EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

04.21.09

FBI, CIPAV, and the Windows Back Doors Revisited

Posted in Microsoft, Security, Windows at 6:30 am by Dr. Roy Schestowitz

Looking through the tube

Summary: How (and why) the American secret services rely on Windows

THE back doors in Microsoft Windows are a serious issue that we've already covered, so there is no point doing it again. Adding to what we already know, there is now this report from Wired Magazine and another from IDG:

CIPAV spyware helped nab unemployed engineer angry over outsourcing

There is also a discussion at Slashdot and one reader of ours wrote: “A good question to ask is, what is it about Windows that allows CIPAV to be so easily activated? Does it even require visiting a contaminated Web site (see the Slashdot article)? What is it in Windows that allows such features?” Here is some relevant information which this reader sent to us:

CIPAV, which stands for “Computer and Internet Protocol Address Verifier,” is secret surveillance software that the FBI used last month to help identify whoever was e-mailing bomb threats almost daily to a Washington high school.

[...]

The only clue in the affidavit is that the CIPAV would operate as a pen register for up to 60 days after the software had been “activated” by the recipient. In other words, the FBI swore that the monitor would “time out” after 60 days. But not that it would delete itself or not be able to spread in some worm or bot fashion.

This post neither defense nor criticism of malicious and dangerous behaviour that the FBI is rightly intercepting. It is merely recognition of the operation of Microsoft Windows.

It is not news that the FBI uses Windows viruses (there were several articles about it last year) and the DHS, which recently recruited Microsoft after pressure from the BSA, is now recruiting hackers.
________
[1] FBI remotely installs spyware to trace bomb threat

While there’s been plenty of speculation about how the FBI might deliver spyware electronically, this case appears to be the first to reveal how the technique is used in practice. The FBI did confirm in 2001 that it was working on a virus called Magic Lantern but hasn’t said much about it since.    

[2] FBI ducks questions about its remotely installed spyware

There are plenty of unanswered questions about the FBI spyware that, as we reported earlier this week, can be delivered over the Internet and implanted in a suspect’s computer remotely.

[3] FBI to Notify Microsoft Windows Users Who Were Victims of Botnets

The Department of Justice and FBI have announced the results of an ongoing cyber crime initiative to disrupt and dismantle “botherders” and elevate the public’s cyber security awareness of botnets.

[4] FBI: Operation Bot Roast finds over 1 million botnet victims

The Department of Justice and FBI Wednesday said ongoing investigations have identified more than 1 million botnet crime victims.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

4 Comments

  1. The Mad Hatter said,

    April 21, 2009 at 11:03 am

    Gravatar

    Based on what I’ve read, you are regarded as a probable threat if you run an OS or Web Browser that CIPAV cannot infect. The reasoning seems to be that if you have made the choice to run Linux/OSX or use Firefox/Opera on Windows instead of Internet Exploder, you must have something to hide.

    No, I don’t have details or a link, I remember reading this a while back somewhere, and now can’t remember where.

  2. Roy Schestowitz said,

    April 21, 2009 at 11:14 am

    Gravatar

    There’s this recent incident.

  3. Yggdrasil said,

    April 21, 2009 at 7:30 pm

    Gravatar

    You are misleading people, again. You should have cited this from the Computer World article:

    “Some user action was CLEARLY REQUIRED to infect the PC with the CIPAV. In the warrant application, the FBI used the term activate several times and alluded to a spyware plant failure if the target did not trigger the CIPAV through the targeted MySpace account. MySpace accounts can’t receive traditional e-mail, so one hacker standard — attach the CIPAV to a message and hope the recipient is stupid enough to launch it — wasn’t available”

    Exactly. If you want to infect a Linux users, it’s as simple as sending them some program and getting them to run it. You also mention Slashdot, but of course, you only mention comments that would be critical of Microsoft. How about these comments instead? Both of which received high rankings.

    “What makes you think they don’t have a variant for Linux? User stupidity (i.e: bad/no security) isn’t unique to Windows. Off the top of my head, if they are relying on the web as an infection vector combined with user stupidity, why not write it into a Firefox extension?

