Slashdot Mirror
German Government's Malware Analyzed
First time accepted submitter lennier1 writes "The German hacker group CCC (Chaos Computer Club) has analyzed a piece of malware the German government uses in criminal investigations to spy on a suspect's computer. I'm sure we're all surprised that it's opening security holes for third parties, and violates a related court verdict (and several laws in general)."
You want competant surveillance too? Sheesh, so demanding.
I'll go ahead and throw out the "if you've got nothing to hide" out there too, and see how this gets modded.
Absolute power corrupts absolutely. indymedia
I'm sure we're all surprised that it's opening security holes for third parties, and violates a related court verdict
This must be some new meaning for the word "all" that I have not come across before. Because it implies that "all" means a vanishingly small fraction of the population.
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
I think there is something we don't know about. If they really got "official" version, then I am expecting that many heads in German federal government will fall.
I was going to scan the binaries with some anti-virus programs to see if their signatures were detected, but the downloaded tgz file comes up with errors when attempting to extract. Anyone else running into that problem?
Sweet, thanks for clearing that up.
Can this trojan upload child pornography (or any other incriminating files/images) to the suspects computer, to be collected as "evidence" at a later date? I suspect it can. And if this program can uninstall itself at a later date, then this is a perfect tool for "bring him in, boys". Oh George Orwell, how foresighted you were.
Seven puppies were harmed during the making of this post.
Sweet, thanks for clearing that up.
Slashdot asked me "personally" for my opinion... Gezz, don't mod me bro...
Communication uses the fixed banner string "C3PO-r2d2-POE" as handshake.
So, this could be the trojan we're looking for.
Also, the code contains a function called "_0zapftis_le_execute()".
"O'zapt is!" is the traditional opening phrase of the Munich October/Beer Festival, where the mayor taps the first barrel of beer with a hammer.
Source: http://www.ccc.de/system/uploads/76/original/staatstrojaner-report23.pdf
How can the US government keep doing stuff like ... what, it isn't the US government? Then it must be for the good of the country since only the US does stuff like this with anything other than good intentions, carry on.
This hopefully helps that state of the art anti virus software from now on will detect at least this variant of the trojan.
i have read the report linked to in the article. This report is written in german. Nothing hints in the binary itself that this is the "real thing". The analyzed binary is a windows-DLL with out exported functions. The C&C server the trojan is 207.158.22.134, which is allocated to Web Intellects in Columbus, Ohio, USA. The connection to the german government is only hearsay for now, we have to believe in it.
Yes, you too can foster Total Political Disintegration (Normal Mode), Totalitarian Rule (Easy Mode), New Nazi Order (Hard Mode), or Common Sense Government (Insane Mode) by pitting the various German political factions against one another via clever remote control of their computers at home and in the office!
Game Play includes: That's Not My Porn and Child Porn Prisoner internet insertion features, send copies of incriminating e-mails to political rivals and international newspapers, bonus mod features to hack China for bonus points or massive DOS attacks on known enemies of Anonymous (pick a target, any target), and many, many other features that have to be seen to believe. (Especially when taking remote control of laptop cameras to take pictures of Government at home and posting the more interesting captions all over the Internet.)
The German Government, working to make life more difficult for citizens and officials alike. You flew it, you blew it, you rue it. (This software law, that is.)
"I'm sure we're all surprised that it's opening security holes for third parties, and violates a related court verdict (and several laws in general)."
No not really...
Really, if the government (any government) is going to get into the malware game, they should hire people to create it for them who are at least as competent as the guys on the other side of the fence.
The higher the technology, the sharper that two-edged sword.
The piece of incompetence that I find really striking is not so much the general shoddiness; but the fact that the malware is using a proxy setup in the US to avoid having its traffic traced back to the German police entity using it. Even if they know nothing about the tech side of things, surely exporting the evidence outside of the state, country, and EU, to some random datacenter in the US, would mean a hairy pile of privacy and chain-of-custody problems for the chaps in legal?
The Chaos Computer Club is probably not adequately characterized as a 'hacker group'. It was founded in 1981 as a computer club and, while hacking has always been their most prominent activity, they have grown not only into a nation-wide association of about 3000 members, but into an influential civil rights organization as well. Their expertise in matters of IT security is frequently called upon by public media in Germany. The CCC is well respected even by many politicians and their expertise was cited more than once by former Ferderal Minister of the Interior Gerhart Baum during the trial that ended last year with the Verfassungsgericht (federal constitutional court)'s finding that the federal anti-terror law that obliged providers to retain all telecommunications data for six months was unconstitutional. The CCC organizes the annual Chaos Communication Congress that Slashdot readers might remember as being the event where some major hacks were presented to the public: http://it.slashdot.org/story/11/01/02/0231242/detailing-the-security-risks-in-pdf-standard http://games.slashdot.org/story/10/12/29/204253/Playstation-3-Code-Signing-Cracked-For-Good http://it.slashdot.org/story/09/12/28/1931256/gsm-decryption-published http://games.slashdot.org/story/05/12/16/2157217/hacking-the-xbox The CCC is also well know for Project Blinkenlights, which grew out of the CCC but is now an independent project.
