04.21.09

FBI, CIPAV, and the Windows Back Doors Revisited

Posted in Microsoft, Security, Windows at 6:30 am by Dr. Roy Schestowitz

Looking through the tube

Summary: How (and why) the American secret services rely on Windows

THE back doors in Microsoft Windows are a serious issue that we've already covered, so there is no point doing it again. Adding to what we already know, there is now this report from Wired Magazine and another from IDG:

CIPAV spyware helped nab unemployed engineer angry over outsourcing

There is also a discussion at Slashdot and one reader of ours wrote: “A good question to ask is, what is it about Windows that allows CIPAV to be so easily activated? Does it even require visiting a contaminated Web site (see the Slashdot article)? What is it in Windows that allows such features?” Here is some relevant information which this reader sent to us:

CIPAV, which stands for “Computer and Internet Protocol Address Verifier,” is secret surveillance software that the FBI used last month to help identify whoever was e-mailing bomb threats almost daily to a Washington high school.

[...]

The only clue in the affidavit is that the CIPAV would operate as a pen register for up to 60 days after the software had been “activated” by the recipient. In other words, the FBI swore that the monitor would “time out” after 60 days. But not that it would delete itself or not be able to spread in some worm or bot fashion.

This post neither defense nor criticism of malicious and dangerous behaviour that the FBI is rightly intercepting. It is merely recognition of the operation of Microsoft Windows.

It is not news that the FBI uses Windows viruses (there were several articles about it last year) and the DHS, which recently recruited Microsoft after pressure from the BSA, is now recruiting hackers.
________
[1] FBI remotely installs spyware to trace bomb threat

While there’s been plenty of speculation about how the FBI might deliver spyware electronically, this case appears to be the first to reveal how the technique is used in practice. The FBI did confirm in 2001 that it was working on a virus called Magic Lantern but hasn’t said much about it since.    

[2] FBI ducks questions about its remotely installed spyware

There are plenty of unanswered questions about the FBI spyware that, as we reported earlier this week, can be delivered over the Internet and implanted in a suspect’s computer remotely.

[3] FBI to Notify Microsoft Windows Users Who Were Victims of Botnets

The Department of Justice and FBI have announced the results of an ongoing cyber crime initiative to disrupt and dismantle “botherders” and elevate the public’s cyber security awareness of botnets.

[4] FBI: Operation Bot Roast finds over 1 million botnet victims

The Department of Justice and FBI Wednesday said ongoing investigations have identified more than 1 million botnet crime victims.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

This post is also available in Gemini over at:

gemini://gemini.techrights.org/2009/04/21/cipav-and-microsoft-windows/

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

4 Comments

  1. The Mad Hatter said,

    April 21, 2009 at 11:03 am

    Gravatar

    Based on what I’ve read, you are regarded as a probable threat if you run an OS or Web Browser that CIPAV cannot infect. The reasoning seems to be that if you have made the choice to run Linux/OSX or use Firefox/Opera on Windows instead of Internet Exploder, you must have something to hide.

    No, I don’t have details or a link, I remember reading this a while back somewhere, and now can’t remember where.

  2. Roy Schestowitz said,

    April 21, 2009 at 11:14 am

    Gravatar

    There’s this recent incident.

  3. Yggdrasil said,

    April 21, 2009 at 7:30 pm

    Gravatar

    You are misleading people, again. You should have cited this from the Computer World article:

    “Some user action was CLEARLY REQUIRED to infect the PC with the CIPAV. In the warrant application, the FBI used the term activate several times and alluded to a spyware plant failure if the target did not trigger the CIPAV through the targeted MySpace account. MySpace accounts can’t receive traditional e-mail, so one hacker standard — attach the CIPAV to a message and hope the recipient is stupid enough to launch it — wasn’t available”

    Exactly. If you want to infect a Linux users, it’s as simple as sending them some program and getting them to run it. You also mention Slashdot, but of course, you only mention comments that would be critical of Microsoft. How about these comments instead? Both of which received high rankings.

    “What makes you think they don’t have a variant for Linux? User stupidity (i.e: bad/no security) isn’t unique to Windows. Off the top of my head, if they are relying on the web as an infection vector combined with user stupidity, why not write it into a Firefox extension?

