Slashdot Mirror
FBI Confirms Magic Lantern Existence
The_THOMAS (and many others) writes: "A day after major
anti-virus firms waffle on their support for 'Magic Lantern', and nine days
after Thomas C Greene of The Register tried to throw cold
water on it's existence,
the FBI Confirms
the 'Magic Lantern' Project Exist. Welcome to a Brave New World!"
first post
grammatically correct post.
It's = short for "it is"
Its = the word you were looking for in your writeup
Lame filler for a lame filter!
To start, I talked with my colleague's brother, "Joe," who is a criminal defense attorney. Joe told me that he has been following the Magic Lantern debate very closely, because his sources indicate that the FBI will be using it in many, many cases to prevent the possibility of seizing equipment with undecryptable data on it. In fact, it has been rumored that the proposed new FBI policy regarding searches of premises requires agents to attempt to use Magic Lantern (which technically counts as a consensual search) prior to even obtaining a warrant, if the warrant is to seize computer hardware.
Joe is not very familiar with computer technology, but he did say that a large part of the Magic Lantern program involves contacting ISPs to allow the FBI to alter network data destined for the suspect's computer. I will take that at face value because they seem to have no problem pulling rank on ISPs. I suspect that their "do it or we'll arrest you" attitude plays a big part in this.
With all of that in mind, I decided to find out just how vulnerable I was. I set up a stock Debian 2.2r3 box, and a stock Red Hat 7.2 box. Both used the installation CDs produced at least a few months ago, so they were both vulnerable to the wu-ftpd exploit and would need to be upgraded for production use.
My goal was simple: I needed to play the part of the FBI, and trick my machines into accepting a trojaned version of the new wu-ftpd package.
First, I set up a transparent proxy on my gateway box, which is used to split my cable modem connection amongst my home machines and those of several neighbors. I used a program called "squirm" to rewrite URLs ending in .deb or .rpm so that they would be redirected to my local web server,
from which the trojanned .deb and .rpm files would be served.
Second, I produced trojaned .deb and .rpm files. The .deb file was
trivial to modify, as only a checksum stood between me and a valid hacked
version. The .rpm was a bit more difficult, because RedHat signs their
packages with a PGP key. However, once I rebuilt the package and did not
sign it with PGP, I had a fixed package.
Third, I went to the Debian box and typed 'apt-get update ; apt-get upgrade'. After a few routine prompts, none of which triggered security alerts, the box was rooted by my "custom" package.
Fourth, I went to the Redhat box and did an 'rpm -U' pointed at the updates.redhat.com server. I got my trojanned RPM back, with no warnings or prompts to tell me it hasn't been signed. And I had an ftp server with a new backdoor up in a matter of minutes.
So, to summarize: the FBI can easily set up a transparent proxy between you and the Internet, and trick your OS into installing malware. You're damned if you do and you're damned if you don't, because you need to download the wuftpd-of-the-week sometime.
As a matter of comparison, my Windows 2000 box has no such vulnerability. The first time I went to Windows Update, I checked the box that said "always trust content from Microsoft Corporation." Therefore, only Microsoft's real certificate will be accepted by my machine. Even if the FBI forces Verisign to issue an impostor certificate, it will be detected and thwarted.
Linux distributions need to band together and find a trusted individual who will be responsible for signing all packages and verifying that they do not contain backdoors. That is the only way to solve this issue. Personally, I nominate Eric Raymond, because of his widespread respect from the community and business leaders alike. Additionally, he is a staunch libertarian and would not cave to government pressure to insert backdoors into something that he has signed. I believe that by charging the distribution vendors a small fee per package, ESR can again achieve financial success for himself and his family.
This is a serious issue for Linux users and I believe it should have been addressed years ago. That said, now is not too late and definitely not too early. I look forward to seeing this feature in all future releases of the major Linux distributions.
df
I thought that the antivirus companies had AGREED to NOT make their programs detect "Magic Latern"???
There's 10 types of people in this world, those who understand binary and those who don't.
This is a very nice new troll. Well done, and I hope it serves you well in your quest for angry replies.
Let me start the ball rolling by saying
"You fucking ignoramous!!!!"
:-) Again, congrats...you obviously put plenty of work into this.
I'm not one for violating our freedoms however something like this may help in scaring would be virus creators, hackers and others problematic computer uses (ie. DDOS attackers). If it will help eliminate problems like that I'm all for it, even if my overall freedoms are curbed a little.
Nathaniel P. Wilkerson
www.haidacarver.com
People fear things like this, yet they really don't have reason to unless they've been doing something worth investigating which is most likely some illegal activity. The FBI doesn't care to read your email or get access to your pr0n, their goal is to deal with threats to security and other illegal activity. The average citizen or even seasoned geek doesn't have much to worry about.
So, here's the deal.
:)
Why do you need defense against "Magic Lantern" if you're not doing anything illegal? That's like telling a cop that you refuse to give him access to your home to search it without a warrent. All you're doing is causing a bigger hassle for yourself. I guarrentee, the more the internet/open source community rebels against this one, the worse it becomes.
You know what? This whole thing isn't anything new. Novices have been writing for their own ego to crash thousands of systems, and these are highly trained FBI officials with both a government and a population behind them. If you're caught doing illegal stuff, you're going to be found.
Of course, there have to be safeguards against this type of thing. If someone got ahold of the way to get data from a "Magic-Lanterned" system, this whole thing would be back-orifice 2. Anyone with any sort of information on which computers had the client software or crack done could get information as well.
Because of this, I propose the FBI must be doing something to limit this type of ability. The software must have some way to check who's grabbing the data out of it. If you're going to defend your other internet users against this type of thing, I say that's the key. Find out how to use their own software and twist it into nothing more than a downloadable program on your local website.
It seems inane. Guys, live with it. It's FBI in your home, but then again, its better than terrorists in your mall. My only concern is that this whole thing is going to end up in the wrong place once the scares are over, and then we're all in for a trip.
Stop pirating now.
Look, guys. It's simple.
Get a warrant. I'll show you anything you want to see, but show me your goddamn warrant first. Until you have it, you have no right whatsoever to search my, or anyone else's computer. I don't care what your reason is. This is not acceptable.
I just tore my own penis off in the paper shredder in the office. They told me it would feel good to stick it in there. Bastards.
you know what's funny? read that cartoon... see case #2? possesive? "the cat's feet are out of the bag" - correct. well just as the cat posesses it's feet, magic lantern posesses it's existence. so basically angry flower says: you're wrong! and to that bitch who said "you should always be able to replace the apostrophe with "it is"" - well, you're wrong too, fuckwad.
First - I don't think this is going to be used to catch one 'terrorist'. Not saying that it's going to be a complete failure... but that they are more using this to go after those 'Drink or Die' types. [makes sense, we are getting ready for DRM right?]
... \\\
Second - Get out your history books and find the word communist. Scratch out all references, and put the word terrorist over it. Read that. That is what is going to start.
Everyone applauded Bush after the attacks on Afghanistan and we love it when he makes those jokes, but I don't think he's the right person to be in that position. Boundries will be overstepped. John Ashcroft... what a joke, should be be John Stalin.
Also, I think I may have this 'virus' because everytime I try to download something from alt.binaries.pictures.centerfolds.playboy my USB cable modem goes off. Something doesn't seem right here.
\
\
\
Get your Unix fortune now!
Flaming Troll!