Slashdot Log In
Symantec Will Not Detect Magic Lantern
Posted by
timothy
on Wed Nov 28, 2001 12:37 PM
from the et-tu-eric dept.
from the et-tu-eric dept.
An anonymous reader contributes: "In this article on Declan McCullagh's Politech, Symantec chief researcher Eric Chien stated that provided a hypothetical keystroke logging tool was used only by the FBI, Symantec would avoid updating its antivirus tools to detect such a Trojan, echoing a similar stance Network Associates allegedly took with its McAfee anti-virus software earlier this week. 'If it was under the control of the FBI, with appropriate technical safeguards in place to prevent possible misuse, and nobody else used it -- we wouldn't detect it,' said Chien. 'However we would detect modified versions that might be used by hackers.'"
Related Stories
[+]
Will Security Firms Detect Police Spyware? 269 comments
cnet-declan writes "A recent appeals court case dealt with Drug Enforcement Administration agents using a key logger to investigate a suspect using PGP and Hushmail. That invites the obvious question: Will security companies ever intentionally overlook police spyware? There were somewhat-muddled reports in 2001 that Symantec and McAfee would do just that, so over at News.com we figured we'd do a survey of the top 13 security firms. We asked them if it is their policy to detect policeware. Notably, Check Point said it would 'afford law enforcement' the courtesy of whitelisting if requested. We've also posted the full results, with the companies' complete answers. Another question we asked is if they have ever received a court order requiring them to overlook police key loggers or spyware. Symantec, IBM, Kaspersky, and others said no. Only Microsoft and McAfee refused to answer."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
No need to use Norton AV... (Score:3, Insightful)
Re:No need to use Norton AV... (Score:4, Insightful)
Your OS is certainly more esoteric, but it has holes like all the rest of them do. Your immunity thus far isn't an indication that there are no holes -- there are always holes -- but that the *nix enviroment hasn't yet been able to cultivate & propagate any really serious viruses yet.
One of two thing is likely to happen: Linux's popularity will crest & wane, and people will stop using it (unlikely, I hope :), or it will continue to get more popular, and as it does so it will provide an ever more appealing target for virus writers, licking their chops at all the complacency out there....
Parent
Re:No need to use Norton AV... (Score:3, Insightful)
Re:No need to use Norton AV... (Score:5, Insightful)
Mac OSX is becoming an interesting case study in Unix For The Masses. Default Linux is, as the Register recently noted, [from memory, can't find a link] "a paragon of Stalinistic control freakery", and that has made it more secure out of the box than the average WinME box, but more importantly it has also scared off millions, and rightly so. Apple's engineers knew well that if they wanted to bring this architecture to the masses -- the way the Gnome & KDE folks do -- then they'd have to encapsulate & hide as much of that control freakery as possible.
And for the most part they've done a good job, but there have been some serious glitches, like programs that would launch themselves as root, or a broken iTunes installer that wiped out whole disk partitions because of one mistyped "rm" command in an installer script. Pay attention, you seething Linux hordes, because if you want to hit the big time then this is your future. You too will face these problems as the system matures & seeks out a wider audience.
The only "secure" system is either (pick your punch line) the one that hasn't been built yet, or the one you bought a decade ago and still haven't plugged in yet. All of the others -- all of them -- have problems of one kind or another, and all of them always well. Welcome to real life, kids.
Parent
Re:No need to use Norton AV... (Score:3, Insightful)
You know what the difference is between Linux and Mac OSX? Linux is written by control freaks. Fortunately, the fine folks who are working on the various parts of the Linux system differ from your average Slashdot sheep in that they care more about system security and less about "widespread Linux adoption". That's why you will never see such a thing as "insecure Linux".
Yes, it's possible that Linux companies will eventually start putting out windows-ified Linux distros that will sacrifice security for ease of use to make it more appealing to the unwashed masses, but so what? Viruses work so well in Windows territory because there's Only One Windows, and everything works exactly the same on millions of computers. Look at all the different Linux distros from a virus writer's perspective and ask yourself if you could really write an effective virus and expect it to work the same on all of them. My answer is no. Not with the huge diversity of libraries and programs and kernel versions out there. What's a virus writer to do? Spread the virus as source file and ask the user to type ./configure? I guess you could do that, but you'd be the laughing stock of the virus writers' community, if there is such a thing.
And if you're going to suggest that Linux will eventually standardize and everybody will use the same distro (or all distros will be functionally identical), and all the programs and libraries will reach stable versions updated only once every six months in service packs, then you obviously have no idea what you're talking about, which is what I would half expect from someone who says things like "welcome to real life, kids".
Re:No need to use Norton AV... (Score:5, Informative)
Don't be so sure. We have had UNIX worms and even VMS worms. Unlike the designers of UNIX, VMS started with a security architecture and actually recieved B2 certification rather than describing itself as 'B2 equivalent'.
