Slashdot Mirror
Swiss to Use Spyware to Listen to VoIP
An anonymous reader writes "Heise Security is reporting that the Swiss Department of the Environment, Transport, Energy and Communications is entertaining the idea of utilizing the 'Superintendant Trojan', a spyware program designed to allow eavesdropping on VoIP conversations. According to ERA IT Solutions, the creator of the software, it will only be distributed to investigation agencies in the hopes of keeping it out of the hands of malicious hackers since firewalls apparently 'do not present a problem' for the software."
Create it and they will get it.
If the trojan can be installed it can be sniffed out and discovered. I give it at tops a week of deployment before someone figures out what it is how it works and backwards engineers it into instant maymem for all the black hats.
I can't believe I just read that. They think they can use it and it won't get in the wild? This sounds as smart as the judge in the Spamhaus case, as in, totally clueless about "that there interweb spying softywear".
Tequila: It's not just for breakfast anymore!
If that isn't a destruction of your privacy, I don't know what is. Although it'll probably be flagged by scanning software soon.
Do they really think so?
I mean, that completely ignores human nature. Come on.
All these things have one thing in common: they are not supposed to be accessible to the general public (or at least initially were not supposed to be) and yet they are. Legality does not stop criminals.
After all, it doesn't pose a problem for firewalls. And then where will we be?
I write all my secrets onto yellow stickies... Then make the person that reads it shred and eat...
--- Relax, that mass muderer is just trying to reduce our carbon footprint, one fetus at a time...
Bad Idea.
If there's a backdoor, crackers will find it and they will exploit it.
Stop the idiotic Police/Spyware.
Two things stand out right away. Point one:
the 'Superintendant Trojan', a spyware program designed to allow eavesdropping on VoIP conversations
Ok, so it's spyware. It sneaks onto a system and installs itself. Gotcha. That moves us to point two:
it will only be distributed to investigation agencies in the hopes of keeping it out of the hands of malicious hackers
Ok. Got it. So to sum up, what they're saying is that they don't want anyone to get it, but they need to install it on a target's system in order for it to work. And a target would be someone the law was interested in who was computer literate. Like, say....hackers, for instance.
I love things that are broken by design.
Weaselmancer
rediculous.
I wonder how they plan to install these things onto the target computers?
How is eavesdropping not a malicious use? From the article: "The wiretap has some additional functions. For example, the built in microphone on a laptop can be turned on to monitor a room or webcams can be activated." It very literally is spyware.
Yes, they are trying to keep it away from "hackers", but should it have even been written in the first place?
I wonder why they don't just do it all on the ISP's end if they are going to be responcable for infecting users anyway.
It's only a matter of time before people figure out what's going on and start using it in every kind of malware. AV/firewalls will need to detect it. If not I imagine this is just a windows thing. The idea of anyone being able to remotely enable mics and webcams is enough to make me switch to a new OS if I thought this was something that could not be detected and blocked/filtered.
Installwatch + a firewall with a solid logging facility might not present *problems* for this software, but should provide enough info to entertain folks for a while...
Take the 90-Day Challenge! http://rwmurker.bodybyvi.com/
Firewalls dont present a problem...........i read this as.....the software connects back to home by connecting to TCP port 80. This is the kind of stupid software developer mentality........everyone allows outbound web browsing right ? (no ... wrong in my case and the company I work for).
You need to ask for a user's consent before installing this type of software. How could you install it without asking the user or providing a EULA and not break the law? Would a warrant allow someone to install spy software on your computer? I guess so since this might be the same as bugging your house or wiretapping.
The problem isn't whether undesirable people will obtain the software - surely if they want it they will get it or write it themselves (whether it is used by law enforcement authorities or not). The question is what process will the Swiss law enforcement authorities have to follow before they use the software. For instance will a warrant be required, what will be a sufficient degree of suspicion to justify the use of the software?
Well, the thing about Trojans, is that the victim installs them.
This article is complete and utter bullshit.
"VoIP" is not a single computing platform or implementation.
And the better question is why not? Provided that there is sufficient judicial oversight, why shouldn't VOIP coversations of suspected criminals be monitored?
Well, I haven't argued anywhere that they shouldn't be monitored. It's not the judicial oversight that worries me. It's the technical oversight.