    Yeah, it wouldn’t get your typical /. geek, but most criminals aren’t known for their foresight or intelligence. “Oh, the private website with the bank account information needs me to install this software! Ok, what could possibly go wrong?”

    In response to that:

    “This is an excellent statement. Stupidity knows no bounds. Its also dangerous to assume that the FBI doesn’t know what it is doing. When I worked in law enforcement, the FBI computer crimes agents I knew were well versed in operating systems other than Windows. The two I worked with most often had a solid knowledge of Linux and Cisco IOS.”

  4. Brian Assaf said,

    April 23, 2009 at 7:53 pm

    Gravatar

    “If you want to infect a Linux users, it’s as simple as sending them some program and getting them to run it.”

    Um. That easy huh? By default files aren’t executable, so it would require changing the permission. It would also need to be run as root to infect the whole system. How about dependencies? How about architecture differences. Just x86 or 64-bits? MIPS? Arm?
    So on and so forth. Linux isn’t a monoculture (no pun intended here guys/gals!) like the Windows ecosystem is.

    Even a pre-packaged deb (which can be installed ala double click in Ubuntu) would ask for a password, and again, wouldn’t be viable for every Linux distribution out there, architecture not withstanding.

    Having to run something out of the blue is odd if you use a package management system. Cryptographically signed, easily installed/uninstalled and updated (and source available for those interested.)

    Although maybe I’m alone in the 24,000+ packages available in Ubuntu being enough for regular computer use.

    My point here is I’ve unlearned a habit, there is no need to grab software willy nilly off the net. Instead check the repos, and check the source of software. Do you trust it, etc and why should I install this. Plus does it behave like a rootkit, if so then it can be scanned for, if this really does become some sort of popular vector…

    So, yes, you could use social engineering to get someone to install something, but the process should set off a red flag in the user.
    There isn’t some autorun or double click deal here. For those users that understand binaries are a blackbox, where no one can inspect, change, etc. anything, install at your own risk.

What Else is New


  1. Microsoft Loves Linux to Death and Still Tries to Kill GNU/Linux

    Microsoft's relentless attacks on GNU/Linux and Free software in general (even if it runs on Windows) are so evident that claims of 'love' remain laughable at best (if not infuriating)



  2. Censorship, Self-Censorship and Intimidation Now the Modus Operandi at EPO

    The European Patent Office has ceased even trying to pretend that it respects human rights, including the right to free speech



  3. Patent Practitioners: "The Unitary Patent Might be Able to Open the Floodgates for Software Patents in Europe"

    The EPO-backed Unitary Patent scheme threatens to bring software patents to Europe and along with them a lot of patent trolls from all around the world (especially the United States)



  4. Microsoft Lies About Vista 10 and Increases Microsoft Surveillance (Even Beyond Vista 10 and Into Android, Vista 7/8)

    Windows surveillance expands retroactively, making its way into platforms other than Windows and also expanding to predecessors of Vista 10



  5. Another Suicide at the EPO, Fifth by Our Count

    Yet another EPO member of staff has just committed suicide, leading to the inevitable question: how many people need to die before Battistelli and his minions are out of the Office for good?



  6. Links 27/8/2015: ownCloud Desktop Client 2.0, Red Hat Downgraded

    Links for the day



  7. Microsoft-connected Mesosphere Threatens to Eliminate Free Software in the Datacentre

    Hiding behind a misleading 'open' label while actually backed by Microsoft (and based on new rumours may join Microsoft), Mesosphere wishes to eradicate Free and back doors-free software in large datacentres hosting a lot of physical and virtual servers



  8. Microsoft Aggression Against GNU/Linux Amid Vista 10's Failure

    A look at the recent assault on GNU/Linux in Munich and the likely cause for this assault (in such a timely fashion, too)



  9. Message to LinuxCon Regarding Microsoft: “It is Necessary to Get Behind Someone in Order to Stab Them in the Back.” -Sir Humphrey Appleby

    Jim Zemlin, executive director of the Linux Foundation, helps Microsoft gain influence in the Foundation after payments are received



