Slashdot Mirror
Hackers Counter Microsoft COFEE With Some DECAF
An anonymous reader writes "Two developers have created 'Detect and Eliminate Computer Assisted Forensics' (DECAF). The tool tries to stop Microsoft's Computer Online Forensic Evidence Extractor (COFEE), which helps law enforcement officials grab data from password-protected or encrypted sources. After COFEE was leaked to the Web, Microsoft issued takedown notices to sites hosting the software." The article notes that DECAF is not open source, so you aren't really going to know for sure what it will do to your computer.
Less innocent people will be going to jail. Less family will be broke up.
The time has come to rise against the machine.
New Economic Perspectives
Haha, that'd be the perfect trojan horse. Have people with (illicit) things to hide run a program that claims to prevent them from being caught, all the while this program is just reporting them. And even if they post code, they could just post any old source code and claim it was used to generate the executable.
Maybe DECAF is a double agent blocking COFEE and collecting it's own things in the inventor's in interest. It's a trap!
just wonder why there are so many anonymous cowards in this world....
Oh Microsoft.... is there *anything* that can't be handled by a lawsuit?
http://www.decafme.org/
There are 10 kinds of people in the world > > Those who understand binary and those who don't
I have incriminating information on my computer so I'm supposed to download and run some closed-source software from people who now know I have this information, and it will make my problems go away. Right.....
AFAIK, if your computer is locked COFEE relies on autorun to work, so disable autorun and lock your computer will pretty much thwart COFEE, since it would somehow require bypassing MS's supplied GINA dll, which given it's Microsoft, might know how to do, but would find it highly unlikely.
Your hair look like poop, Bob! - Wanker.
>The article notes that DECAF is not open source, so you aren't really going to know for sure what it will do to your computer.
And most people running MS-Windows know for sure what THAT will do to their computers?
Does seem odd, though, that DECAF would not be open so people (in the know) would trust it and could learn from it. Oh well.
...to distribute rootkits and create botnets. Even better than those "Free Antivirus Software" downloads.
Seriously, is anybody going to trust something like this without the source? Somebody intelligent enough not to open unsolicited email attachments, at any rate.
(And yes, I realize there might be "legitimate" reasons for keeping the source out of law enforcement's hands, but frankly [at risk of trolling] I would rather be spied on by the government than identity thieves.)
No? GOOD
I think I'll just stick to Pepsi
I realize a large number of people won't trust it because its not opensource. I can see the authors view point though of not wanting Microsoft to turn around and make a patch against it. If you don't want it don't run it, but if it is a trojan a firewall can easily defeat that. If it is a virus word will spread and people will avoid it. It is like the Antivirus 2009 programs, other then being blatantly obvious viruses, don't work anymore because people know they are bad.
Could be that Microsoft is also really concerned about Cofee accessing protected encrypted files that would allow hackers to pirate legitimate copies of Windows if the device identity encoding within WGA is cracked! I am afraid someone might have just let the horse out of the barn through a Windows backdoor. The heads are about to roll in Redmond again!
I'm a little confused, what exactly is the point of DECAF? Wouldn't encrypting your hard drive be more effective?
Trying to install linux on my microwave, but keep getting a kernel panic...
It could be that they are intending to sell it as a product in a future release.
The point of COFEE is to grab things that would be lost when the computer is shut down (passwords stored in ram, temporary files, etc) before they pull the plug and take it back to headquarters.
(Pull the plug, not just tell it to shut down, because it may have a shutdown process in place to wipe evidence.
And yes, you could use linux live CDs to remove passwords, but that involves changing what is on the disk, thereby ruining it as evidence. There are strict procedures in place to prevent the evidence from being corrupted. (ie: drive is duplicated, and then only the copy of the original drive is worked on...)
Soon I'll Release my Beta version of FRENCH VANILA
(Forensic Reducing Emulator Named Coherantly and Handsomely for Very Awesome Naughty and Illicit Activities)
Linux! ammite?
...so you aren't really going to know for sure what it will do to your computer.
You're saying you don't know how to run a debugger in a VM session? or registry and file monitoring utilities? I get that analyzing machine code may be a bit of a lost art, but if you have the binary file you have everything you need to figure out what it does -- eventually. Someone will reverse-engineer it. In fact, I rather expect the authors knew this when they released it.
#fuckbeta #iamslashdot #dicemustdie
There is so much more COFEE should have done. It looks like it takes a look at your current running state. It grabs netwrok connections you have open, running processes, and user account names that are logged in. Things that get lost when you power a computer off. The autorun is just to make it simple for the user. I don't expect this is the only tool ran. I expect it is quick snapshot before you pull the plug.