Let me clarify my objections a bit. In order for this hack to work, some authorized person has to sneak something onto your system. And as soon as it's on your system....it's on your system. You have it. If you find it and can figure out what it is, nothing is stopping you from using it on other people. In short, it's only a matter of time until the hackers DO get it. And then they'll be listening in on VOIP.
To summarize the summary, this is wildly irresponsible. I can't believe people smart enough to write this software are dumb enough to think they can contain it. Absolute morons, I'd call them.
Weaselmancer
rediculous.
From the best intention, come stupid ideas.
Me with my TA behind my router I think I have less to worry about.
There are dozens of commercial keyloggers and remote admin type apps out there. "Firewalls do not present a problem" to any of these, nor most of the other tools. I'm assuming here that they mean incoming firewalls, not restrictive bidirectional firewalls which block unknown outbound connections. The fact that this makes use of webcams and microphones is nothing new, Back Orifice did this a decade or so ago. None of the antispyware or antivirus vendors mark the commercial tools as malicious, because they assume (wrongly) that whoever put the tool there had a right to do so. I guess the only thing that is new here is that the company is distributing only to law enforcement. That might not even be new, since I'm sure the espionage community has some exclusively licensed tools at its disposal. If you want to get paranoid about something, be worried that your credit card info is in the hands of somebody in former Soviet countries or that some ransomware has taken over your PC. Trust me, the Swiss are not your biggest problem out there.
Thankfully I have nothing to hide. But if I did: .EXE? .DLL's.
:). This virus, at that time, was not known my Norton, McAfee, or Clam-AV. Thankfully my Windows workstation _is_ a work-hourse and I do have heuristic type scanning turned on for everything it ever touches.
:). Sure -- you could capture the OTHER END of the call probably much easier.
:)
Thankfully my main GUI is a Mac. I wonder how LittleSnitch would handle a
Thankfully my networks are Linux and BSD based. They don't like
Thankfully my VoIP is handled by a Sipure non-PC based box. It doesn't allow / nor has needed updates.
Thankfully the one place I do use Windows for now (work) will be replaced with a Mac in short time.
I do have to wonder if and how heuristic type scans and/or zonealarm tweaked all the way up would react to this type of software. Recently there was a "new" virus that showed up (one week ago today) on the email (Linux) server which my workstation immediately flagged as suspicious before even reading the body of the message (which was supposedly from the email admin [myself]
As for the firewall, well, trust me, you have no idea HOW I configure it and what I do (or don't) allow out under normal circumstances. VoIP? Only from authorized IP's and MAC address' -- and only to specific OpenVMS servers (which REALLY hate to run Windows software and are even harder to infect
Thankfully, I have nothing to hide.
Yup, that should fly really well past all the privacy laws, antivirus and antispyware programs.
As delicious^Wschtoopidttt as Swiss is...
Excuse me, but please get off my Pennisetum Clandestinum, eh!
First off, most places allow some sort of outbound port 80, even if it is heavily restricted. The last place I worked at allowed outbound connections to the Debian update servers, and only through a proxy, but the principle is the same. And if you allow web browsing of any normal sort, it can be very difficult to differentiate between legit web browsing and something like this.
Now, it could be more complex, but to suggest that firewalls don't present a problem is to display an absurd amount of arrogance. The only way I can imagine this working is if they forced the ISPs to cooperate, and did some sort of stenography across multiple protocols (not just HTTP), in the hopes that at least some kind of outbound traffic is allowed. After all, VOIP has to be itself allowed. But at this point, you wonder why they would bother to infect the user -- maybe this simply passes crypto keys on to the ISP, thus defeating zFone?
Still, the sheer audacity of saying that "firewalls aren't a problem". Here's some simple firewall rules that are guaranteed to block it:
Saying "Firewalls aren't a problem" is like a travel agency saying "Customs isn't a problem." You can't say that unilaterally, for all customs -- different countries have different laws and procedures surrounding what you can bring into the country, or what you can take out, and in any case, a naval blockade pretty much ends the conversation.
Don't thank God, thank a doctor!
HAHAHAHAHA!!!!!
ROTFLMAO
Thank you, that is all. Great plan, thumbs up to the Swiss!
This is no different from a software key logger that turns on the microphone as well. Nothing new here. Move along.
The only possible means by which a trojan can get around anti-virus tools, operating systems and firewalls is if the tools themselves have been modified to allow this trojan to work.
I suspect that the software vendors / designers of these tools will be contacted, asked to participate and sign a ND agreement.