  10. Market Share Estimates Confirm That Vista 10 Failed in a Major Way

    Confirmatory evidence that Vista 10 is failing in the market about a month after its much-hyped (paid coverage) release



  11. When Microsoft, the Master of Patent Trolls, Complains About Trolls

    Possibly the world's biggest patent abuser and monopolist, which also creates many patent trolls (including by far the biggest one), takes on a far smaller abuser in Court



  12. Letter Signed by Two German Officials Becomes a Microsoft Weapon of Propaganda

    Microsoft and its minions refuse to leave Munich alone, even though the vast majority in Munich are perfectly happy with Free/libre software



  13. Links 25/8/2015: Linux Kernel 4.2 Final RC, KDE Ships Plasma 5.4.0

    Links for the day



  14. Sabine Pfeiler and Otto Seidl Should Take Note as Russia -- Like China -- is in the Process of Banning Microsoft Windows for Security Reasons

    A look at a strange suggestion, signed by Sabine Pfeiler and Otto Seidl, who suggest going back to Microsoft which is basically a spyware company now



  15. Microsoft Windows Leads to Espionage and Blackmail: Latest Examples

    Another news overview, detailing high-profile examples of high-cost Windows deployments (including the cost of litigation and settlement)



  16. Links 23/8/2015: BcacheFS Benchmarks, Blackphone 2

    Links for the day



  17. Links 22/8/2015: Chromebook Gains, GNOME 3.18 Clues

    Links for the day



  18. Alice v. CLS Bank (the Alice Case/§101) Continues to Crush Software Patents in the United States

    Patent scope in the United States continues to be narrowed down as more software patents get their wings clipped



  19. Company of Hype and 'Fanbois' Continues Its Patent Attacks on Android/Linux

    Apple's attacks on Android (using bogus patents) may be soon be escalated to the US Supreme Court (SCOTUS)



  20. EPO Corruption of Patent Boundaries: Business Methods and Algorithms Patented

    How the European Patent Office (EPO) not only turns a blind eye to European law while patenting or granting patents on software but also openly advocates this now



  21. Who's Obsessing Over Patent Trolls in Latest 'Reform' Efforts? Larger Patent Trolls Such as Xerox

    Response to claims that the patent problem is being tackled by focusing on patent trolls and their favourite courts in the Eastern District of Texas



  22. Links 20/8/2015: Fedora 24 Plans, Ubuntu Phones in India

    Links for the day



  23. Blackmail and Lies From the Press and the Government of New Zealand Attempt to Sell to the Public a Deal That Broadens Patent Scope

    Corporate conquest or takeover of New Zealand culminates in empty promises from government officials and blackmail against citizens of New Zealand, especially the country's dairy industry



  24. Vista 10 Turns PCs Into Zombies: Microsoft to Remotely Delete Software From Windows, Like Amazon Deleted Books From Kindle

    Microsoft allows itself to remotely delete software from Vista 10 (not just Microsoft's software), as revealed by the mainstream media not too long after the failed launch (poor adoption so far)



  25. Black Duck Still Destroying, Lying, Rewriting History

    Black Duck is still carrying water for Microsoft and pretends to be working for 'Open Source', despite doing it much harm and doing nothing that is actually Open Source



  26. Ashley Madison Disaster Apparently the Fault of Microsoft Windows

    New reports serve to show that Ashley Madison's data which got leaked includes complete dump of corporate Windows passwords



  27. After OOXML Propaganda, New Assocham Propaganda Calls for Back Doors, Spyware and Other Malicious, Self-defeating Traps Inside Government of India

    Assocham is showing its true colours yet again, lobbying for the interests of foreign companies and endorsing serious abuse or compromise of India's national sovereignty



  28. Links 19/8/2015: LinuxCon Everywhere

    Links for the day



  29. Links 18/8/2015: Linux 4.2 RC7, IBM's LinuxOne

    Links for the day



  30. Patents Roundup: Patent Reform, Google's 'Startups' Ploy, JDate, Fitbit, Cisco, and UPC in the UK

    A collection of news stories about patents, accumulated over the past week or so


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts