Slashdot Mirror
Court Slams Door On Sale of Spyware
coondoggie writes "The Federal Trade Commission yesterday had a US District Court issue a temporary restraining order halting the sale of RemoteSpy keylogger spyware. According to the FTC's complaint, RemoteSpy spyware was sold to clients who would then secretly monitor unsuspecting consumers' computers. The defendants provided RemoteSpy clients with detailed instructions explaining how to disguise the spyware as an innocuous file, such as a photo, attached to an email."
Back Orifice anyone?
Bane of ICQ 98b users everywhere!
On the Oregon Cost born and raised, On the beach is where I spent most of my days
Because they didn't disclose what they were doing.
FMI please RTFA
"Maybe this world is another planet's hell"
Aldous Huxley
As much as the FTC deserves an "A" for effort, however, the timeline of the case is an excellent example of how poorly equipped the government is when it comes to addressing this type of problem. The brief states that RemoteSpy has been available since "at least August 2005.
It hardly seems worth the effort if this time frame is typical. You'd hope any spyware scanner worth using would have picked it up 20x faster.
But it's stuff like this we're really after: http://en.wikipedia.org/wiki/MPack_(software). People who code professional-grade malware generally do so to profit off of it. It's well known that in the existing ecosystem of digital crime the malicious hackers themselves rarely act as attackers in large-scale id/credit card theft; instead they sell it to people who do. Quoting this extremely enlightening interview: http://www.securityfocus.com/news/11476
"The project is not so profitable compared to other activities on the Internet. It's just a business. While it makes income, we will work on it, and while we are interested in it, it will live. Of course, some of our customers make huge profits. So in some ways, MPack could be looked at as a brand-name establishment project."
This particular piece of spyware is amateur stuff, aimed at paranoid spouses/bosses, but if we can hit the business of selling spyware (probably requiring the cooperation of the international banking system, as well as the governments of china and russia) it would totally cripple large-scale internet crime as we know it. It's a pipe dream, of course. But one can always dream.
Ultimately, hopefully, the issue which will get the defendants in trouble will not be that they sold the keylogger software OR that they provided tutorials on how to trojan it into unwitting victims computers, but rather that THEY stored illegally obtained software on THIER server. Otherwise, this sets a dangerous precident where someone decides that software which potentially has valid uses, is declared illegal. (It's convoluted but you can imagine a case where someone might have a legitimate use for using keylogger software) It's like the whole "right to bear arms thing", just becuase someone shoots his neighbor doesn't mean guns should be illegal. (they should be, IMO, but this isn't the reason)
If the television show Cheaters is ok, then surely this should be ok.
I think their problem is that they should have sold it under the guise of a computer security assessment tool or something, and not outright say it's for spying on people. It's like those countless micro-camera that are sold to "monitor babies", when in reality everybody knows they're bought by peeping toms who plant them in ladies bathrooms
I honestly don't think you could pass of something this simple as a pen-test tool. You could probably pass it off as a pure remote administration utility. But this would require you to add lots of extraneous functionality that would seriously confuse the intended market, and you couldn't market it to them directly either (I guess this could work anyway if you could incite some really strange grassroots campaign.) On the upside, if the virus engines wouldn't recognize it, you wouldn't have to include signature-evading code (polymorphism, packing...).
Well I am seeing a paradox here because the NSA designs and creates tools like this and makes manuals to explain how to use it. Now they can say they are using it for a legal purpose, however if the mere fact of having something that could be used in a sneaky way is illegal then they would be guilty of possessing a criminal artifact. If creating the stuff is illegal, whoever contracts with a government agency to produce this stuff is criminal by this strict an interpretation. It seems to imply that a citizen can commit a crime and a bureaucrat cannot.
"...if we can hit the business of selling spyware (probably requiring the cooperation of the international banking system, as well as the governments of china and russia) it would totally cripple large-scale internet crime as we know it. It's a pipe dream, of course. But one can always dream."
:), but the road to software hell is paved with legal definitions of the term "spyware".
I don't want to rob you of your dreams (or take away your pipe
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
You mean like the catch-all German "hacker program" law, that has had the entire security industry up in arms? The one where you could in theory get arrested for possessing a copy of NMap?
www.schneier.com/blog/archives/2007/08/new_german_hack.html
They could simply classify it as a war weapon and limit it to govt agencies...
Justice is the sheep getting arrested while an impartial judge declares the vote void.
Almost all software has legal use to some extent.
I am a small company owner. I have 5 employees and provide them with computers. I have told them that their computer use is monitored and bought this software to ensure I could perform that task. It does.
My computers are for my company to make money, not their personal use. No personal email. No day-trading. No on-line banking and definitely no gaming. Do that stuff on your own computer and own time. I've had to discipline employees for personal use before and expect to do it again. My rules matter.
I am a software developer for some companies, and we have included as part of the test installation keylogger software, as well as mouse clicking software, because with out this log of information we found that humans have no clue as to the path that was used to create a problem in the software. So this a very very legitimate use of the keylogger software, and mouse clicking software when the tester, is running our program. Other times I have used keylogger, and mouse clicking software on a customer's computer just to diagnose an issue the customer was having, and found that some one on the cleaning crew was using the computers as a gaming network, the company was unaware of this activity until I installed this invisible software on their computers with their permission. When everything settled down, then I was paid to remove the keylogger, and mousing logging software.
Time for OSS to step up to the plate and make a GPL equivalent!
It's the use to which it's put.
Consider by analogy a crowbar. It could be used to force open someone's window or someone's head, both illegal; but it could also be used to pry off the hubcap of one's own car, an operation legal in most jurisdictions.
Let's see, legal ethical use of spyware... Hmm, that's a tough one for a civil libertarian. Logging your underage kid's IRC sessions in case you later need to find out where she's run off to meet her 40 year old "friend"?
charged with posessing a criminal artifact? The police get to have cool toys because they are police, and if they have to break in they will. Think slimjims, boltcutters etc. There is no conflict here.
Oh come on, it's just spyware, not encryption.
Random Thoughts From A Diseased Mind (Not For Dummies)
I consider myself a moderate libertarian. This is why it's only "moderate". I honestly do think this kind of software should be illegal; in fact I thought it WAS. In my opinion, no one has a legitimate reason to spy on someone else's computing habits, parents included. If you break down privacy you break down society, there's things you just don't want to know about other people, and said other people just as much do not want you to know about them.
And please, don't compare this to gun rights. Guns as self defense are a deterrent, but spy software doesn't work that way. You can't deter spying against you with spy software. People are still going to have spy software and use it, but it should be as difficult to use as possible, and victims should have legal defense against it if they discover the culprit.
By the way, I understand the fine line between VPN type software and spy software when it comes to functionality, so I understand the hurdles when it comes to illegalizing spy software. I'm just stating my opinion.
Charisma is the measure of someone's ability to lie with a straight face.
How easy is it to detect and/or delete keylogger software? Does anyone know if the popular anti-virus software out there will detect it?
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
It seems to imply that a citizen can commit a crime and a bureaucrat cannot.
Sort of like when police officers fly down the road at 40mph+ higher than the speed limit, change lanes without signalling, run stop signs, cut people off, tailgate people on the highway, and generally drive like the biggest bunch of suicidal assholes the road has ever seen but will pull over the rest of us for stepping even slightly out of line without a second thought?
Sorry, I just spend a lot of time on highways, so it just really bugs me.
-- "Government is the great fiction through which everybody endeavors to live at the expense of everybody else."
Does this mean that companies which develop keylogging software for law enforcement use are breaking the law? No? Didn't think so.
It shouldn't be illegal to write this kind of software, but it should be illegal to install it without either the owner's consent or a proper warrant.
"In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."