    Yeah, it wouldn’t get your typical /. geek, but most criminals aren’t known for their foresight or intelligence. “Oh, the private website with the bank account information needs me to install this software! Ok, what could possibly go wrong?”

    In response to that:

    “This is an excellent statement. Stupidity knows no bounds. Its also dangerous to assume that the FBI doesn’t know what it is doing. When I worked in law enforcement, the FBI computer crimes agents I knew were well versed in operating systems other than Windows. The two I worked with most often had a solid knowledge of Linux and Cisco IOS.”

  4. Brian Assaf said,

    April 23, 2009 at 7:53 pm

    Gravatar

    “If you want to infect a Linux users, it’s as simple as sending them some program and getting them to run it.”

    Um. That easy huh? By default files aren’t executable, so it would require changing the permission. It would also need to be run as root to infect the whole system. How about dependencies? How about architecture differences. Just x86 or 64-bits? MIPS? Arm?
    So on and so forth. Linux isn’t a monoculture (no pun intended here guys/gals!) like the Windows ecosystem is.

    Even a pre-packaged deb (which can be installed ala double click in Ubuntu) would ask for a password, and again, wouldn’t be viable for every Linux distribution out there, architecture not withstanding.

    Having to run something out of the blue is odd if you use a package management system. Cryptographically signed, easily installed/uninstalled and updated (and source available for those interested.)

    Although maybe I’m alone in the 24,000+ packages available in Ubuntu being enough for regular computer use.

    My point here is I’ve unlearned a habit, there is no need to grab software willy nilly off the net. Instead check the repos, and check the source of software. Do you trust it, etc and why should I install this. Plus does it behave like a rootkit, if so then it can be scanned for, if this really does become some sort of popular vector…

    So, yes, you could use social engineering to get someone to install something, but the process should set off a red flag in the user.
    There isn’t some autorun or double click deal here. For those users that understand binaries are a blackbox, where no one can inspect, change, etc. anything, install at your own risk.

What Else is New


  1. IRC Proceedings: Friday, April 16, 2021

    IRC logs for Friday, April 16, 2021



  2. Hate Letter Against FSF (Concern Trolls): 1415 Committers, Letter in Support of FSF (With Its Founder Back): 5116

    Taking into account people who asked for their names to be removed from the defamatory hate letter (inciting people, based on falsehoods), it's not impossible that the support letter really triples or quadruples it in terms of number of signatures



  3. Richard Stallman: Sharing is Good... We Need to Legalise It

    Dr. Richard Stallman, the Free Software Foundation's founder, explains his take on copyright and the artificial restriction being used against sharing



  4. Nadine Strossen and Hannah Wolfman-Jones Rebut Accusations Against Stallman and Choose Him as Coauthor

    "Here are her thoughts and the response she received from Nadine, extracted verbatim with their permission from the original article"



  5. Links 17/4/2021: GNOME 40 in Tumbleweed, Devuan 4.0 Alpha, Kate Editor Makes a Leap

    Links for the day



  6. EPO Staff Union Takes the EPO 'to Court' (the ILO's Tribunal, as the EPO Cannot be Taken to a Proper Court)

    The Staff Union of the EPO (SUEPO) Committees are preparing a legal battle over unlawful and unjust measures taken collectively against hard-working (overworked during pandemic) members of staff; the European public should support them



  7. The Latest Anti-RMS Coup Attempt Targets the GNU Project (Because the FSF Coup Has Clearly Failed) by Infringing and Disregarding Trademark Conventions

    A fake "GNU" (not the original GNU, just riding the coattails of the name "GNU") is trying to find/gain traction and we must oppose it because it's an extension of the very same coup attempt (same plotters) that manufactured a whole bunch of libel to incite people and blackmail the Free Software Foundation (FSF)



  8. Links 16/4/2021: Mozilla Dumping FTP, Corporations Still Concern-Trolling FSF

    Links for the day



  9. The EFF Attacks Software Freedom and Promotes Fake Privacy Linked to Microsoft

    Only weeks after attacking Software Freedom (the ad hominem way, which is easier) the EFF endorses a Microsoft-linked privacy abuse, misframing it as some sort of privacy champion



