Slashdot Mirror
'Babar' Malware Attributed To France
sarahnaomi writes: The NSA, GCHQ, and their allies in the Five Eyes are not the only government agencies using malware for surveillance. French intelligence is almost certainly hacking its targets too — and now security researchers believe they have proof. On Wednesday, the researchers will reveal new details about a powerful piece of malware known as "Babar," which is capable of eavesdropping on online conversations held via Skype, MSN and Yahoo messenger, as well as logging keystrokes and monitoring which websites an infected user has visited. The researchers are publishing two separate but complementary reports that analyze samples of the malware, and all but confirm that France's spying agency the General Directorate for External Security (DGSE) was responsible for its creation.
The first ever malware to work only 35 hours a week...
reports that analyze samples of the malware, and all but confirm that [the DGSE] was responsible for its creation.
Those two reports do everything except confirm that the DGSE was responsible? Can somebody explain this English expression to a non-native speaker?
They've ruined the good name of a respectable elephant, in this very room!
It could have been the Asterix malware. That shit doesn't just spy on you, it beats the crap out of of you - and then has a nice feast to celebrate!
I am Slashdot. Are you Slashdot as well?
Lord forbid a security researcher share list of user name and passwords, or a journalist post a link to a database dump, or a college student download a large number of academic journal articles through MIT's computer network.... These evil computer hackers need to be put away forever to protect the children, moral people everywhere, and our pristine government that can do no wrong. The death penalty probably won't be too good for them!
However, should the government want to hack us, destroy our privacy, intercept and tamper with postal packages, harm the computing environment in general by embedding back doors and exploits into software/hardware, etc. by all means this is perfectly OK. Hell, we should be grateful they are doing this for us poor pleebs since we can't think for ourselves. I mean this is the government; they know what's best for us.
So kill the "hackers" for doing something that doesn't even remotely approach the level of invasiveness described by this article and others, but let the government do anything they like in the name of "security" and "safety." Or hell, maybe even because they just feel like it. Who are we to question our betters?
This crap makes me sick.
Herp a derp WEASEL WORDS i are so cute
There must be a commercial break on Fox News. You better get back, you might miss something.
You don't know how many people are afraid to even comment on this article, because you never hear from them.
Quite sure visiting slashdot already puts you on the watchlist. You know a lot about computers, that means you probably understand encryption and are potentially a terrorist.
I mean, who else is going to craft malware named after french speaking elephant.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Everyone get online and start talking about terrorism to flood the snoopers.
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
This proves that all the whining about the NSA has little to do with actual worries (as if anyone in the government actually cares about their porn viewing habits), and more to do with overwrought anti-Americanism.
No, it doesn't.
We are more concerned about the NSA doing it because it has a bigger budget and because, for a lot of slashdotters, it's our government that's doing it. It's still a subject for humor, but nevertheless a real social policy concern. I've met a lot of great guys who work in law enforcement whom I would generally trust not to abuse the powers created by massive surveillance, but the problem arises when too much trust is given and there isn't enough oversight of how it is used. As it is, the public is not given any believable claim to even the existence of meaningful oversight.
That means bad actors within the system can use it to spy on people they know, on their own ex-wives, for example. And while they might get severely disciplined if they're caught, the public hasn't been told how likely it is that they're caught.
It also means the system can be used to blackmail VIPs, power-brokers, reporters, and legislators. While most of the people involved would not use it for that, it only takes one or two people to be willing to do that and a lack of *perfect* oversight and reporting for a system like this to utterly threaten and destroy any notion of representative government.
Imagine you have a database of every Congressman's phone calls, or even every third or fourth phone call that happens to be to someone within a three-hop warrant of a terrorist.
I think it's more to do with the inevitability of the French=Surrender Monkeys meme. Personally, I think this makes it all the more evidence that this is a government practice that we need to eliminate. Those behind this malware are criminals and we should see them as such.
This is my signature. There are many like it, but this one is mine.
I think the main thing this proves is that most people on slashdot are from the US, so they obviously are more fearful of their government spying on them than they are of other governments.
