Slashdot Mirror

← Back to Stories (view on slashdot.org)

The Secret History of the FBI's Classified Spyware

Posted by timothy on from the but-we-just-want-to-peek dept.

An anonymous reader writes "A sophisticated FBI-produced spyware program has played a crucial behind-the-scenes role in federal investigations into extortion plots, terrorist threats and hacker attacks in cases stretching back at least seven years, according to newly declassified documents obtained by Wired.com. The so-called 'computer and internet protocol address verifier,' or CIPAV, is delivered through links to websites controlled by the FBI, and it silently reports back to a government server in Virginia. Among other cases, the FBI used it to track a Swedish hacker responsible for cracking thousands of computers at national labs and NASA's JPL in 2005."

9 of 133 comments (clear)

  1. The Ends Don't Justify The Means by QuantumG · · Score: 4, Insightful

    How is this not breaking the law?

    Breaking the law to enforce the law.. way to piss on justice.

    --
    How we know is more important than what we know.
    1. Re:The Ends Don't Justify The Means by bconway · · Score: 4, Informative

      RTFA.

      But the documents released Thursday under the Freedom of Information Act show the FBI has quietly obtained court authorization to deploy the CIPAV in a wide variety of cases, ranging from major hacker investigations, to someone posing as an FBI agent online.

      --
      Interested in open source engine management for your Subaru?
    2. Re:The Ends Don't Justify The Means by Shakrai · · Score: 4, Insightful

      So if they obtained court authorization to deploy Sarin gas that'd be ok too right?

      Wow, hyperbole much? How is installing software on someones computer with court authorization to monitor their behavior any different from using the warrant to obtain a wiretap or using it to search their home and possessions?

      --
      I want peace on earth and goodwill toward man.
      We are the United States Government! We don't do that sort of thing.
    3. Re:The Ends Don't Justify The Means by rackserverdeals · · Score: 4, Funny

      Wow. You totally sidestepped the Sarin gas question.

      You must think it's ok to eat babies too.

      --
      Dual Opteron < $600
    4. Re:The Ends Don't Justify The Means by Shakrai · · Score: 5, Funny

      Only if you season them right :)

      --
      I want peace on earth and goodwill toward man.
      We are the United States Government! We don't do that sort of thing.
  2. Linux version? by MrKaos · · Score: 4, Funny

    I wonder if they have a Linux version?

    --
    My ism, it's full of beliefs.
    1. Re:Linux version? by srollyson · · Score: 4, Insightful
      This paragraph from TFA is telling:

      In a separate February 2007 Cincinnati -based investigation of hackers who'd successfully targeted an unnamed bank, the documents indicate the FBI's efforts may have been detected. An FBI agent became alarmed when the hacker he was chasing didn't get infected with the spyware after visiting the CIPAV-loaded website. Instead, the hacker "proceeded to visit the site 29 more times," according to a summary of the incident. "In these instances, the CIPAV did not deliver its payload because of system incompatibility."

      Seems like the FBI exploits browser vulnerabilities a la the Pwn2Own contest in order to deliver CIPAV, but CIPAV itself might not run in linux. I suspect that the FBI will have written a linux-compatible CIPAV after the quoted incident. Probably a bash or perl script so they don't have to worry about different architectures.

      On a side note, there was probably some good porn on that page for the hacker to load it 30 times.

  3. Re:RIAA software by WCMI92 · · Score: 5, Insightful

    "FTA :

    "After sending the information to the FBI, the CIPAV settles into a silent "pen register" mode, in which it lurks on the target computer and monitors its internet use, logging the IP address of every server to which the machine connects. "

    Let's hope the RIAA doesn't get it's hands on this."

    What I'd like to see is an open source antivirus/antispyware suite that WILL detect this. I own my computer, not the government, therefore I have a right to know what is running on it and to decide what is and isn't going to run on it.

    I don't think it is any of the government's business what websites I go to, what blogs I post on, and for that matter, what porn I download.

    Given some of the scary things coming out of the "O"ministration lately (such as the recent homeland security advisory painting people who support the right to own firearms and who object to the outrageous spending going on as "rightwing extremists" and "potential terrorists" I think I and others have a legitimate fear that we may be targeted for such spyware for political reasons.

    That's why I opposed and still oppose the patriot act... Not because I am against going after the actual JIHADI terrorists who have and are attacking our country, but because government abuse of it and turning it on law abiding citizens was inevitable.

    Note that Obama isn't doing anything to repeal the patriot act (which he used to object to). He wants that power just as much as Bush did.

    --
    Corporatism != Free Market
  4. The Comments Don't Match the Article. by Eevee · · Score: 5, Informative

    The Constitution is QUITE clear that a search of private property requires a warrant.

    From the fine article, emphasis added by me: "But the documents released Thursday under the Freedom of Information Act show the FBI has quietly obtained court authorization to deploy the CIPAV in a wide variety of cases, ranging from major hacker investigations, to someone posing as an FBI agent online."

    And from further down in the article: "The FBI obtained a warrant to use the CIPAV on February 10, 2005, and was apparently successful."