  10. Richard Stallman on How Corporate Media Limits What People Are Allowed to Think and Say (Updated)

    What the founder of the FSF told yours truly a number of years ago about the behaviour of corporate (funded and controlled by corporations) media



  11. Exposing Hard Truths is the First Step or the Path Towards Justice

    A reflection and a moment taken to set aside tribalism (shallow differences based on allegiances of personal comfort), for we need look back at actual facts — however inconvenient at times — and consider the reality of the situation



  12. IRC Proceedings: Thursday, April 15, 2021

    IRC logs for Thursday, April 15, 2021



  13. [Meme] Laundering Bribes as 'Cooperation Money'

    Germany has financial interest in ensuring that EPO abuses carry on and nobody holds the EPO accountable



  14. Articles in Support of Richard Stallman

    Reproduced with permission



  15. EPOLeaks on Misleading the Bundestag -- Part 20: Taking Stock

    Benoît Battistelli's legacy at the EPO is a legacy of corruption and cover-up; we take stock of how illegality was defended and persists to this day



  16. Links 15/4/2021: Zorin OS 16 Beta and Pushing Linux to GitHub- and Microsoft-Connected Rust

    Links for the day



  17. [Meme] Enemies With Common Interests

    The Software Freedom Movement (or Free Software Movement) has many enemies; some of them just hide in the shadows or speak out through shadowy front groups/NGOs that they semi-officially sponsor



  18. [Meme] Germany's Red Cash Cow

    EPO brings a lot of money to the German state. But at what cost to citizens and Germany’s public image?



  19. EPOLeaks on Misleading the Bundestag -- Part 19: The Deafening Silence of the Media

    "There has been speculation that Maas might have had his own political interest in protecting Battistelli and the Balkan Express because of certain allegations about financial irregularities involving the German Patents and Trademark Office (DPMA) which were doing the rounds at the time."



  20. The Indirection Game

    How to attack institutions and concepts by personifying them, then proceeding to character assassination based on lies and deliberate distortions



  21. Links 15/4/2021: LXQt 0.17, Proxmox Backup Server 1.1

    Links for the day



  22. The Patent Battles in Europe Are Connected to the War on GNU/Linux (as a Community-Led Effort)

    Monoplisers of GNU and Linux want us to think that OIN is the solution while they actively lobby for software patents in Europe and the people in charge of Europe’s second-largest institution and Europe’s largest patent office help them; this long video contains thoughts about news from the past couple of days



  23. Richard Stallman: Freedom is the Goal (Updated)

    What Richard Stallman (RMS) told me in person on his trip here



  24. IRC Proceedings: Wednesday, April 14, 2021

    IRC logs for Wednesday, April 14, 2021



  25. EPOLeaks on Misleading the Bundestag -- Part 18: Zero Tolerance for “Lawless Zones”?

    "It comes as no surprise that Maas appeared as a guest of honour at the European Inventor of the Year Boondoggle in Berlin in 2014 where he was seen on stage clapping along with the EPO President."



  26. Richard Stallman's Honors and Awards (and Why He Resigned in 2019)

    Reproduced with permission



  27. Links 14/4/2021: Alpine Releases and X.Org Server 1.20.11 Release (Security)

    Links for the day



  28. Links 14/4/2021: EasyOS Dunfell 2.7, Tor Browser 10.5a14

    Links for the day



  29. EPOLeaks on Misleading the Bundestag -- Part 17: Jawohl, Herr Minister!

    A French-German co-production of "Yes, Minister!" starring Raimund Lutz, Heiko Maas and Christoph Ernst. Directed by Benoît Battistell.



  30. Over 1,000 EPO Workers Initiate Legal Challenge Against the EPO's Attack on Salaries (in Defiance of Assurances Made to Workers Who Relocate to Another Country With Whole Families)

    The EPO’s attack on workers and pensioners isn’t going ahead without challenge; while the “Mafia” (what EPO workers call the management) loots the organisation it takes away money from the workers — i.e. from besieged folks who do all the work and face growing workloads during a pandemic


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts