Slashdot Mirror
FBI Remotely Installs Spyware to Trace Bomb Threat
cnet-declan writes "There have been rumors for years about the FBI remotely installing spyware via e-mail or by exploiting an operating system vulnerability from afar — and now there's confirmation. Last month, the FBI obtained a federal court order to remotely install spyware called CIPAV (Computer and Internet Protocol Address Verifier) to find out who was behind a MySpace account linked to bomb threats sent to a high school near Olympia, Wash. News.com has posted a PDF of the FBI affidavit, which makes for interesting reading, and a summary of the CIPAV results that the FBI submitted to a magistrate judge. It seems as though CIPAV was installed via e-mail, as an article back in 2004 hinted was the case. In addition to reporting the computer's IP address, MAC address, and registry information, it also gave the FBI updates on which IP addresses the user(s) visited. But how did the FBI get the spyware activated and past anti-virus defenses? Two obvious ways are for the Feds to find and exploit their own operating system backdoors, or to compromise security vendors..."
From: spyware@fbi.gov
Subject: Click here for free movies!
Attachment: not_spyware.exe
Hello! You have been selected to receive free movies at no cost to you! All you have to do is install the attached program to start downloading all the latest Hollywood hits free of charge!
They think this guy really did it! I fooled 'em good!
How much is your data worth? Back it up now.
s/pay/blackmail
There, fixed that for you.
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
implies that EVERY Windows OS can be remotely exploited.
Who needs the FBI for this? Microsoft have been doing this all by themselves for years...
If your version of file can't tell the difference between an MS-DOS executable and a Windows PE binary then you might want to consider upgrading, as it's almost certainly a good 15 years out of date.
I am TheRaven on Soylent News
[2] Then they came for the end-of-sentence punctuation Nazis, and I did not care because I punctuate my sentences.
[3] Then they came for tense agreement Nazis, and I did not care because I know that 'do not need privacy' (even abbreviated as don't) is present tense while 'did not care' is past tense.
Then I realized that it matters not, because if someone can't read, they aren't going to care about net access records regardless of the privacy issues.
"Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
From the summary:
A MySpace account linked to bomb threats sent to a high school.
Chances of this system being secure, updated, well-managed? 0
Chances of this system being a Gateway laptop that takes 10 minutes to boot, loads 5 IM apps on startup, has 4 different IE toolbars, and constantly warns that the Norton Antivirus subscription lapsed 16 months ago? Our survey says yes!