniffer/firewall would see while the Magic happened? If anyone posting to slashdot thinks the Feds might want to shine a Lantern on them, could you try this experiment? We won't know whether you really have ML installed until you're disappeared, of course, but at that point your data might prove useful.
I'm the stranger...posting to
Arrggghh!
OK, I really need to get this off my chest here.
How will this affect copies of software sold countries outside the US? Will my AV software end up crippled and able to be exploited by those who have reverse engineered the "FBI Friendly" code?
Why is this acceptable? Because the good old US Government wishes to remove the much-lauded freedom of its citizens, the rest of the world also loses those freedoms. Will McAfee for example really bother to have a US-only version with the FBI-lover code in it, and remove that code from all other versions? Even if they say they have, how will we know???
Grrrrrrrrr....
Prisoner #655321
Is anyone else wondering whether this means that it would soon be mandatory for software that is used in the US to have exploitable security flaws in order to better catch terrorists?
For those that would point out that convincing someone to click on an attachment is social engineering and not really an exploit, I'd like to point out that there are mechanisms that can be put in place both at by the OS or the mail reader to make things like clicking attachments less dangerous (automatically running attachments as a user with minimal privileges is one of them). But given that the FBI is relying on OSes not to make doing this easy would applications or OSes that tend towards security start to face the same stigma and negative association that encryption has faced since the events of 9-11?
The problem, in my opinion, is that sales of McAfee's products will NOT drop because of this. You're forgetting that 99% of the people who buy that product do so because of FUD--Fear, Uncertainty, and Doubt. These are people who do not understand computers, viruses, bugs, worms and all kinds of other "marketing" names. They buy McAfee because it will prevent "hackers" (who should be called "crackers") from entering their system and causing their CPU to melt. These people will say, "Well of course McAfee shouldn't detect the FBI's crimefighting behavior." They simply don't know that this is a loophole for crackers (the "hackers" they're afraid of) to take advantage of. And they'll never consider that a possibility.
THAT is the problem with things like this. Just wait a few more days and we'll probably get a Slashdot story about a press release by the FBI telling of a new "technology" (a 4KB program that plugs this loophole) that empowers criminals to rub the Magic Lantern and make a wish that the FBI will leave them alone.
no need to be root just to monitor the user...
Hum, all we have to have is some hackers go through the virus scanning software and figure out what they're "ignoring" for keystroke logging and other things and impliment it the same way the FBI would. That way it would go completely undetected.
I'm glad the PC world feels safe with virus scanners installed.
In case you want to shout at them about how you'll not buy any more of their products. Maybe if McAfee understands how stupid this is, they'll change their minds (hahaha, right).
http://www.mcafee.com/aboutus/contact_us.asp?
McAfee.com Corporate Headquarters
McAfee.com
535 Oakmead Parkway
Sunnyvale, CA 94085
USA
Telephone: (408) 992-8100
Fax: (408) 720-8450
"If he thinks he can hide and run from the United States and our allies, he's sorely mistaken." Bush on bin Laden
Why does an organization like the FBI even need the ant-virus makers cooperation? If they were half as good as the federal government makes them out to be they would have a cross-platform, stealthed, and god-only-knows-what program out in a day.
Or is that the NSA?
But honestly, if virus writers can bypass virus-scanners, why can't the Feds?
"McAfee Will Ignore FBI Spyware"
They've been ignoring viruses for years. Why change now?
;)
Knunov
Why do users with IDs under 100,000 or over 700,000 usually have the most worthwhile comments?
Norton Personal Firewall/Internet Security detects and stops this software from operating, as a personal firewall program is designed to do.
If McAfee does not, then they should be investigated by the FTC for marketing a low quality product.
It just may be that the FBI's so-called "Magic Lantern" is a classic magician's trick. They are telling the whole world that this Magic Lantern is a technology that will seek out and destroy every dangerous criminal on the face of the planet. They're marketing it as an unbeatable technology that works on EVERY SINGLE COMPUTER IN THE WORLD (that is, every one that's running Windows). They're causing lusers to think that there really is some kind of crimefighting technology when it's really nothing more than a bug which allows crackers to compromise Windows.
Then, the criminals who are trying to avoid the FBI see this and talk to someone who understands computers. That person tells them how to patch their system to remove the vulnerability.
Here's where the classic trick takes place. The criminal thinks he's immune from the Lantern, so he goes on with business as usual. He writes down his drug trafficking records or whatever, and then the FBI goes in behind his back, using some other system that nobody knows about, and gets the information.
I'm not saying this is what's going on. On the contrary--government people are really stupid, and even more so when it comes to computers. But I'm saying this is a possibility, and I'll try not to discount the FBI's intelligence just yet.
Oh well.
It doesn't need to be as complex as that. They could just require that all computers contain a user account named 'fbi', group 'root', password 'jedGaRHoOVer'. Simple.
Failure to support the account would be considered an act of harboring terrorists. Civilians using this account would be considered impersonating a federal agent: that's illegal, so there won't be a problem with unauthorized access.
I've got even better advice than not running virus protection programs at all: Get FreeBSD, install it, configure a good firewall, maintain the system properly, make backups of your files often, and don't run as root. You won't even need virus protection programs--the system is protected by design.
OH WELL.
wonder if this "Magic Lantern" has been ported to Linux. I tend to think not ... so for now my bet would be Windows only.