At the other end of the scale the security architecture of MAC O/S has until a few months ago been stuck at the MSDOS level, lacking even protected memory, yet MAC viruses are none too common these days.
The significant factor is the proportion of the network population that uses a particular O/S. As with a biological infection there are definite inflection points that determine whether a virus spreads fast enough to cause an epidemic or a pandemic.
When the Wang Worm hit it could propagate because close to 100% of the computers on HEPNET were VMS systems. Equally the Moriss worm took out the Internet when the vast majority of nodes were UNIX boxes running sendmail.
The proportion of UNIX machines on the Internet today is probably close to critical mass for allowing a viral epidemic. The saving factor is not the design of the O/S, it is the variation between the O/S implementations. Anyone who thinks that sendmail is a lesser security risk than Outlook should read a few CERT advisories.
The separation of administrative privs is not actually significant when it comes to the propagation of email viruses. If that was the case Windows XP would solve the virus problem completely (it won't). The problem is that the boundary between code and data has been blurred. For some reason the people who felt they had to foist Java and Javascript winky-blinky features on the world had no clue when it came to security. (Don't get me started about the Java sandbox model, the code does not match the marketing hype, the implementation does not correspond to what I would regard as a sandbox design)
The other reason that UNIX boxes tend to be more secure is that the use of winky-blinky features is nowehere near as widespread. The proportion of terminally clueless users in the Windows world is (acording to my studies) approximately 92.931%, in the Linux world that figure is only 23.428%. So not only is the userbase smaller, the propability that a user sent the virus will execute the program and cause it to replicate is much smaller.
Again, look at biological models of propagation. x^n is a very big number if x > 1, it is a very small number if x Therefore the day that AOL ships AOL for Linux will be the day that Linux will start to get virus problems. It will have the active code to support winky-blinky features and thus be vulnerable to attack, it will introduce the terminally clueless into the Linux user base.
Parent
Not likely at all. (Score:3, Insightful)
1) most people don't read their email while logged in as root. This is the number 1 reason why viruses easily spread in Windows systems is because in Windows, just about everything is done with an account that has full control over the system.
2) In Windows-land you generally run binary-only programs and you have no idea what the source looks like. Most programs in Linux come with the source code. You are not likely to run a binary only program in Linux unless you know for sure who its coming from.
So, to reiterate, viruses are executable programs. They need both permission to execute and a means of spreading themselves. Windows systems were already set up to allow these things to happen by default. Linux systems will never be set up that way, at least not on a widespread basis.
I don't think we will ever see problems as widespread and damaging such as Nimda or Sircam on Linux systems, no matter how popular Linux gets. Its just not designed to easily allow programs to be run, without someone explicity giving it permission. Even exploits of commonly used server programs are limited in the damage they can do, because most servers do not run as root. No, the virus writer has a much much harder job to do on Unix systems. Why bother when Windows is so much easier?
Uh, the answer is simple... (Score:4, Insightful)
Anyway, I don't use Windows, so this is not my problem. Ask yourself; is it really yours? :-)
Re:Uh, the answer is simple... (Score:5, Insightful)
Here's why it IS your problem. If you think the FBI is going to limit their spying to Windows, you are pretty naive. Count on one of the following:
They will find a way to make it work in every consumer OS.
They will find some other way to acheive the same thing with other OSs.
They will outlaw the use of an OS that can be used to evade law enforcement.
Parent
Re:Uh, the answer is simple... (Score:5, Insightful)
All that is happening here is that
Sometimes I honestly feel pity for Americans!
Parent
Re:Uh, the answer is simple... (Score:3, Insightful)
I don't think it is useful to assume that you are safe because you are using Ye Sacred Linux. If a Linux version of the trojan were written, it could be installed in 3 ways (that I can see):
But you're still right with most of your point. It's not my problem (because I don't live in USA) and it's not your problem (because you have not done anything to attract the attentions of the CIA/FBI/NSA/FDA/TLA have you)
I really don't think they'll install it without cause - and even if they did, who's going to monitor keystrokes on every computer in America?
Oh, for the stupidity example, I'm assuming that Magic Lantern wouldn't be sent to Linux users as source...
Actually, it's even simpler... (Score:5, Interesting)
Such an arrangement would be next to impossible to compromise, as you would need to break all three programs within the check cycle of all three of them. Either that, or you need to break all three hashing algorithms, in such a way as to find a synonym in all three key spaces. Synonyms in a single key space are going to be common, simply because you're using fewer bits. Two coinciding synonyms will be very rare, and there's no guarantee that the software could be moulded into one. THREE coinciding synonyms will be so vanishingly rare that it wouldn't be worth anyone's while to search for one that's even remotely usable.
There. Problem solved. And all it took was a bunch of Tripwire clones. And someone thought it was difficult?
Parent
Re:Actually, it's even simpler... (Score:5, Informative)
These utilities, when used together, would offer a defence, using a slightly different technique. Here, you'd be warned, the moment any intruder attempts to connect to your machine, OR your machine mysteriously attempts to connect to someone else. You also get the warning on when a file is changed.
(By relying on only one verifier, you're not quite so secure, but it was the best I could find in a short time. Apologies for that.)
Parent
Are you sure? (Score:3, Flamebait)
McAfee Ignoring Magic Lantern Is Bogus?
Nice ... (Score:2, Interesting)
Open Source Solution? (Score:4, Interesting)
Silly to the extreme (Score:5, Insightful)
But it isn't the idea of the FBI trying to use these tools that offends me. I expect them too, and I don't have anything to hide. But the issue of a company that I pay money for to help protect me to turn a blind eye to government intrusion is insane.
If I pay someone to give me security, I expect them to provide it against anyone who wants my information. Pure and simple. And I'm not worried about the "Oh, we won't check the FBI's version - but we would check variants."
Oh, that makes me feel *much* better. Imagine a cracker getting his fingers on the FBI software and using that on my systems. Gee, thanks for not checking that, Symantec.
Of course, you have to admit that Symantec and McAfee are in a bind. If they state they're going to detect the FBI software, then they're anti-government. If they don't, then they're aiding big brother. But considering that the United States was formed from a healthy distrust of our government (and that distrust has only proved to help us, thank you Hubert Hoover and your bra collection), I would rather have the security companies on my side and make my government work just a little harder to prove guilt. Or at least, that's what my tax dollars should be going to.
Of course, this is just my opinion. I could be wrong.
Re:Silly to the extreme (Score:3, Interesting)
Your free to live in the USA as long as you have the same morals, if you don't its off to prison with you. Over a million people are in prison in the US for minor drug related charges, Over 2 million are on parole for minor drug offenses as "Position of marijuana"
The moral majority in the US has passed laws to keep freedoms from you. They empower the jacked boot thugs to take everything you own, lock you away, and forget about your speedy trial. They can ruin your life, walk away and say "All in a days work, protecting the innocent..."
Crime is murder, rape, arson, robbery, identify theft, violence and abuse...
NOT backing up software, fair use, recording a tv show, downloading an mp3, having sex, smoking, erotica, fiction writing, speaking against the government, abortion and sexual orientation...
At least they cant put me in prison for detecting a trojan, right?
-
The law, in its majestic equality, forbids the rich as well as the poor to sleep under bridges, to beg in the streets, and to steal bread. - Anatole France (1844 - 1924)
Re:Silly to the extreme (Score:4, Insightful)
I have a better conspiracy theroy though
Parent
Re:Silly to the extreme (Score:3, Insightful)
So if you hire private security guards to protect your house, do you expect them to forcibly keep out the FBI even if they don't have a warrant?
These companies are ignoring the FBI trojan altogether. They aren't requiring a warrant to ignore it.
Re:Silly to the extreme (Score:5, Insightful)
This analogy doesn't work because if the FBI presents a warrant I already know they're searching my house.
A more accurate analogy might be: What do you expect your security guards to do if they find out that your house is bugged? Should they not tell just because the bugs carry "FBI" labels?
Parent
huh? (Score:5, Insightful)
What about Norton Firewall? Will it still detect unexpected outgoing connections? How can I expect it to reliably detect and permit FBI-approved software, but not hacker software with a similar MO?
Oh, maybe there'll be a hard-coded IP address in the outgoing connection -- now THERE'S a nice target for DDOS!
Great - It's a three way race (Score:4, Interesting)
Eventually, I'm gonna need a scorecard to keep all this striaght.
I can hardly wait (Score:5, Insightful)
Malda might as well start composing (and spellchecking) the headline now, because it's a sure bet he'll get to use it.
Ten minutes, tops. (Score:5, Funny)
Keep "Magic Lantern" out of the hands of criminals.
How does "Magic Lantern" work?
The FBI sends it to criminals.
Parent
Savvy (Score:5, Interesting)
Parent
Re: a/v software (Score:5, Insightful)
The FBI? Do anything illegal? Who would ever imagine that such a thing could happen?
<repressed_memory>
</repressed_memory>
Hmmm, I can't seem to think of any examples of how police spy powers have been abused in the past, can you?
Re: a/v software (Score:3, Insightful)
COINTELPRO [icdc.com]
And this time we're GIVING the government this power by agreeing to be spoon-fed this 'for our own good' and 'war on terrorism' bullshit.
I say no thank you. If there was a tracking device installed subcutaneously on every single American citizen in the country, and our borders were closed, THEN would you people feel safe?
Reverse engineers line up here - (Score:4, Interesting)
Well, if the antivirus vendors are going to include a sufficiently detailed signature in their products for the FBI's virii, that should help anyone trying to build a detector.
I'm sure somebody will try to build malware that impersonates this so-called "Magic Lantern" - I hope they call it "Magic Latrine" :^).
But wouldn't it be nice to see a GPL'd program to detect the FBI's virus? