Slashdot Mirror

← Back to Stories (view on slashdot.org)

What We Know About the FBI's CIPAV Spyware

Posted by Zonk on from the i-always-feel-like-somebody's-watching-me dept.

StonyandCher writes "What is CIPAV? CIPAV stands for 'Computer and Internet Protocol Address Verifier'; a lengthy term for powerful spyware the Federal Bureau of Investigation can bring to bear on web-based crime. It was used last month in a case where someone was emailing bomb threats regularly to a Washington high school. An affidavit by an FBI agent revealed some of the workings of CIPAV. 'According to the court filing, this is [some of] what the CIPAV collects from the infected computer: IP address, Media Access Control address for the network card, List of open TCP and UDP ports, List of running programs ... Last visited URL. Once that initial inventory is conducted, the CIPAV slips into the background and silently monitors all outbound communication, logging every IP address to which the computer connects, and time and date stamping each.' In a Computerworld article, the author attempts to dissect CIPAV's purpose and raises a number of questions such as: What happens to the data the CIPAV collects? Does the CIPAV capture keystrokes? Can the CIPAV spread on its own to other computers, either purposefully or by accident? Does it erase itself after its job is done?"

52 of 207 comments (clear)

  1. does it... by russ1337 · · Score: 5, Interesting

    What happens to the data the CIPAV collects? Does the CIPAV capture keystrokes? Can the CIPAV spread on its own to other computers, either purposefully or by accident? Does it erase itself after its job is done?"

    Does it run on Linux?

    sorry, couldn't help myself.... but seriously..... does it?
    1. Re:does it... by HaeMaker · · Score: 4, Funny

      Let's find out...

      "Mr. Gman from Quantico, VA has sent you an eGreetingCard from Flowers By Irene! Just open this P.D.F. file to view..."

    2. Re:does it... by TWX · · Score: 2, Interesting

      Does it run on Linux?
      Even if it does, if you find one of those last-generation Motorola 68000 machines and compile your entire OS from scratch I doubt that they'll have a binary-compatible version to install on it...

      Of course, be prepared to have one SETI@Home packet take about four weeks to process, and to have a bogomips rating of something like 16.9...
      --
      Do not look into laser with remaining eye.
    3. Re:does it... by OrangeTide · · Score: 3, Informative

      insert a new system call in the middle of your syscall list, and recompile everything for it. it will break all static binaries and shell code :)

      My Sparc Classic would takes minutes to establish an SSH2 connection. those big keys take a while, SSH1 was nice and fast. (50MHz no cache, no FPU)

      --
      “Common sense is not so common.” — Voltaire
    4. Re:does it... by dgatwood · · Score: 4, Insightful

      Mod parent down. SELinux is support for more fine-grained rights management in Linux. It's a mandatory access control policy system, basically. Unless parent has proof that there is a back door in there somewhere, I'm pretty sure parent is full of it.

      Just because the software is partially paid for by the government, it does not necessarily follow that it's a back door. Take off the tinfoil hat.

      --

      Check out my sci-fi/humor trilogy at PatriotsBooks.

    5. Re:does it... by GrumpySimon · · Score: 3, Funny

      That is, until version 2.0.


      oh no - it's going to have Ajax and a drop shadow!
      --
      henry -- the human evolution news relay
    6. Re:does it... by jwo7777777 · · Score: 2, Funny

      You say that out of shear ignorance. Better than tensile or compressive ignorance.

  2. What about zombies? by Reziac · · Score: 4, Insightful

    What happens when zombied computers are used to email such threats? who gets the blame in that case? How do you distinguish the innocent zombied-user from the trojan or virus? Would being infected constitute defense? If so, how do you prove intent??

    So many questions raised by this... I'm sure others can think of many more.

    --
    ~REZ~ #43301. Who'd fake being me anyway?
    1. Re:What about zombies? by toleraen · · Score: 5, Interesting

      I think the obvious question would be "How does it get installed?"

    2. Re:What about zombies? by Reziac · · Score: 2

      How do you prove that you're the innocent victim of a zombie installer, vs. having surreptitiously zombied your own machine? the installer works the same way regardless, and ISTM it's not too difficult to determine and target your own IP address. (Or for that matter, for the gov't to do so.)