Or is it illegal for an app to find viruses that are questionably legal because he government spreads them?
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
Why don't we all ask WebIntellects what they're doing there?
nope, as german law doesnt exclude illegaly obtained evidence from use in court.
ive read enough dystopiae to see where this is goin...
That the Nazi Government of Fuehrer Angela Merkel is caught engaging in such Federal buffoonery is of no supprise.
The best thing to happen to the peoples of Deutshland is the nuclear bombing of the Chancellory by US Commander Jack Ripper.
Vell ... meet again ... Don't know vere ... Don't know ven. But I know ... zat ve vill meet again ... zome zunney day ....
++
does it run on Linux?
thegodmovie.com - watch it
at least as competent as the guys on the other side of the fence.
The general public is not known for their competence in computer software development. The government would be better off employing criminal hackers.
"I've got more toys than Teruhisa Kitahara."
Right, but that is appropriate. The USA is the only country I know of that does exclude evidence like that. In most jurisdictions, the aim (idealized, not always realized) of a court case is to uncover the truth of what happened. If the law was broken in the process of obtaining evidence, by all means prosecute the people who broke the law, but to exclude that evidence is a weird thing to do. At least, 90% of the planet thinks so...
The situation in the US is based on a rather bizarre interpretation of the constitution set by the supreme court, actually not so long ago, starting from around 1920. The Fourth Amendment of the constitution is the one about "no unreasonable searches and seizures", and requiring "probable cause". But it doesn't specify what the penalty should be if those rights are violated. In much of the rest of the world, the equivalent violation (eg, of police or some other person obtaining evidence illegally) opens the offender for prosecution but whatever evidence is obtained can still be used. That was the case in the USA before the early 20th century. But several court cases in the 20's and 30's established the "fruit of the poisonous tree" doctrine, in which evidence which was obtained illegally is not admissible in court. This has resulted in many farcical court cases where the facts of the case are well established, but can't be presented in court because the evidence was obtained illegally (in some cases, due to some technical omission). It also results in lots of arguments where opposing lawyers have a big bun fight, and make lots of money, arguing at length over whether a particular fact is allowed to be presented to the court or not.
It has also resulted in the attitude that cops who break the law are already "punished" by being unable to present the evidence in court (and often therefore unable to convict a criminal), and that this is sufficient punishment for the cop. Whereas in other jurisdictions the cop would lose their job, or end up in jail themselves, in the US they typically don't. This is an encouragement towards corrupt behavior.
The USA is the only country I know of that does exclude evidence like that.
Norway would be the second country then. In fact, it's probably stronger than the US protection because an employer that made illegal recordings of his employers had the evidence rejected after filing charges for embezzlement. That one went to the supreme court, I couldn't find a similar case where the police used illegal methods because once that is known the charges would be dropped. Honestly I would be surprised if a modern rule of law didn't include something like that, otherwise there's a million loophole where the police can protect each other or hired thugs to provide evidence without any clear trail.
Live today, because you never know what tomorrow brings
I think in Hungary it works similar to the US. Also, evidence can't be reused in a different trial.
"I'm sure we're all surprised that it's opening security holes for third parties, and violates a related court verdict (and several laws in general)."
No not really...
I'm sure everyone here is familiar with the concept of sarcasm.
The Tao of math: The numbers you can count are not the real numbers.
In other news, the Piratenpartei recently made it to the Berlin City legistature with 8% of the vote and and are currently running nationally with that level of support. If they maintain this, they will be the 4th-5th largest party in Germany.
Mielipiteet omiani - Opinions personal, facts suspect.
So, if you're a criminal in Germany, all you have to do is install this software on your computer and then you have plausible deniability because anybody could have uploaded anything to your PC. Your PC could no longer be used as evidence.
Fucked that one up didn't you Germany!!!
Waterfox - a Firefox fork with legacy extension support, security updates and better privacy by default.
exporting the evidence outside of the state, country, and EU, to some random datacenter in the US, would mean a hairy pile of privacy and chain-of-custody problems for the chaps in legal?
Far more than that: it is exporting personal data outside of the country, this is against EU data protection laws. In particular the USA which has been found to NOT have a data protection standard that is good enough -- again a violation of EU data protection laws.