That's a hell of a bet to make if you're a criminal. There are a reasonable number of remote-root exploits for Linux, and it's possible that they're may be unknown ones out there.
I mean, Christ, the FBI isn't that stupid, I'm sure they have the resources to port software to different platforms, even if they need a totally new codebase.
autopr0n is like, down and stuff.
forgetting that 99% of the people who buy that product do so because of FUD
... the American market may well stand behind an American company and the FBI in the name of national security.
Not really true.
Most of the people who buy antivirus software do so because they know they are at risk.
You've seen you rapidly viruses can spread in the time between they're released and the time the AV companies release detection.
And you know that even after the AV companies detect the virus, the virus doesn't die out straight away because there are enough computer users who aren't running AV software to keep it alive.
If you were running IT for a large company, wouldn't you want to be protected from Sircam say, which you know is out there and you know will forward internal documents when it spreads?
The rest is right though
http://www.thehungersite.com
The way anti-virus software generally works is that it detects particular programs and patterns. This isn't like fixing a security hole or something, where a number of programs can be stopped with a single fix.
In this case, they'll probably just not write a detector for ML, and it won't get caught. If someone writes something similar to ML, they'll probably just test their detector to make sure it only catches the intended virus and not ML.
McAfee is in the business of stopping particular exploits, not of fixing anything. That's why people keep getting new viruses that aren't significantly different from old viruses.
Of course, ML doesn't seem to be designed to spread all over the net, so McAfee probably wouldn't do anything about it anyway, any more than they do anything about other non-automated security breaches.
There is no doubt that Macafee's mindless show of patriotism invites a new breed of free-to-do-as-they-will virii from everyone, including terrorists -- merely by attempting to appear to be the Golden Lantern.
But moreover, it shows an economic cluelessness, inviting competitors to provide a service they do not. Even worse, it is one thing to sell a "here's some filters, we're trying to keep the buggers out," program, but another thing entirely to sell one KNOWING that it will permit viruses to go undetected. That additional scientermight even invite litigation from companies injured by their recklessness.
In short, it is amazing what a little jingoism can do to get people to lose their minds.
Way to go. The FBI, in hopes of protecting the nation, introduces its mystical spyware to facilitate its enforcement. MacAfee, in its strong show of faux patriotism willfully places a security hole in its virus systems (and I have no doubt that some government backdoors is part of the Microsoft antitrust settlement).
Net result is that we have made an internet security infrastructure even weaker than it was before. While this overall approach is not likely to beat up on well-informed criminals and terrorists, it does weaken everybody else's system, making the nation even more vulnerable to actual cyberterrorism than it was before.
All we have done is to make a nation weaker.
This creates an interesting situation. As I understand it, virus detection programs use:
1) signatures -specific byte patterns which are searched for in files, and
2) heuristics - in this case algorithms which seek unlikely looking data to determine whether the user should be alerted to a possible intrusion attempt.
McAfee can of course omit signatures for this 'Magic Lantern' (ML) software from their database. However, in the case of the heuristics, avoiding user notification of ML requires either:
a) a weakening of the heuristic(s), presumably to such an extent that other viruses may penetrate the system or
b) the presence of a special signature in the McAfee software which (on recognizing ML) can 'override' the heuristic
Case (b) is interesting. If McAfee do this with a simple byte pattern search this will immediately provide viruses with a neat little 'binary tag' which permits them to evade McAfee's software
The alternative must be to use a cryptographic hash which can be used to identify ML but which cannot be readily forged by other virus code. Using this checksum technique also demands that the ML 'payload' remain unchanged. Very restrictive for code which needs to be stealthy.
But the most important side-effect of both of these techniques - and any others McAfee might choose to use, would be that it provides an easy route for developers to produce software which can check for ML.
In other words, McAfee cannot both provide useful levels of virus detection and avoid alerting the user to Magic Lantern without giving other developers a blueprint to locate it.
Programmers of the world unite, you have nothing to lose but your strings.
What are you talking about? Anthrax has a documented existence of thousands of years -- presumably it has been around much longer -- having been a problem for the ancients right up until Louis Pasteur developed a vaccine in the 1870s. The microorganism was isolated by Dr. Robert Koch in 1876, who named it Bacillus anthracis after its accepted name of anthrax, from Middle English antrax carbuncle, from Latin anthrax, from Greek, coal, carbuncle. [1] It wasn't until WWI that the US started exploring the use of anthrax as a biological weapon. [2] All that we did was make it more portable. But to say that we developed something new and decided to call it anthrax? That's just silly.
n ary&va=anthrax
-Waldo Jaquith
[1] http://www.m-w.com/cgi-bin/dictionary?book=Dictio
[2] http://www.defencejournal.com/dec98/anthrax.htm
A user account might be all that needs to be compromised. You don't need root access to read your mail, and you don't need root to make IP connections. And with facilities like cron the trojan could make sure it was always running.
- Create message on machine isolated from any network.
- Encrypt message, then copy to floppy
- Load floppy on networked PC
- Send to all your buddies!
- Don't forget to take isolated machine with you when you leave your hideout...
Bad FBI, no donut!Yeah, right.
Does magic lantern require a search warrant?
Does this qualify as wire tapping?
Does the international cybercrime treaty apply here?
Can they install this virus on a computer in another country ? (where US due process may not apply?)