      Point being, I'm wondering just how solid this evidence really would be in the eyes of the courts, with or without tech-savvy judges and lawyers.

      --
      ~REZ~ #43301. Who'd fake being me anyway?
    3. Re:What about zombies? by Anonymous Coward · · Score: 2, Informative


      1) re: duration of evidence kept:

      This is either a troll or a rhetorical question.

      Why would they need to erase it? how could you prove they didn't delete it?

      I remember sitting in a Computer Law class in the early 80s. One of the things which arose (aside from writing briefs which the chair from the department and a group of landsharks would pick pieces apart & continue until it looked reasonable) One of the things discussed at that time was you could force the FBI to ensure your information is correct. Did they send you a copy of their information and let you correct it? No. You'd send the information which you believe might be outdated or incomplete and they'd update their information with whatever you sent to them.

      2) As far as dealing with the charges + any other issues, remember: there are things which the gov't will prosecute you for, which are top secret and your lawyer isn't given access to the information.

    4. Re:What about zombies? by toleraen · · Score: 3, Interesting

      I was referring more to the question of how the FBI installs the software on your machine. For some reason picturing a guy in a black suit wearing dark sunglasses sending "OMG Pony Screensaver Inside!!1" emails doesn't cut it. If they're going for computer evidence, it seems likely that their targets would be a bit more computer literate: more up to date on patches, firewalls, etc.

      Otherwise, who knows. Maybe their software has to wipe out other possible malware to be effective (wouldn't want that data they're collecting, or even the software they installed going overseas, right?). You'd hope that they would have to show that it was someone typing out the emails locally vs. remotely. But then, who's to say it wasn't the person's little brother writing the email? It doesn't seem like they'd have a lot to stand on...there should be a lot of supporting evidence going with what they collect with that software.

      But in the end, don't they pretty much just have to say "We're the FBI. That's what happened." anyway?

  3. How to identify? by redshirt1111 · · Score: 2, Interesting

    I did read the article, but did not see anything about identification. Other than ensuring there is no spyware running on your machine, anyone have an idea how to detect this particular program?

    1. Re:How to identify? by Opportunist · · Score: 2, Interesting

      Well, there are some ways. Some of them used by trojans, some used by AV kits, some by both.

      You can go ahead and force every program you run to load a DLL of yours, which hooks the relevant calls and alerts you should an application that's not supposed to tries to access things it has no business in. At least that's how I did it.

      It does slow the system down considerably, though, so you might want to use it on a separate machine (real or VM) that you use to do your internet stuff.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  4. address is 192.168.0.100 by maxwells_deamon · · Score: 3, Funny

    Just look for the guy with that address!

    It most do a trace route/phone home or somthing to actually get a useful address

    1. Re:address is 192.168.0.100 by ArcherB · · Score: 4, Funny

      Just look for the guy with that address!

      It most do a trace route/phone home or somthing to actually get a useful address

      As opposed to the guy at 127.0.0.1! I hacked into his machine once, but that bastard had some sort of active defense daemon running that wiped my drive at the same time I was trying to wipe his!

      Fortunately, I was able to see the porno pics of his wife before I was hit. Man! That bitch was FUGLY!

      --
      There is no "I disagree" mod for a reason. Flamebait, Troll, and Overrated are not substitutes.
  5. The real threat of "government spyware" by Opportunist · · Score: 5, Interesting

    The core problem is, surprisingly, its correlation with antivirus tools.

    Either the feds don't give AV vendors a heads-up when they plan to use a trojan, i.e. they risk being found. Now, this would double as the "hey stoopid, the feds are onto you" warning.

    So it's likely they do require AV vendors to avoid finding them. This, in turn, would mean, though, that all a potential virus writer has to do is to get his program to match the fed trojan in behaviour and shape, possibly in signature.

    I needn't write more, I guess? Why bother coming up with a rootkit if there are governmental-assisted ways to create undetectable malware?

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    1. Re:The real threat of "government spyware" by robogun · · Score: 2, Funny

      The AV could just take the middle ground with a generic description like "Suspicious Program: E-card Viewer", it is unlikely it will display as "W.32CIPAV j00 R SO FEDERALLY PWNED"

    2. Re:The real threat of "government spyware" by orclevegam · · Score: 2, Funny

      it is unlikely it will display as "W.32CIPAV j00 R SO FEDERALLY PWNED"

      No, but that would be awsome. Maybe some of the open source antivirus kits out there (I know there's at least one) should use that as the name if they ever manage to get a signature of CIPAV.

      --
      Curiosity was framed, Ignorance killed the cat.
    3. Re:The real threat of "government spyware" by mr_mischief · · Score: 3, Insightful

      By the time you've detected it, it's probably already reported everything. IP, MAC, IP address and HTTP request of last packet to ports 80 (or possibly 443 if it gets its information before the SSL encryption), etc. is not difficult nor time consuming to figure out.

    4. Re:The real threat of "government spyware" by plague3106 · · Score: 2, Informative

      Um, you've been able to sign executable in windows since at least Windows 2000. Its call Authenticode, and XP does read it. Vista takes it a step further by warning you if you run an unsigned application.

    5. Re:The real threat of "government spyware" by querist · · Score: 4, Informative

      Discretion is the better part of valor.

      One of the differences between the virus that your bog-standard AV will detect and this critter from the FBI is the number of instances out there in the wild. Keep in mind that this FBI thing is intentionally sent to specific targets, and I suspect that it is used sparingly in order to prevent it from being found easily.

      Nearly all AV programs rely on signatures. The way they obtain the signatures is first to obtain samples, and then determine how they can identify the program accurately (Hashes, etc). I've discovered new malware and forwarded it to the proper channels, as have others that I know.

      Therefore, the following (simplified) steps must occur:

      1. become infected with the malware
      2. suspect that the machine is infected
      3. correctly isolate the malware (find its parts, etc)

      Then, once those happen one must also do the following in order to hope that protection will be offered to others:

      4. send the sample to one or more anti-malware application support teams for inclusion
      5. wait until the AV/AM team can create a signature
      6. wait until the AV/AM team distribute the signature
      7. wait until people update their AV/AM signature databases.

      As you can see, there are several places where this process can fail. Think of it like phishing, but sort of in reverse. Phishers send out a large number of messages in hope that even if only a very small percentage of recipients (1/100th of one percent, for example) fall for it, they will be able to profit.

      That works just fine if you send out a few hundred thousand messages.

      If you send out only one message, or ten, or twenty, your odds are very close to zero that even one person will "bite".

      This is the critical difference. I doubt that this program is out there on thousands of machines, or hundreds of thousands of machines all over the place. It is "placed" (I know - some victim effort is required) on specific machines.

      Therefore you have a very small victim base. The odds of this being discovered are quite small, even without collusion from the AV vendors.

      This is more like "spearphishing" (who dreams up these phrases?), being specially targeted for one individual. This increases the odds of that one individual falling for the ruse, and since only one person was the target, this works well.

      Things like this make the lives of us who work in security full time much more complicated.

      -Q

    6. Re:The real threat of "government spyware" by Opportunist · · Score: 2, Insightful

      AV programs are amongst the most reversed programs in existance. Malware writers spend hours, days and weeks dissecting AV tools and finding weaknesses in them.

      I think it's fairly secure to assume that one of them would have used a security hole like this in the meantime, e.g. by rewriting the hosts-file, then sending to the (rerouted) cipav.fbi.gov and the AV tool would let it be.

      And this, in turn, would have been detected immediately by an AV company (who is competing with the AV company that lets this leak exist), as soon as they got a sample of that malware.

      Question for 100 bucks: Think we'd have read a blog about it by now?

      Malware writers usually don't care, neither for the FBI nor for the goodwill of AV companies. Actually, they are quite happy when they can piss off both.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    7. Re:The real threat of "government spyware" by GeekZilla · · Score: 2, Informative

      "that's why many european states does not trust windows to run their battleships or other critical military systems. I was assigned to disassembling the windows core logic when I did my mil svc."

      Afraid that Great Britain is more than happy to employ Microsoft software in their warships.

      See this: http://www.theregister.co.uk/2007/02/26/windows_bo xes_at_sea/

      and this:

      http://en.wikipedia.org/wiki/Type_45_destroyer

      --
      Veritas patesco per quaestio questio. Truth is revealed through questions.
  6. Nice acronym but... by Statecraftsman · · Score: 4, Funny

    can't we just continue calling this Vista?

  7. Do they still get spam? by 192939495969798999 · · Score: 2, Interesting

    If they have this amazing tool for tracking people down, do they still get spam at HQ? If so, why not use this to catch the spammers and make them stop? Is it because they're all beyond jurisdiction now?

    --
    stuff |
    1. Re:Do they still get spam? by It+doesn't+come+easy · · Score: 3, Funny

      In the grand scheme of things, spam doesn't rate very high when compared to a bomb threat. Resource limitations dictate that the FBI concentrate on music downloading, bomb threats, and spam, in that order ;)...

      --
      The NSA: The only part of the US government that actually listens.
  8. So, if you're a criminal.... by iknownuttin · · Score: 2, Insightful
    MySpace accounts can't receive traditional e-mail, so one hacker standard -- attach the CIPAV to a message and hope the recipient is stupid enough to launch it -- wasn't available. Instead, the most likely tactic would have been to send a URL to the suspect account using MySpace's own instant messaging and/or Web mail system. If the suspect clicked on the link -- it would have had to be enticing, so use your imagination here -- and visited the FBI-owned malicious site, an exploit for a zero-day vulnerability (or unpatched one on the suspect's PC) would have let the government download CIPAV to the target hard drive.

    Don't click on any links sent to you and don't visit any sites sponsored by the FBI.

    I guess if the FBI is targeting you and they know that you like kiddie porn, they would set up a kiddie porn site to get a trojan on your machine.

    --
    I prefer Flambe as apposed flamebait.
    1. Re:So, if you're a criminal.... by vertinox · · Score: 2, Interesting

      Thats why I have always disagreed with the current policy, not because I support the vile people that create such images, but I fear that it would be too easy to frame some one who is innocent.

      There is this Japanese urban legend that when a corporation or Yakuza wants to off someone, they have the sucker win a trip to Indonesia. Then at the airport they slip some drugs in his bag and then give an anonymous tip to the Indonesian authorities.

      The thing is... The penalty for drug possession in Indonesia is death.

      You just got a government to carry out a mob hit for you.

      That said, if you didn't like someone in particular and had a vendetta, putting these images on their machine would be a good way to get rid of them for a long time... Or at least ruin their career and family life.

      I'm surprised the same Russian mob types behind spamming haven't created a scheme to put images on peoples computer and threaten to report them to the FBI if they didn't pay up.

      --
      "I am the king of the Romans, and am superior to rules of grammar!"
      -Sigismund, Holy Roman Emperor (1368-1437)
  9. But how do they install it?!?! by Daneboy · · Score: 5, Interesting
    How, exactly, do the Men In Black install this uber-spyware on a target system?

    Do they get a warrant, sneak into your home in the dead of night, and install software on your computer?

    Do they mail it to you as a virus, perhaps cleverly disguised as a Nigerian spam scam?

    Do they use the back door that Microsoft agreed to put in all their software in return for being granted Most-Favored Monopoly status by the government?

    Or something else? "You are a suspected pedophile. To clear your name, please click here to install the FBI's internet spyware on your computer"?

    Anyone know?

    --
    /* "Specialization is for insects." -Heinlein */
    1. Re:But how do they install it?!?! by Opportunist · · Score: 3, Interesting

      Maybe it's just a variant of the way MPack infects. Slipping code into inconspicuous pages, redirecting you to an iframe containing an exploit, suitable for your browser, and presto.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    2. Re:But how do they install it?!?! by Anonymous Coward · · Score: 2, Funny

      Do they get a warrant, sneak into your home in the dead of night, and install software on your computer?