Sounds like they just copy/pasted subseven.
"I'm sure we're all surprised that it's opening security holes for third parties, and violates a related court verdict (and several laws in general)."
No not really...
I'm sure everyone here is familiar with the concept of sarcasm.
No not really...
Every end has half a stick.
It has also resulted in the attitude that cops who break the law are already "punished" by being unable to present the evidence in court (and often therefore unable to convict a criminal), and that this is sufficient punishment for the cop.
Well, not so in Germany. Typically (at least according to popular lawblog.de) it's like this: Prosecutor gets judge to sign a search order which is blatantly illegal. Search victim goes to court; result: a letter to hang over the fireplace saying the search was illegal.
If the search victim is prosecuted, the court has to weigh what's more important: the injury of the illegal search or dealing with the crime. Hint: answer's always the same.
Whereas in other jurisdictions the cop would lose their job, or end up in jail themselves, in the US they typically don't.
Unless it's something big like the recent blanket surveillance of all mobile phones in a city, I don't know there's ever been any consequence in Germany.
...of its own ridiculousness, they manage to pull off something even more stupid. These times the stuff you write on a postcard is better protected by German law than your private emails/data/whatever. It's like politician are afraid of the new technologies. :-/
Computer simulation made easy -- LibGeoDecomp
Knowing the German government, and how it works, I can tell you how this train wreck came into existence.
Some government employee drafted the requirements for the toy. Being a government employee, he doesn't know jack about security and got his job mostly due to connections and knowledge of people rather than the matter at hand. And as such, his draft was shabby and less than perfect.
The company executing the order did implement it with the minimal effort to meet the requirements, as is usual in such a scenario. And hence the blunders.
Why the shabby not-quite-secure AES implementation? Because the requirements most likely listed "must do AES" without details on why and how.
Why the proxy in the US? Because it wasn't part of the draft and it's been probably cheaper to do.
Why the hole where planting "evidence" is possible? Because audit security was no requirement.
Why all the other blunders? Because they were not part of the bid invitation and implementing them would have increased the cost.
In a nutshell, even if the executing company could do it better, my money is on the wager that it was simply not part of the specs. What's not in the specs does not get implemented.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
It called "Free Anti-virus Software". Or better yet lets have the proles pay to install our spy-ware {Norton, McA..., WindowMali...Tool, etc.)
In much of the rest of the world, the equivalent violation (eg, of police or some other person obtaining evidence illegally) opens the offender for prosecution but whatever evidence is obtained can still be used. That was the case in the USA before the early 20th century. But several court cases in the 20's and 30's established the "fruit of the poisonous tree" doctrine, in which evidence which was obtained illegally is not admissible in court.
This incentivises the police and prosecution services in other countries to ride roughshod all over the rules of evidence if the crime is serious and they think it'll net them a conviction. I mean, who really cares if a pedophile was convicted using illegally-collected evidence - he obviously doesn't deserve any rights, and neither the press nor the courts are likely to see anything much wrong with this, if he even lives long enough in jail to be able to sue in the first place. Without the "fruit of the poisonous tree" doctrine, deciding whether or not to deliberately and illegally collect evidence just becomes a gamble - the odds of netting a conviction versus the odds that the person is innocent and it'll backfire - and the police tend to be biased towards assuming guilt. Only throwing out evidence collected in this way can remove the incentive to trample on the constitution.
In other news, the Piratenpartei recently made it to the Berlin City legistature with 8% of the vote and and are currently running nationally with that level of support. If they maintain this, they will be the 4th-5th largest party in Germany.
I think I see a political strategy forming...
Whereas in other jurisdictions the cop would lose their job, or end up in jail themselves
What a quaint belief.
Cops in every jurisdiction don't even get their hand slapped unless they start doing things that are orders of magnitude beyond what would cause normal citizens to be thrown in jail for 10 years. Yes, there are a few examples made, but generally those are going to be people that the rest of the cops didn't like for some other reason.
"The government would be better off employing criminal hackers."
The leaders don't like the competition.
at least as competent as the guys on the other side of the fence.
The general public is not known for their competence in computer software development. The government would be better off employing criminal hackers.
The problem there is ... they're criminals. You'd have to have any code they come up with vetted by someone competent enough, indeed tricky enough, to make sure there's nothing in there that could make the whole thing backfire (I mean, hell, if you were a blackhat of that magnitude ... wouldn't you try to put one over on the gendarmes? Just as a matter of principle?) And if you know someone you can trust who's good enough to spot any problems, you might as well just hire him (or her) in the first place.