Just some thoughts.
and not purchase, nor recommend to anybody including my employer (2000+ PCs) McAfee's products. Or any other product that doesn't jive with what I want it to do.
Will be interesting to see what the marketplace thinks of this move when their stocks start trading again on Monday.
F-Prot isn't based in the States, and maybe they will provide the protection users want.
You can lock a UNIX box down tighter than a virgin whore if you know what you're doing. And with the current IT job shortage, I bet Don Parcheesi can find a pet UNIX geek or three dirt cheap. Or some trustworthy ones for a bit more.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
I use filters for web, scanners for adware, virus checkers, back up programs, password safes, security tools and firewall software.
My computer is a warzone, as long as I have the tools I can win the war. I wonder how long before my tools will be outlawed.
-
Politics is the art of preventing people from taking part in affairs which properly concern them. - Paul Valery
... like assuming the virus checker uses md5 ...
For all you know, it uses a simple 8-bit checksum.
This is Microsoft's wet dream... If the holes the FBI uses are unique, then the holes will be classified to protect the FBIs ability to monitor terrorists (therefore protecting national security). That means, they will have the ability to stop security exploits from being published in the interests of national security.
int func(int a);
func((b += 3, b));
We need to protect ourselves vigorously from crime. However, creating secret agencies who are able to commit crimes themselves is not the way to protect ourselves.
Already there is a serious problem with people committing some destructive act and claiming it was done by the CIA or other U.S. government secret agency. There is no good defense against this, because people worldwide know that the U.S. government secret agencies routinely break the law. How could it be proven that the FBI, CIA, or NSA, or some other secret agency didn't do a particular crime?
The U.S. FBI, CIA, and NSA are now worldwide surveillance agencies. They are supported by Americans who are not allowed to know how much of their money is spent on surveillance. United States citizens are not allowed to know what the U.S. government secret agencies are doing, so they don't know if the agencies are doing things they would now support.
The people who work for the FBI are often not smart people. They don't realize that trust is absolutely necessary in a democracy. They have often in the past not shown understanding of the other needs of democracy. They have often acted like secret police. They often believe in killing or other ways of being destructive as a way of curing some ill in society.
Now they will be attacking computers like the criminals. They will say that they are doing it only to solve crimes, but it is socially impossible to control this kind of thing. Once the principle is established that a secret agency can break the law, there is in practice no limit to what some people in that agency might feel "justified" in doing. Consider your own experience. When has the boss had complete knowledge and complete control over the actions of employees? Never. A company's only good policy is to hire open and honest people and to encourage honesty and genuine caring.
The FBI's influence will mean that the U.S. taxpayer's money will become a powerful force in preserving security holes, instead of closing them. Generally, this kind of software has had holes of its own. You may be attacked by a cracker exploiting a security hole created by FBI software. Governments will detect FBI snooping software and feed the FBI erroneous information.
This is all support for people who like snooping and sneaking. It is not actually a way to reduce crime. It is for adults who like to treat the whole world as a video game. It is for the kind of people who think of themselves as James Bond, who like the idea of being able to kill other people legally.
How U.S. government policy contributed to terrorism: What should be the Response to Violence?
Bush's education improvements were
Next week's headlines:Also, I'm wondering how long it will be before some enterprising soul catches a copy of the lantern, analyzes it for a
Or better yet (for suitable notions of "better"), use McA to detect it, but rather than replacing it just install a script to fake a safe log for the FBI's reading pleasure?
Sheesh, evil *and* a jerk. -- Jade
There is one implied point that I can agree with - development of offensive techniques can come back to bite one. However, the example of anthrax is increadably lax in fact.
Others have already pointed out that anthrax is a natural agent. It is one of few agents known that could be deadly enough to be used as a weapon. Research in this agent have been towards defense against the weapon as well as creating a more effective strain.
One thing that hasn't been pointed out is that this is not the sole realm of the US military nor Mr. Bush (either one). Anthrax research began over 80 years ago. And not just by the US. The Biological Weapons and Toxins Convention produced many signers agreeing to prohibit offensive biological weapons research and production. But it has done little good. There are numerous states and autonomous groups (ie: terrorists) continuing development of biological weapons. And two major signers of the convention, Iraq and the former Soviet Union, later acknologed continued offensive biological weapons programs. Today, there are believed to be at least 17 nations with offensive biological weapons programs.
Iraq itself has claimed to have produced "weaponized" anthrax. There are fears that former USSR scientists have been hired by external interests for their knowledge of anthrax based weapons. And of course, it is unknown how many terrorist organizations have their own biological weapons programs. One known group Aum Shinrikyo, responsible for release of sarin in a Tokyo subway station, attempted to release anthrax and botulism throughout Tokyo on 8 occasions with (thankfully) negative resaults.
The US Army and Mr. Bush may not be helping the situation with the state of biological threats in the world. But they are far from the only cause of this threat.
The threat offered by Magic Lantern is a bit different than anthrax. Defense against biological weapons are, for the most part, a resonsiblity of the State. However, security of private networks have been, and really should continue to be, the resonsibility of those who own those networks. If those in the industry who provide key solutions to private security conserns wish to hamstring their products, then those who are responsible for their benifactor's network security should know. And adjust their contracts / purchases / strategy accordingly.
Hell, why doesn't McAfee just include FBI-Orifice in their install package? Might as well save time...
One line blog. I hear that they're called Twitters now.
I can't help but notice you're using a pseudonym. You wouldn't be doing this unless you have something to hide; why else would you not give your real name?
Vintage computer games and RPG books available. Email me if you're interested.
I refer to my previous post on this very subject a few days ago...
3 071
http://slashdot.org/comments.pl?sid=23995&cid=259
Skiers and Riders -- http://www.snowjournal.com
- Are these devices legal?
- Will they detect wiretaps placed by the police?
This is EXACTLY the same situation. What is the legal precedent?- The security of an iterative hash algorithm cannot be any better than that of its compression function. (Source: Menezes, Van Oorschot and Vanstone, Handbook of Applied Cryptography)
- MD5 is an iterative hash function. (Source: Schneier, Applied Cryptography Second Edition; also, Menezes)
- Collisions can be generated in MD5's hash algorithm (Dobbertin, 1996).
- Dobbertin's compression-function collision algorithm executes in just a few hours on a 586 (Dobbertin, 1996).
- Therefore, collisions in the full MD5 algorithm can be generated in the same time or less. (This is known to be true as a logical consequence of what's already been proven; if anyone has actually used Dobbertin's attack on the full algorithm, they've kept quiet about it.)
... Next time, before you quote Applied Cryptography, you might want to ask a cryptographer what the latest research in the field is.When has the boss had complete
knowledge and complete control over the actions of employees? Never.
During the Industrial Revolution, many had to buy from company stores, live in company housing, etc.
And nowadays, H1-Bs can basically be deported by their employer.
Just because it CAN be done, doesn't mean it should!
Does anybody know what the subnets for fbi.gov are? It'd be pretty easy for people to block outgoing connections to them...
my old sig used to be funny, but then slashcode ate it and now it's not funny anymore
Easy way to abuse the FBI's new Magic Lantern "virus."
Do illegal stuff online, and be conspicuous about it. If you are already involved in organized crime, this will be easy. Do all your stuff using PGP on a Windows 2000 base install. Regularly talk on the phone to your buddies about those idiot FBI agents who can't read your encrypted email. Make sure to do everything with LCD montitors so that the FBI has to crack the email instead of just tapping your CRT. Get a geek to learn a lot about virus operation so that he can regularly check the system and snag the virus.
As soon as the virus pops up, keep playing along. Send out encrypted crap messages that make no sense, and appear to be written in code words so that the FBI spends more time trying to crack THAT code after cracking the message. At the same time, decompile the virus and figure out how it works. Alter the virus to be self-propigating and extremely malicious, destroying all filesystems on infected machines and shutting them down while residing only in memory to prevent people from finding the virus on disk.
After a few days, set up an online store selling anti-virus software at $19.95 a seat licensing. Encrypt everything the program contains with the exception of an executable, so that no other virus company can figure out how it works without violating the DMCA.
Laugh at the FBI agents who are too busy trying to figure out what all your code words are to notice you raking in millions with a foreign company selling anti-virus software, move to Zug, and retire.
I admit, that scenario is a bit of a stretch. A more likely scheme (And what will likely happen very soon.) is a few good crackers decompile antivirus software from McAffee and Norton, both American companies that will allow the FBI virus through, and compare it with antivirus software from foreign firms, which will likely block the FBI virus to prevent the USA from spying on their companies as the USA does with echelon. Bingo, killer virus in no time flat, watch it take the world by storm. And before any of you bother to post about how the FBI will manage to keep all the details secret so that this doesn't happen, think about this; if the FBI could manage to keep a secret, we would not know about things like Magic Lantern and Carnivore to begin with.
I want to thank the FBI for fucking over America with their inability to realize the dire consequences of their poorly-planned actions. By doing this the FBI is screwing over:
1- All of the companies around the world, especially in the US, that will spend a ton of money dealing with the downtime caused by the first virus to exploit the Magic Lantern backdoors.
2- All of the American antivirus software companies who will lose market share to foreign software companies who do not leave FBI backdoors in their products.
3- Microsoft, who will likely be accused of leaving FBI backdoors in Windows, and who will lose market share when a virus sweeps the Windows world on a level that shames Code Red I and II.
4- All the Windows admins out there who will now have to rebuild all of their compromised machines, and switch to antivirus software by companies that do not leave backdoors for the FBI.
Forget McAfee. The best antivirus software for Windows is Kaspersky Antivirus, and they are based in Russia.
Comment removed based on user account deletion
Makes you wonder what the real reason was behind Microsoft's settlement....could part of the terms have been to disclose "unknown" security holes to the FBI for use with their Magic Lantern spyware? Conspiracy theory is fun :) Big brother is watching....
I'm a little more positive. I hope something can be done. But it is VERY scary.
Bush's education improvements were
Dobbertin created collisions in the compression function.
The security of an iterative hash algorithm can be no greater than the security of its compression function.
This means that if you can create collisions in the compression function, then you can create collisions in the hash.
Dobbertin did not extend his attack to the full MD5 algorithm, and nobody knows quite why--maybe RSADSI asked him not to, or maybe Dobbertin wanted to give people a few years to migrate from MD5 to SHA-1 before he applied his attack to the full MD5 algorithm.
RSADSI is correct to say that Dobbertin did not break the full MD5 algorithm. But don't think that doesn't mean Dobbertin didn't break MD5 in half. By analogy, imagine a locked door. Someone comes along, picks the lock, and demonstrates that yes, the doorknob turns freely and the bolt turns. The lock manufacturer (RSADSI) says, "well, yes, Dobbertin did expose some weaknesses in the lock, but he didn't open the door."
RSADSI, by the way, nowadays recommends the use of SHA-1 as a hash algorithm instead of MD5. Given that MD5 is the brainchild of one of RSADSI's founders, I think that says worlds.
I for one hope that other anti-virus and/or firewall manufacturers opt to not ignore this poorly planned intrusive boorish spying mechanism, or choose to let it pass without warning the user, which leaves a HUGE hole in personal and corporate security nets. The Federal Government is obviously using "terrorism" as the new catch all for more spending, it is tantamount to the "communism" and the witch hunts in Salem, Mass. It is clear that our own government is insouciant to the basic rights of man, life, liberty, and the pursuit of happiness. The Washington overreacting machine is in overdrive now, in full kneejerk mode to enact stupid laws, that are not always easy to repeal.
Insert Sig Here.
I hate sigs.
I quit not long after that, as did a lot of other people. Whee.
Well, I'm seeing a completely different issue here, beyond other people being able to craft virii exploiting the same holes that this Magic Lantern does. (Although I'm assuming that as security holes get patched, Magic Lantern will ultimately refer to a family of virii rather than any single virus; it's going to make McAfee's job of trying to explicitly exclude it from virus searches all the more ridiculous)
The thing that occurs to me is that, back when I was an easily amused kid I used to capture computer viruses, dissect them and study them. If Magic Lantern is genuinely going to be an effective way to retreive data -- and if it's a virus designed by a team of top-level professionals, which it is likely to be, then it should be so -- then how long a matter of time is it going to be before everyone and his mad bastard cousin starts to make copies of this virus and mutate it for their own ends? This seems like it would quickly become a valuable corporate espionage tool, and then a personal espionage tool, and then just a total disaster area.
The problem with this is, if they design a powerful cracking tool which by its nature must be primarily built out of code resident on the target's machine, it's only a brief matter of time before such software and any upgrades thereof enter the mainstream of black-hat equipment.
Frankly, I'm not looking forward to script kiddies with tools like this...
Remember Cringley's columnabout Microsoft wanting to replace TCP/IP with their own protocols? Imagine a requirement that American's only use software that the FBI can get at- and if that software ran on proprietary Microsoft protocols, the government could force American ISPs to block the older protocols that only criminals need anyway. Given that George Bush will likely be elected if he can drag on his "war on terrorism" until 2004 (Americans always re-elect wartime preisdents.), that leaves us with seven more years of a federal government supports Microsoft, supports John Ashscroft's assault on the freedoms provided by our constitution, and is not afraid of the political ramifications of extreme actions.
I think we all have a reason to be paranoid...
"So you have all this incredibly nasty software sitting happily on some (criminal enough to get the FBI's attention) hacker's computer, conveniently within his reach."
Exactly.
They'll spend $30,000,000 of your money (if you are a U.S. citizen) on software to exploit security flaws. Then they'll broadcast that software free to criminals. This will teach some of the criminals how to exploit security flaws. Then there will be more crime. Then the FBI will get more money to fight crime. They will see this as a big success.
The CIA used this same method in Afghanistan. They trained Arabs in terrorism. Read about that in: What should be the Response to Violence?
How many criminals smart enough to use computers will be smart enough to run Tripwire, or some program like it, such as the one that comes with Mandrake? At least some, is my guess. Those criminals will know immediately that their computers have been compromised. The criminals will then use the compromised computers to write email saying how much they believe in law enforcement, and to send Paypal payments to charities.
Bush's education improvements were
Well, since most readers are most likely open-source enthusiasts, I would like to say that an obvious solution is not to use McAFee and only install software that you have faith in or that you compile from the source. This is a damn shame that this retarded crap is happening.
I would also like to point out some problems I foresee. What will stop the FBI from hacking into my pc here in Canada if I install McAfee? Is this not outside of the FBI jurisdiction? Will software developpers only create software that complies to US demands the and sell it the world-over.
You better believe that in the near future more and more people will have a pc bundle and only use one (clean) pc to use the net (disconnected when not in use and removed from the network when in use) and use the others on a network to remove all data from that pc and store info. Essentially, if the trail of wires leads to and pc hd and its powered, it'll be your fault for letting the FBI access the info.
I guess we finally realise that we have no rights. Its just wishful thinking on our parts and propaganda used by the governments.
-I wish I could be sure that my thoughts werent being monitored.
-My own tragic Hero - GoV
I'm tired of this almost religious reverence for our government that seems to have taken hold lately. Yes, well intentioned and in some cases genuinely brave and courageous; some agents with the FBI undoubtably deserve our gratitude and respect. However, collectively, the FBI has worked diligently to strip away and corrupt the freedoms and principals that make America a great country. For that my friend, they collectively deserve and receive my utmost contempt and scorn.
Instead of believing in to the hype that Slashdot has come to like, let's look at the situation(s) more closely. My main questions spawn from ponderance of the WHOLE situation. These questions I plan to adress.
1:Why did MCafee allow this trojan?
2:What is the FBI's purpose in creating this tool?
3:Why did the FBI tell?
4:Who is this tool targeted at(main classes of criminals)?
5:How will other anti-virus companies look at the FBI's choice?
Well, lets consider the targets first. I see the most common groups targeted at are drug dealers and computer _criminals_. It's safe to say that the Computer criminals probably will not be caught in a trap like this. The FBI's main tool is believed to be a windows executible however, don't make rash belifs that the FBI hasn't considered a *nix tool yet.
The main mode of transport is that of a binary segment sent over email. Since Outlook is the most popular form of email client, Outlook buffer hacks that 'autorun' binary code are the best transport. Next off, who said that the FBI would be sending data back through the Internet or do any dialing? If I wrote a tool like that, I'd store data (keystrokes, logins/passwds, 'certain sites') in a secure place of the computer. I'd aim for the segment after the bootsector code. There's plenty of space for a few KB of the 'best info'. The FBI would raid the machine anyways, so sending back data is useless (trace of tcp/udp streams would be evident).
However, I question why the FBI even told here. Thier purpose is to catch intrastate criminals and investigate bad political dealings. I'm questioning if the FBI even has this technology. I'm much more scared of a hardware dongle that has 5 megs of storage capibility. Those types of entering have been cleared by the courts, providing the correct documents have been presented. Malware is going to be caught, unless the FBI destroys the data before the criminal sends it away elsewhere.
The last fields of questions deal with the AV companies themselves. Why exactly did MCafee do such a thing? Perhaps they have no choice. There is such a law called Obstruction of Justice. If the AV companies do not allow some sort of loophole, they could be tried in a court of law. Most of you Slashdotters would say "So What", but this type of court battle would lead to either horrendous losses to the company, and eventually having to put the anti-FBI code in, or the destruction of the company. However all is not lost. There is more AV companies outside the US. They WILL defend thier rights to no FBI code in thier computers. I mainly count the Russian AV coders to somehow get the code and track/kill it.
Flat out, the FBI will fail only because of public outcry. They will catch a few criminals and will parade around saying how the US is a better place without the 'scum of the Earth' around. However the worst thing people could do is to assume that the FBI is stupid. They have already addressed most of the questions, better than that has slashdot crowd.
Would they let us know that?
Josh Crawley
How can anyone trust anything NAI produces anymore?
I doubt very many people with a clue did even before this. But at that time their rather powerfull marketing machine was able to keep the $$$ rolling in from joe blows buying computers with the software pre-installed and computer "hobbyists" who think they know what they are doing and recommend software like McAffee and NAV and so on because the names are well known.
"No nation could preserve its freedom in the midst of continual warfare."
--James Madison
By openining McAfee up to the "FBI Virus", they are obviously opening it up to any "similar, but malicious" viruses. The only way to guarantee that it will work, it will have to be able to compare the virus byte-for-byte with the FBI virus. For it to do that, it must quite literally have a copy of this virus buried internally in the virus definition file. Since you have a copy of the virus coming packaged with McAfee, why doesn't McAfee just INSTALL THE VIRUS when requested to do so by the FBI. That would solve the probelm of allowing other "cracker" versions of the virus on to the system, since they will be installed locally by McAfee itself... Of course, this makes no sense for an anti-virus company to be intentionally installing viruses, but whatever.
"Your superior intellect is no match for our puny weapons!"
I know somebody there and think I'll ask them if they are planning on making security holes for every local law-enforcement agency. Could be a money maker but somehow I doubt it.. if it was China they would probably have to allow the government to install keyboard loggers on your pc through this Patriotic Remote Exploit facility. Unfortunately Japanese nuclear power plants are running Windows 95 as far as I could see from a recent newspaper photo.. (+3, Cynical, Despair)
I was working with the CS Department at my school on this research project for DARPA. Basically it is a self-learning IDS program based on data-mining techniques. How it works is that it sets up a number of different sensors within the computer. When something fits the footprint of a potential intrusion, it marks it as such. Then it creates a model (or virus definition) for the intrusion.
By using this technique, you limit the amount of work that the developers have to do.
_______________________________
"I'm not Conceited...I'm just a realist..."
Do our constitutional rights even exist anymore?
.45 in my pocket, the constitution says I can, the government tells me I'm breaking the law......
:)
Owning a weapon is a priviledge, let alone owning a weapon and carrying it on your person. "The right to bear arms." You need specific reason now to carry a concealed weapon, why is that? I'm an american citizen, if I want to carry a
Sorry using an example of the breakdown of our constitutional rights.
This really disturbs me. Between Carnivore and now Magic Lantern, we have pretty much given up all rights to privacy on the internet. I know that most of you will say that its been likely that the government has been monitoring traffic for some time anyways secretly, now we are publically accepting this as "ok in the name of our safety." Don't think they monitor your cell phone calls? Explain how they got voice recordings of the conversations of the doomed flight to Sommerset, PA.
This is disgusting. We are just handing over our freedom and very few people are saying a word. Funny how not all that long ago, the Supreme court ruled that aquiring search warrants based upon thermal readings from a house was illegal and yet they haven't said a word about anything the FBI has been doing.
Its really fscking sad that the alleged "war on terrorism" is really just a lame excuse to quickly remove a good deal of our rights. People in New York City are being searched randomly in Manhattan. What the hell is that? In 10 years can I expected to be searched if I walk down my street? If I have something illegal, is the search unreasonable, or does the court care more about me just having something illegal? If our phones and computers are tapped (lets assume for the moment that they are for the most part) where does the government stop? They can see what I am writing and talking about....why shouldn't they be allowed to see what I am doing in my home without a search warrant? The best part of it is, nobody would even know if they were being watched. I know this has been something people have complained about over the years (as the government has slowly crept into their privacy), but now its really in our faces. 1984 is not very far away indeed.
Let's take Magic Lantern for instance. If one were to disassemble it, it would violate the DMCA ruling. If one were to circumvent it (which likely anyone in their right mind will), the techniques used would likely violate DMCA. (Remember Skylarov?.....)
Can anyone think of software they might use that might possibly violate the DMCA ruling? I can think of a few, and I am not talking about cracking software. Also this makes me wonder about Windows....does DMCA make WINE illegal?
Indeed, the whole issue is a lot like a runaway train coming down the hill. People see it from the distance and don't realize how dire their situation is and eventually the train comes pummeling down into their sleepy little town and destroys it. I wonder how long before we lose all faith in the government entirely. Too bad we decided that we are too weak and lazy to take the government back into our own hands. What's so sad is that the more disillusioned we become with our government the more likely we will feel that it is out of our control. Judging by the recent elections and the completely disgusting turnout, it seems we are just about there. What do we do in 10 years when we don't even have enough voters voting to elect an official?
Its really time to either:
A) Do something about the slippery path we have slid on
or
B) Walk away from it, buy a huge ranch/estate/tract of land, start a community of like minded individuals, and ignore what the government does. I suggest some western states that do not tax their land so you can totally live government free.
Just some random infuriating thoughts I've had lately.....
Zos/Xavius.23
zos[@]winwood.net
Art is the realization of truth - AOS
zosxavius photography
Of course McAffee et al wanted a signature for the thing, and this was the best way to formulate the question. Besides, now they can produce a spevif Lantern-detector, and sell under the counter for a high price - and sell the names of the buyers to FBI. Ah the beauty of the free market...
In Murphy We Turst
Outside the US of A, many countries have strict laws against assisting foreign powers in their spying, and rightly so. I suppose knowingly installing backdoors might fall under such clauses. I would not dare to install or recommend installing McAffees scanners on sensitive networks without seeking legal advice!
In Murphy We Turst
If the news reports are to be believed, the FBI is merely taking advantage of a loophole people have known about for years - keylogging.
Most keyloggers don't get reported by most "virus" programs. I think Norton AV does, but then again its "Corporate Edition" might not - keylogging is something a lot of corporations do, believe it or not, and that might be against their target market.
People really concerned with privacy should be using software with anti-keylogging features, which on Windoze machines includes products like Scramdisk (freeware! and with crypto module plug-in support, though not fully tested by the community), its successor DriveCrypt (commercial and untested by the community so far, but made by people who maintained Scramdisk), and I think possibly BestCrypt(commercial but tested somewhat). These all have the ability to mask input against keylogging, to varying degrees. Read the documentation and enable it.
And again, remember. For them to use the keylogger, they have to install it on your system, and have some way to retrieve the info.
Practice good data hygiene, like you should be doing anyway, and you should be fine. If you want to test whether the programs mask effectively, install some program like Back Orifice and have it log while you create and mount containers. If the log shows your password, obviously it's not working.
You didn't read the article.
You can start reducing violence by being less mentally violent.
Bush's education improvements were
Excellent! Here FBI...How about you french-kiss my ass!!!
You're using her as bait, Master!
The road to hell is filled with good intentions.
All to often has something been done with good intentions to only become used wrongly.
Whatever we make, we can break, and that includes FBI/CIA/NSA/etc.. spyware.
So the reality is not one of catching the bad but rather removing the incentive of being bad.
As an example, take a close look at:
What the World Wants
Imagine that! We have enough resources from world military spending to solve major world problems not once, not twice, but three times over.
Hmmm, guess that means I just busted them all. And I didn't even need spyware (MAD - spy vs. spy) to do it.
Well, quite a few posters above did say those who work for such organizations as the FBI/CIA/NSA/etc.. aren't very smart. Now everybody has proof.
.
This same question came up with Back Office vs. Back Orifice. Because Microsoft was a "respectable" company (and because it costs money), antivirus companies decided that Back Office was a legit remote network administration tool. However, when the "hacker group" cult of the dead cow released Back Orifice, the antivirus vendors decided that, even though Back Office could do everything that Back Orifice did, because it was free and not released by a corporation it should be classified as a trojan.
So, besides magic lantern, you could have the SMS part of Back Office installed, too. And with its weak encryption, it's a greater security risk than BO2K.
More BO2k docs and info
HIV Crosses Species Barrier... into Muppets
It is truely frightening when what is so obvious to someone who need only be moderately technologically savvy, is so non-obvious to the powers that be. Especially when those powers have massive force at their disposal.
We are seeing widespread curtailment of fundemental civil liberties in the name of "fighting terrorism", when there is no evidence that such measures would even be effective for the stated objective.
We've seen the U.S. government insist that foreign countries turn over suspected terrorists for "millitary trials". What of Spain, which is refusing unless the accused are assured of civil trials, with due U.S. Constitutional protection? Should the U.S. bomb Spain until they comply? Why? Why not?.