      Yes.
    3. Re:But how do they install it?!?! by mogasm · · Score: 2, Informative

      They have gotten court orders in the past to break into the house for the purpose of installing the spyware

    4. Re:But how do they install it?!?! by BlueParrot · · Score: 2, Funny

      Do they get a warrant, sneak into your home in the dead of night, and install software on your computer?
      You still think they would need a warrant to do so? It is more like:
      try{
      getTarget().addUncostitutionalSpyware();
      }
      catch (SomebodyFoundOutException e){
      getTarget().accuse( new Excuse( Excuse.paedophile , Excuse.terrorist ));
      }
      finally{
      profit();
      }
  10. Better question by grasshoppa · · Score: 3, Interesting

    What happens to the first person to get a hold of this software and fully analyze it?

    5 bucks says they get a visit from big men in serious black suits and then are never seen again.

    --
    Mod me down with all of your hatred and your journey towards the dark side will be complete!
    1. Re:Better question by Mattintosh · · Score: 3, Insightful

      That depends on whether they're in the USA or not. If you're in the USA, enjoy your stay at the Gitmo Hilton. If you're not, well, you might not be bothered at all, but don't fly to the USA. Ever.

    2. Re:Better question by gstoddart · · Score: 2, Insightful

      That depends on whether they're in the USA or not. If you're in the USA, enjoy your stay at the Gitmo Hilton. If you're not, well, you might not be bothered at all, but don't fly to the USA.

      Yeah, because the US government has never grabbed someone who is on foreign soil and whisked them away in an airplane late at night when nobody was looking. (No, really.)

      If they want you bad enough, they will send someone to retrieve you. Domestic and international laws be damned. Now, they won't do it for sending spam, but if you seem like a potentially serious enough threat, they will.

      Cheers
      --
      Lost at C:>. Found at C.
  11. Is this really a reliable tool for the FBI? by Vokkyt · · Score: 4, Interesting

    There are many programs out there, such as LittleSnitch for Mac, which are rather adamant about making sure you know everything that is phoning home on your computer. Does the CIPAV have a method of circumventing these road blocks or would the FBI be stumped by the same software that is intended to keep computers safe from malicious software? While I could certainly understand them working with larger developers like Symantec and Microsoft to ensure that their anti-spyware and virus protection software dutifully ignores a product like CIPAV, what about machines running protection applications from smaller developers, or even open source protection, like the ClamAV project?

    Better yet, if programs like CIPAV become more common as a tool for Federal Investigations, does it become a requirement that said programs allow CIPAV and its successors to do their work?

    1. Re:Is this really a reliable tool for the FBI? by Vokkyt · · Score: 2, Interesting

      Also (sorry to double post, but this just came to mind), what happens if it is blockable. Does using the software to prevent CIPAV from calling home constitute a felony for disrupting a Federal investigation? Or, what happens in the case of a rebuild? Is that also considered to be messing with a Federal Investigation if the target is unaware that they are being monitored?

  12. What happens to the data collected? by WillAffleckUW · · Score: 3, Funny

    It's sold to commercial firms so they can advertise to you.

    Duh.

    --
    -- Tigger warning: This post may contain tiggers! --
  13. What if Crackers modify it for themselves? by denis-The-menace · · Score: 3, Interesting

    If AV companies do let the FBI version go through unchecked,
    what if the virus and worm writers of today get a hold of this and modify it for their own purposes?

    --
    Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
  14. A lot of effort for 90 days detention. by AltGrendel · · Score: 3, Insightful
    ...Monday, June 18. On July 15, after he pleaded guilty in juvenile court to charges of identity theft and making bomb threats, the teen was sentenced to 90 days' detention.

    They spent a log of money on that. Sounds to me like it was actually a "test run" to make sure things work as expected. And now that they know it will work...

    --
    The simple truth is that interstellar distances will not fit into the human imagination

    - Douglas Adams

  15. Hey, this is no fair. by Caspian · · Score: 3, Funny

    I demand a Mac OS X port! And a Linux port! The FBI is being unfair! ;)

    --
    With spending like this, exactly what are "conservatives" conserving?
  16. Let's check... by Jeff+Carr · · Score: 5, Funny

    $sudo apt-get remove cipav
    Reading package lists... Done
    Building dependency tree
    Reading state information... Done
    E: Couldn't find package cipav
    Whew, safe!

    --
    The television will not be revolutionized.
  17. Moral to this story? by JimDaGeek · · Score: 2, Insightful

    Don't use a MS Windows based OS if you want to do stupid stuff. Odds are that these type of government programs are only targeting the large user base of MS Windows. Use Linux, *BSD or Mac OS X and flip the government the birdie! ;-)

    --
    General, you are listening to a machine! Do the world a favor and don't act like one.
    1. Re:Moral to this story? by JimDaGeek · · Score: 2, Informative

      Linux is open source, how exactly would they have an "unpublished" exploit? There are a lot more people looking for bugs for Linux than the FBI have searching Linux for some exploit they could take advantage of. Oh, and the FBI would only be able to use a exploit they found first for a few times before it is patched and all through the Linux Community.

      As for MS Windows, if there is an unknown exploit, maybe MS would leave it there with a little nudge and wink from the FBI?

      As for OS X, the core is open source *BSD based, so would be the same there as for Linux. However, the proprietary stuff of OS X could have an unpublished exploit. Though I don't think Apple would be as willing to help out the FBI and keep things under wraps. The thing going for Apple are Apple fans. If Apple really screwed over their fans, their business would collapse.

      --
      General, you are listening to a machine! Do the world a favor and don't act like one.
  18. Yes... millions of taxpayer dollars have been... by DaedalusLogic · · Score: 2, Funny

    Spent on a sophisticated solution for detecting your IP address, and the FBI has integrated THIS into CIPAV.

  19. Some More Speculation on Installation Methods by Dreamland · · Score: 5, Interesting

    Some more speculation on installation methods of CIPAV can be found here:

    http://blog.misec.net/2007/07/31/3/

    Specifically, it looks like the FBI may have several ready-made exploits, each targeting a different OS/web browser combination. An interesting question, then, is what they would do if they encountered a system that is fully patched and running a more secure browser such as Firefox. Does the FBI have access to their own zero-day exploits that they can whip out to install this trojan? If so, is it possible they have their own team of hackers set out to find such exploits?

  20. Zombie or not, one specimen WILL be found. by arth1 · · Score: 4, Interesting
    Another worry is if someone finds it, how good precautions are there that it's immune to subversion, in multiple ways:
    • Sending false data to the feds. With my knowledge of the bureau, I doubt they would ever question the data they receive. (The healthy paranoid people who might ask questions either get fired, or end up in different government branches).
    • Using the app or information in it to launch an attack to the fed's own clandestine systems. This could include modifying the data sent to try to trigger a buffer over/underflow, or simply brute force DoS the target destination through a botnet.
    • If it contains backdoor functionality, replace it with a honeypot and gain access to passwords and client info of the feds trying to access it.
    • Modifying the app too send data not to the feds but to somewhere else. This would be the holy grail of trojans, as it's likely that most AV software have specific exceptions for ignoring software from the government.

    1. Re:Zombie or not, one specimen WILL be found. by ScrewMaster · · Score: 2, Funny

      I'm sure they've accounted for the possibilities you've raised (excellent points, by the way.) And, if you were to actually ask the FBI about those issues, I'm sure the conversation would go something like this:

      Brody: The CIPAV is a source of unspeakable power and it has to be researched!

      Eaton: And it will be, I assure you Dr. Brody, Dr. Jones. We have top men working on it right now.

      Jones: Who?

      Eaton: Top men.

      --
      The higher the technology, the sharper that two-edged sword.
    2. Re:Zombie or not, one specimen WILL be found. by Gazzonyx · · Score: 2, Insightful
      Thanks, I didn't want to sleep tonight, anyways.


      Let's up the ante and get this thing going - I'll throw in $10 to the first slashdotter who contains and publishes the 'bins' and/or reverse engineers this piece of code. $20 if you can isolate the signature of executables that it's binded to with a high degree of success (say, =>75% confidence). It's $10 well spent to sleep at night, IMO. I kinda' want to play with this thing and I'm willing to fund the hunt for it. Anyone else wanna' throw in?

      --

      If I mod you up, it doesn't necessarily mean I agree with what you've said, sorry.

  21. This is Slashdot, people! by TheVelvetFlamebait · · Score: 2, Funny

    Since when did we ever let little things like evidence or common sense get in the way of a nice bit of conspiracy theorising?

    --
    You know, there is a difference between trolling and pointing out the flaws in your reasoning. Just saying.