Microsoft did take care to get the correct versions of the tools for each OS. You know how you can take some utils from XP and run on 2000 or Windows 7. This collection of tools looked like they should be able to run on any version. But for whatever reason they had a version of netstat for every Microsoft OS. My only reasoning for them to do it is for how it would stand up in the court room. It could be argued that using the XP version on the vista machine could have given invalid results because it was not ment to be ran on vista.
I have not looked at DECAF yet. But a simple root kit is all you need to defend this off. Hide running processes and network connections. Or better yet, stop breaking the law.
Im a gamer, not a grammer major. This post is full of spelling and grammer mistakes.
Get a mac?
Someone please explain. How is Windows secure (no pun intended) if Microsoft can release a tool, or script, which can get information from a password or encrypted system? Surely this cannot be an exploit to a backdoor. Does the use of COFEE require a user to already be logged in for it to work? Seriously. If this is the case, what keeps an evil-doer from using the tool to get into any window system they want and do whatever they want? If the tool has been leaked, then there is plausible deniability regarding any type of evidence on any windows box. Even if it were not leaked, this is proof that the windows platform is inherently insecure because there is a built-in method for bypassing its security features. Someone knowledgeable care to enlighten the uninformed?
.. about DECAF and COFEE?
this thing tries to access dns on startup and crashes if not allowed
seems suspicious to me
+1 Funny, -1 Troll, +1 WTF
IMO there are three kinds of funny: Funny as in joke funny, dry funny (e.g., sarcasm, dramatic irony), and "what the heck, where did that come from?" funny.
Unity? Screw that: XFCE. Slashdot Beta? Screw that: SoylentNews. Australis? Screw that: Pale Moon. UX developers DIAF
I first encrypted all my temporary data, encrypted everything in cache, it was a sweet algorithm. But I figured that wasn't enough, an onion-rings didn't help either. (I tried, I failed.)
So then I decided to use my PC without keyboard, so they couldn't log my keystrokes or via processing the audio for my keystrokes discover what I was typing. From there up, everything was a success, I could later remove my monitor so noone could see what I was doing and I could just imagine keyboardinupt on my PC.
I wasn't ever so productive and most of all SECURE.
Soon enough, I felt my mousemovements could also be secured by removing my mouse. Once I mastered this way of working, they suggested I also could work without turning on my PC, as they could measure my work by reading radiation from my CPU "if they really would be wanting to read my work", just tossing out my HD wasn't sufficient. So, right now, I'm 100% secure, sitting at my desk, imagening my work.
I did read something about mindreading, but I think that's just FUD.
I think we can keep recursing like this until someone returns 1
Seriously, what does COFEE generated data prove? If my computer would run XP and for some reason some official would want to plug a USB stick with the label "COFEE" into it, then what ever data they claim to find I could deny easily that it was mine. After all, on the USB stick there could have been ANY program which plants ANY data on the computer it was plugged into!
As far as I know, part of proper computer forensics work is to first (!) dublicate the hard drive in question, then generate a checksum for both drives (which of course should be the same), and lock away one of the drives to a seperate place such that one can prove later on that nobody has changed the original hard drive and that the gathered data is authentic!
But this COFEE is just pathetic!
Arrested Development Makes My Banana Stand
Slashdot users proved prophets for the nth time over: http://tech.slashdot.org/comments.pl?sid=1435688&cid=30021576
Oh yay! I cannot wait to install some unknown software on my computer that promises it will detect and block other unknown software.
I'll stick with my SODAS (Some Other Data Archival System). It run's on Linux and doesn't like COFFEE or DECAF.
-- this space for rent --
My 2 cents:
If someone has physical access to your machine, you're likely going to be boned. I tried COFEE, it's nothing special. It's not a secret elite tool. If you are knowledgeable enough to secure things so that physical access to your machine doesn't matter, there is nothing that COFEE can do to you.
All the hype around this is not generated by anyone in info. sec. It's typical "scary" media coverage.
You could use an accelerometer or a ball-and-cup arrangement similar to a seat belt locking mechanism (very sensitive, especially on newer cars. It locks the seat belt reel if the ball isn't exactly centered) to trigger a computer to shut down or reset if moved. If it's inside the PC and looks pretty normal I doubt the cops would notice, even if they opened the PC (which they probably wouldn't since they could trip a case intrusion switch...sawing through the case in a known safe area would be their only option).
"When information is power, privacy is freedom" - Jah-Wren Ryel
WGA's been cracked six ways from Sunday. The issue is Microsoft's server-side validation - illegitimate copies can't get updates. This is why MS goes apeshit on unauthorized patch distribution.
"When information is power, privacy is freedom" - Jah-Wren Ryel
When was the last time you read the source of an application to audit it?
there is a built-in method for bypassing its security features
Ding ding ding ding ding!