It's a bit of a conundrum though, if you work for law enforcement: any capable programmer with ethics is going to think twice about accepting that kind of a job in the first place. The fact that it's "for the good guys" isn't sufficient reason in my mind. I wouldn't do it, even though I could. It's one of a number of areas where I just won't go, even if it might be an entertaining technical challenge. Too much potential for innocent people to get hurt, and I wouldn't want that on my head.
The higher the technology, the sharper that two-edged sword.
"The government would be better off employing criminal hackers."
The leaders don't like the competition.
Ha ... isn't that the truth.
The higher the technology, the sharper that two-edged sword.
What's not in the specs does not get implemented.
Yeah, I think you hit the nail on the head. Nor should they be implemented: it's not the contractor's fault if the purchasing party has its head up its collective ass. Know what you're asking for when you put out a bid request: it's the only way you'll a. have any chance of getting what you want and b. be able to tell if you ultimately got what you paid for. Specs can be a pain in the neck, and many see them as a waste of time, but without a proper spec a development contract is a crapshoot.
The higher the technology, the sharper that two-edged sword.
And I don't even want to blame the guy responsible for the bidding conditions, because I'm in his shoes and I know how it works. You get an assignment to write the specs and they should be done by, well, yesterday. I mean, how long does it take to type those five pages?
What people fail to see is that the work isn't typing. It's pondering what to type and taking every aspect into account. Pretty much like programming, once the code gets written, 90% of the work has already been done. At least if the programmer's worth his money.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I read one of the job postings from BKA for "IT Security Programmer". I definitely was not included to do the devils job, even though I had the skill and sufficient background to do it. Maybe I should have done it, would not have been a mess like it is now. (And pass it on to the likes of CCC...)
Whereas in other jurisdictions the cop would lose their job, or end up in jail themselves
Tell that to Jean Charles de Menezes. You'll probably need a medium, though.
Finally had enough. Come see us over at https://soylentnews.org/
I kind of disagree, in some way. As a government employee you have actually sufficient time to think it though. But the big obvious problem is that you normally don'T think of all the hooks and notches while you write the original spec. Then you go for a bid and Germany, (for government contracts) you need to take the cheapest bid, that fulfills some basic requirements. As it tuns out there is ALWAYS one bid that servilely undercuts the other bids and you know that this one is crap. Only problem is formally the bid is ok. There is a reason why the Netherlands always take the second best bid, that prevents price fixing.
The USA is the only country I know of that does exclude evidence like that.
Norway would be the second country then. In fact, it's probably stronger than the US protection because an employer that made illegal recordings of his employers had the evidence rejected after filing charges for embezzlement.
I assume, in that case, that the employer went around one night to the embezzler's house with a couple of baseball-bat wielding friends and beat the crap out of him. There's such a thing as natural justice if the legal system fails too egregiously.
To have a right to do a thing is not at all the same as to be right in doing it
I kind of disagree, in some way. As a government employee you have actually sufficient time to think it though. But the big obvious problem is that you normally don'T think of all the hooks and notches while you write the original spec. Then you go for a bid and Germany, (for government contracts) you need to take the cheapest bid, that fulfills some basic requirements. As it tuns out there is ALWAYS one bid that servilely undercuts the other bids and you know that this one is crap. Only problem is formally the bid is ok. There is a reason why the Netherlands always take the second best bid, that prevents price fixing.
Ideally, there should be some give-and-take. There's no way in hell that a spec author can account for everything, know everything, or be aware of special capabilities of a given supplier. Given some communication with contractors during the spec-writing phase a lot of important details can get nailed down, and the purchaser may often learn about options and methodologies of which he wasn't aware. I used to be a contractor, a long time ago: my specs precisely fit customer requirements because I worked them while I was writing it.
The higher the technology, the sharper that two-edged sword.
Odd, when I was on the other end of the bargain (i.e. the "picker"), I had pretty much leeway to pick the right offer, as long as I could sensibly argue my choice.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
And that's usually a big nono. You see, when you write the specs together with a potential contractor, a competitor could butt in and argue that that you played favorites and that contractor only won because he pretty much drafted the specs.
Actually, the sensible thing to do when you're writing specs for a field you lack the expert for is to hire such an expert. And that's actually the proscribed procedure in such a case for government contracts. Hire an expert in the field who will then draft the specs with the feds (them writing the "content" requirements, him adding the "technical" requirements) and exclude him or any affiliates of his from the bid for the actual contract. This is the correct procedure.
Sadly, when it comes to computers, suddenly every idiot able to turn on a box calls himself an expert. There's also very little in the form of hard credentials in the field that isn't geared towards the management-compliance driven and less the technical-hands-on driven aspect of ITSEC.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.