All people running software by these vendors will then be susceptible to attacks from this trojan - a trojan which will undoubtedly be in the hands of black hat hackers by then.
Additionally, if this sort of thing becomes common practice, it will result in anti-virus software becoming practically useless, as the virus writers will take advantage of these 'back doors' to create new malware that can mimick the behaviour of the trojans.
I wish someone would restart PGP Fone.
It is by the juice of the coffee bean that thoughts acquire speed, the teeth acquire stains. The stains become a warning
if this was in the us you guys would be bitching up a storm about how we're now under the control of hte nazis and that the terrorists have won and soon you'll end up missing if you speak badly of the Bush reich.... where's the fucking outrage? I can see it's little more than partisan bullshit and lies.
Me with my TA behind my router I think I have less to worry about.
Me with my terminal adapter which happens to be integrated with my router,
I think I have plenty to worry about. Who says its firmware is not rigged?
Who says they can't upload a patch to it or otherwise tamper with it??
On the other hand, why do these shitheads need to tamper with someones
machine if they can just pick off the conversation directly from the wires
at the provider (unless they're using encryption)??!
Which would you prefer, mandatory backdoors at every point in the network where you never know if you're being watched, or a solution where, upon repeated e-mails with attached executables masquerading as the same nudie pics, you can kind of guess that you're probably being watched?
Your mind is clear / The things that you fear / Will fade with how much you / Believe what you hear
That one never gets old.
He can atleast argue that installing a spyware in his system made it insecure in some way which led to the theft or something to this tune. I don't know the technicalities of the software in question but I am sure the judges won't exactly be experts in this domain either.
Politicians and Pedophiles: Two groups of exploitive bastards who are most dangerous when they're thinking of children.
Reading TFA I thought it could probably somehow defeat most PC firewalls like the one they ship with Windows XP ... now all it does is using outbound port tcp/80 to tattle back home. They don't even bother to "support" the
_inbound_, somehow threading its way through the lethal digital packet perimeter by hitting the firewall
hard over its head with irregular bit settings and funny buffer overflow code-injecting variable length
tcp option fields no man has thought of before...
handful of standalone windows firewalls that are out there and stealthily modify the firewall configuration.
I am not impressed.
For one thing, entire audio conversations are a bit hard to slip into "small inconspicuous packets". Additionally any program that starts broadcasting on the internet upon system startup is going to be flagged rather quickly.
Welcome to the USA!!!
I was just wondering.. I understand bittorrent engages a high-bandwidth conversation with a dynamic swarm of IPs. Has anyone worked on a tunnel over bittorrent? Would seem like the next escalation..
Got on Vans they look like sneakers!!!
1.intrusion of privacy
2.administration of law outside legal jurisdiction
3.stealing computing time
4.stealing bandwidth from us who need it.
5.intellectual property compromise
wrong.fuckers.misguided.immoral.
lets reverse engineer this and use it on them! see how they fucking like it.
another bunch of politicians that decide our everyday freedoms.
There's a category of "investigative" software marketed to suspicious spouses and the like that includes keystroke logging features. The antivirus/antispyware industry is split on how to handle them. In general, the less commercial an AS/AV product is, the more likely it is to detect a commercial spy package.
I suspect that plenty of spy agencies and police are using this approach, the Swiss are simply one of the few to acknowledge it.
Also, it doesn't really have to be "malware", in that it tries to install itself after the fact, these people can simply do on-the-wire replacement of software updates with software updates that have been modified specifically for their purposes (getting around signing is work, but feasible). Unfortunately, Linux is as susceptible to that as Windows and MacOS.
far be it for me to mention this, but....
what is to prevent someone from leaking the software
(or the source code therein) for whatever reason?
given what human nature is, it only stands to reason
that those who do not have will seek any means necessary
to acquire that which they do not have.
I see this program in the hands of those who have no business
having it within hours of its launch.
Understanding is much like a 3-edged-sword. in this: there are always 2 sides and the truth.
My friend,
next time before you shout out loud, have a look on a map and study the difference between
.
Sweden and Swiss
Anybody who's stupid enough to use VoIP without encryption probably has nothing useful worth listening to anyway...
Move along, nothing to see here.
Gentoo Linux - another day, another USE flag.
Eventually it just be another Sony rootkit debacule.
BTW, how many viruses/trojan have been released based on Sony's toy?
Definitely a more elegant solution, and I'd love to have it! But in the near-term, any crypto would be better than none.
Check out ZRTP if you want a real head-scratcher.
by sjs132 (631745) on Monday October 09, @09:47PM (#16373281)
I write all my secrets onto yellow stickies... Then make the person that reads it shred and eat...
by cybercobra (856248) on Monday October 09, @09:47PM (#16373285)
Bad Idea.
If there's a backdoor, crackers will find it and they will exploit it.
If this gets installed on a box with another trojan, I'd give it three days tops before it gets discovered and put into the wild by Black Hats.
Windows has detected an undetectable error.
Which is why checking signatures is important. ..or at least hashes. I suppose ISPs could just substitue in their public key for every one you download and slip in their own hashes, but it would be more difficult. Especially if you traded keys some other way--such as face to face swaps, but usually only the paraniod do that...
Fun facts about Switzerland: 1. Our army needs seven years and 40 billion Swiss Francs (about 30 billion US Dollars) to be ready for war. 2. It's illegal to flush the toilet after 10 pm. (Nobody seems to know, however) 3. My government believes they can bug the VOIP of the country the most Macs per capita.
When will people start to understand this? It's one of the most basic and fundamental statements when first learning about "the computer." Software is a set of instructions for the computer to execute. It has more in common with a book than with a wrench.
Every time I read about how anyone, government or otherwise, wants to deploy some sort of software 'tool' to accomplish something, either to ensure security/privacy or to deny it, I invariable consider any means to defeat the measure or to use it for unintended purposes. I can't help it really, the mind is attracted to flaws... well, at least my mind is.
I hope, for the sake of our technological futures, that every child will be taught to understand that software is called software for a reason.
I hate to be pedantic, but the country's name is Switzerland not Swiss.
Steve, is that you?
to point out how utterly foolhearty "security through obscurity" is?
it will only be distributed to investigation agencies in the hopes of keeping it out of the hands of malicious hackers since firewalls apparently 'do not present a problem' for the software."
Last I checked, a hacker's main activity is finding things that you are trying to hide from them?
I work for the Department of Redundancy Department.
This is really a quantum leap in malware design. They apparently have a piece of software that can remotely infect an unknown operating system. It works on Windos, Linux, MacOSX, HP/UX, Symbian, Oracle Raw Iron and your TSR-80. It works on all VoIP-capable phones and equipment. It can penetrate all firewalls, regardless of make or ruleset. Your computer can be infect while it's turned off! The trojan will also adapt to new systems automatically and evolve to counter any security patches that might fix the holes it is exploiting. And it makes coffee.
A few decades ago, people like this were called con-man or snake-oil peddlers.
Assorted stuff I do sometimes: Lemuria.org
From TFA:
...
"supply it solely to investigation agencies. This should also prevent antivirus manufacturers from incorporating it into their databases and having their tools recognise it. According to the manufacturer, firewalls do not present a problem.
Installation of the software wiretap is to be carried out on the instructions of a judge only. The ISPs of the persons under investigation will then slip the program onto their computers."
It says that the software will be supplied solely to investigation agencies to foil antivirus manufacturers. In the next paragraph, it says that the program will be provided to ISPs. The paragraphs are mutually exclusive, they can't keep it exclusive to investigation agencies and also provide it to ISPs. If ISPs are provided with the software it can be assumed that the software is in the wild, even if the ISPs don't have a clue about how they are going to 'slip' it onto a customer's computers.
1. An investigator at an agency types up a court order that specifies a requirement that the ISP "slip" the provided software on a customer's computer.
2. Judge signs the court order just like he always does, without having a clue about the technical jargon.
3. ISP receives the court order and a CDROM containing the program.
4.
5. PROFIT!
You have it backwards: They skate on Satan and Worship Butter. Plus, this is about the Swiss, not Swedish.
You mean "Confoederatio Helvetica" (hence .ch), or in English the "Swiss Confederation" :-)
shit, piss, fuck, cunt, cocksucker, motherfucker, tits*
Now we know how Mr. Goatse got that way.
How much of the taxpayer's money have they wasted in this piece of crap?
You counted 'it' twice.
If corporations are people, aren't stockholders guilty of slavery?
"Court Order"? You mean that thing that Bush was required by law to get for his Spy On America policy, said he would need to get, didn't bother to get, and got away with not getting? Hm.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
It's not specifically Bush's fault... The NSA was spying on US citizens and the rest of the world since a very long time... That was also the case with Clinton and many others...