"When information is power, privacy is freedom" - Jah-Wren Ryel
Well, yes, it isn't called GNU/Linux for nothing...
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
I'm also fed up with Rages " Lets venerate burglars who murder old people" misguided lyrics and their "lets make socialism acceptable so we can sell lots of Che T-Shirts at Hot Topic" attitude along with the guitarists " lack of technical expertise on a Whammy pedal, rendering it an misused, overused cliche for those of us who use it seriously."
So maybe we should buy someone who isn't prepackaged industry approved rock and roll rebellion.
Or better yet quit worrying about who's on top of the industry charts, because it doesn't matter anyway.
Some other industry baby just as bad as Welcome to the Machine or Anonymous Cowell.
*Repent!Quit Your Job!Slack Off!The World Ends Tomorrow and You May Die!
Im a gamer, not a grammer major. This post is full of spelling and grammer mistakes.
Head... exploding... you evil.. bastard...
What's the COFEE without the donuts?
> I did read something about mindreading, but I think that's just FUD.
That's what the tinfoil hat is for.
And yes, I realize there might be “legitimate” reasons for keeping the source out of law enforcement&s hands [...]
WTH? Machine code IS source code! Just in another language that is a tiny bit harder to read (assisted by tools). So there really is no real point in hiding the source code. Everybody who wants to look at what it does, can still do that.
How else would the CPU know what to do with it?
It’s sad, when even on Slashdot, people think that “closed” source would be anymore than security trough obscurity theater.
Any sufficiently advanced intelligence is indistinguishable from stupidity.
People, you don't understand what this means !!
This marks an end of an era ! Up until now investigators could be pretty comfortable assuming that their forensics analysis were giving off accurate data about the use and activity of the computer. Tools to analyse file, network and disk access are based on the assumption that the metadata has not been tampered with.
It is enough that you download and run this program every now and then to render every analysis of your computer pretty meaningless as evidence. Soon someone will write a open source program that runs as a service to ticker with your metadata just a little bit every other day or so, and that will set back forensics analysis quite a few years, and make everything so much harder.
echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
I can't wait for the 'LATTE MOCHA' fork.
*Yawn*
Those of us in the computer forensics business don't use COFEE for real cases anyway. It's barely useful as a quick analysis tool for something you don't need to worry about presenting in court (thus completely nullifying the term forensics when talking about it).
Not surprised at all the typical slashdot anti-law enforcement rhetoric in here... especially all of the "innocent people will be saved!" statements. But I *am* a bit surprised that some of the commenters have said what they have. Do this many people really not want truly guilty people caught and prosecuted?
DECAF Developers release youtube vid explaining reasons behind release
http://www.youtube.com/watch?v=lF-g1Pb1tGM
Ok this is scary... I am visiting Turkey and when i tried to visit the "who we are" link in http://www.decafme.org/ I got a ministry of whatever of the Turkish government telling me that they are breaking some law... This is fucked...
Sure, it's security through obscurity.
And sometimes, security through obscurity works. ... for long enough. Sure, you can disassemble megabytes of machine code. But if it takes man-years to read enough to know what it is doing, you still win if the people reading it take real-years to get practical results.
It's that you can't really know how much effort people are putting into defeating the obscurity, and how much success they are having until "too late", that makes security through obscurity so unreliable (and thus despised).
When was the last time you blindly installed a program that performs a loosely-defined set of high-level administrative tasks like deleting files and disabling hardware, and which was developed for the express purpose of deterring law-enforcement? It's one thing to question the motives of freeware zip program or video editor, but I would never give full control of my OS to a program that could very plausibly be written by the bad guys themselves.
The counter-argument is of course that they wrote it to protect themselves, not to screw honest people, but there is no guarantee one black-hat won't try to screw another. Granted, the risk of *clones* that are *actual malware* is arguably higher than the original being malware.
However, it just occurred to me that this could become relevant for a lot more people if the international DMCA takes effect and enforcement against individual downloaders ramps up...
It's .NET and they ran Dotfuscator over it, so it's not that simple. At this point it's pretty damned obscure.
Even obfuscated, it's only 5 classes (which reference an unobfuscated settings namespace that gives you a little more info). Anyone familiar with .NET with some time on their hands could reverse engineer it.
Most human behaviour can be explained in terms of identity.
Which is exactly why Microsoft will be the first one to do so, thus eliminating any point in hiding the source in the first place--besides deceiving potential users.
My gut feel is that Microsoft (or somebody Big) fucked them (the authors of Decaf) in the arse and that's why they killed Decaf.
If i were a malicious hacker I'd rip decaf's internals out and either continue or repackage it. What kind of whackjob writes something like Decaf AS A LESSON TO THE WORLD. Sounds like one of those villains from Bond movies..
blog.idigitall.com