This may be reaching but could it be possible that majority of actual hacking, (not some bullshit script to get other users data by varying query strings or guessing the naming pattern of files stored under a directory that aren't enumerated etc....) is done by government sponsored agents? Could the majority or close to it of malware out there be ultimately funded by governments? The rate of stories like the OP keep up and I am going to have trouble believing this isn't only possible but probably.
The 'Bieber' malware has been attributed to Canada, which is capable of infecting all news websites with inane celebrity gossip.
They say every country is doing surveillance and this post adds wood to the fire. But don't fall in the category mistake to equate NSA and GCHQ to the other countries. They have unlimited and growing budget, receive help from cloud companies, have build development teams that have created surveillance software that ran for 15 years under the radar. NSA, GCHQ surveillance is the most sophisticated, widespread and all encompassing, there are even 2 countries where ALL communications are being vacuumed by their systems, they also sell their services to oppressive regimes. Everyone else is a amateur compared to these two
haxxed by dem frenchies, no less. a-fucking-ma-fucking-zing.
As an American, I have the right, duty and obligation to complain about the NSA's illegal bullshit because they're (ostensibly) claiming to represent me as a citizen, while acting against my interests as a citizen. France, on the other hand, is a sovereign foreign nation, in which I have no standing to complain.
The spying is bad no matter who's doing it, but it's the French citizens' job to fix France's spying, not mine, just as it's American citizens' job to fix the USA's spying, not theirs.
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
The "evidence" are : 1) babar & titi the names (babar from a children book published in 1931... and has pretty much international readership and has shows in canada) Or pretty damn simply a fan of soccer.
2) MSIE misspelled as MSI which anybody could have done
That is quiiiite flimsy. I hope they have more.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
I figure they are going after most users which will exclude hackers since they all use Linux or some form of to do their work.
Weird, I thought visiting Slashdot meant you either:
A) Want to catch up on last months news
B) Want to troll comments.
This malware invades Windows desktop machines and aims at exfiltrating almost anything of value: it steals data from instant messengers, softphones, browsers and office applications .. A target machine is infected possibly through a drive-by or malicious e-mail attachments. Babar is deployed through a malware dropper, which installs the malware ...
Is it still Malware if Microsoft does it?
They surrendered in WW2 and still can't live it down, but aside from that the meme isn't accurate. Their special forces are usually considered some of the best in the world, and the french resistance certainly managed to make the Nazi occupiers lives difficult.
The English still remember kicking French arse at Agincourt, of course. Even if it was six hundred years ago. We didn't just win - we won by such a margin as to give them humiliation that will last a thousand years.
As long as my ICQ chats aren't vulnerable Im happy
This proves that all the whining about the NSA has little to do with actual worries (as if anyone in the government actually cares about their porn viewing habits), and more to do with overwrought anti-Americanism.
Quite the opposite. It proves that the anti-French sentiment is so strong in the US and UK that it drowns any rational discussion.
The report says "Titi is a French diminutive for Thiery, or a colloquial term for a small person".
Well first it's Thierry with two 'r's, but I've never seen titi being used as a diminutive for it, though that's because nobody would stand to it being used in public. Then there's the titi parisien but I've never seen titi referring to a small person.
But all this misses the point. Just like an uninspired English-speaking programmer will call his variable 'foo' and then 'bar' if he needs a second one, a French programmer will call his variable 'toto' (from the classic Toto jokes) and then 'titi' if he needs a second one (and then 'tata' but normally by the time he reaches tutu he realizes he really needs to straighten up ;-) ).
So what this really tells us is that this developer has a collegue whose username is 'toto'.
Yea but not right next to each other, I thought that's what you meant.
See subject: Windows is by far MOST USED on the planet - that's the only real one. Proving that Windows is the MOST WORTHY to attack - more possible victims on worldwide use patterns alone.
* Every platform out there has ways in, & I figure that once they're shown, they're fixed @ most in 30 days time usually. One less security issue to worry about, every month.
(One day? It's not going to be any for MS I wager: Give it 5-9++ years for Windows 7 & above)
APK
P.S.=> So - what happens after that? The lesser used platforms get attacked more since MS stuff will be patched fully vs. all possibles & MacOS + Linux (they're already getting a 'portent of things to come' that way on ANDROID for a decade++ now) will have to go thru a baptism of fire that MS already weathered...
Will they? Time only can tell, but we'll see...
... apk