Engaging in activities that, under fair use doctrines would be legal, such as ripping and deCSSing a movie for display on one of several computer monitors on a home LAN, streamed from a media server, is now (a) questionable, (b) "hacking", and (c) therefore terrorism. I plan to do just this, with DVDs I may buy in the future.
Not reporting suspected terrorist activity, with full knowledge (even that wasn't required in an early version of the relevant bill) makes one a terrorist. You, gentle reader, having read the previous paragraph, are a terrorist unless you turn me in. Oh, and for good measure, since I am not an American citizen, I can be held indefinately without even being charged.
Now, I've made some pessimistic and extreme interpretations of sections of recent legislation, and perhaps a good lawyer in a civilian court could make minced meat of such extrapolations. If it were one small loophole that could lead to extremism burried in a single piece of legislation, such fears could be discounted as paranoia. But, geez! We seam to have a lot of such power grabs in legislation of late. Whether by malice or stupidity, that can't be a good thing.
Clearly, the U.S. was caught unawares on Sept. 11, 2001, and like a frightned and wounded animal, the government is reacting like one would expect such an animal to react: with purpose, determination, but little in the way of reason, replaced instead by blind rage. So we have a steamroller of constitutionally questionable legislation that essentially lets the government kill who it wants, when it wants, and how it wants. But we're to trust that it won't intentionally harm innocents, except accidentally (collateral damage is, of course, part of war).
I don't know what's more frightening: a significant terrorist attack, or a government, armed to the teeth, with no peer, unable to rationally cope in the wake of such an attack.
I am a Canadian. Unlike most Canadians, I don't "shut up" and I speak my mind. Increasingly disgusted with the trampling of people's rights by my government (really, we have a Constitution that says, "there are your rights unless the government decides otherwise"), and my ever- increasing tax burden that funded such oppression, I did what any decent person would do: I got involved.
Letter writing, politics (I served as official agent for two candidates for member of parlament, and as an elected member of the Federal Libertarian Party's Ethics Committee (an internal court)), bending the ear of anyone who'd listen, you name it: the kind of peaceful protest that used to be protected speech in the U.S.A. I mean, put up or shut up, right?
I finally decided the best way I could fight was to stop fueling the tax-based oppression by denying the government my tax-dollars: I legally became a Canadian non-resident, for tax purposes, when I accepted a job in the U.S. permitted under NAFTA. It might be a small thing, but I was much happier paying taxes to the American government than the Canadian one. Besides, almost all Americans I met approved of my general distrust of government, and my outspoken attitude, even if not all agreed with my libertarion viewpoints. I paid my taxes, spent my money in support of local business, supported a bunch of charities, and generally paid my own way and minded my own business. I was made to feel like a welcome guest. Here was a place with a strong constitution, and people who believed in it. A strong sense of liberty and freedom!
I look around now, and I wonder where is that general distruct of government, that "Can Do!" attitude when it comes to fighting freedom-robbers and fear-mongerers. Yes, to paraphrase, they surprised and shot your eldest son, and russled your cows, but does that mean you should accept your shady's neighbor's help tracking them down while his brother rapes your daughter?
Could it be that Americans, for the most part, fear their government (/. readers excepted), perhaps as much or more than terrorists, and so have fallen silent? I will say this: the sons and daughters of the Founding Fathers who's principles I admire so had better find a way to reign this governing beast they created so it serves their reasoned interests instead of rabid desires.
You could've hired me.
This is why they use signatures which may be easier to thwart.
Think about it.
As the article says, the U.S. government has killed an average of 100,000 people a year for more than 30 years.
I'm against violence. However, 6,000 in one year is a lot less than 100,000 per year for 30 years.
Bush's education improvements were
> english speaking programmers borrowed a word
"Virus" was already an english word (with plural "viruses") when programmers started using it as a metaphor based on the medical/biological usage.
rant
> > So why does virus break the us -> ii rule
> Because it's ius -> ii, and "virus" does not end with "i". Virii would be the plural of "virius".
Exactly. "virii" is an attempt to look smart or educated, and it doesn't work. It's like arguing that the plural of "octopus" ought to be "octopi" because that's the way Latin works, when "octopus" has a Greek root not a Latin one.
(And yes, if enough people abuse or misspell a word, it will get into the dictionaries with the new meaning or spelling. But people saying "because it follows the Latin rules" will still be wrong).
rant
+1, Informative? I think not. Try -1, Wrong. "Virii" is in fact the proper Latin plural of the (medical Latin) word "Virus". "Viruses" is an INCORRECT English pluralization of a Latin word.
Why is it that the proponents of "one nation under God" are so eager to get rid of "liberty and justice for all"?
I understand everyone's concerns about crackers exploiting the spyware to gain entry into their systems. I think this could be easily solved by the FBI providing free, convenient upgrades to the spyware product in the event that vulnerabilities are discovered.
It would also be nice if we were notified by email whenever a patch was available.
"When I grow up, I wanna be an Attorney-General!"
"We were killing people that were trying to kill us, and our way of life."
You picked a bad example. During the time the U.S. was killing 2,000,000 people in Vietnam, the average income in Vietnam was under $200 per year. The Vietnamese were not able to threaten anyone 8,000 miles away, even if they had heard of us.
The Vietnam war was about whether the north could force their manner of politics on the south. The U.S. government spent billions of dollars, killed millions of people, and they north did that anyway.
Bush's education improvements were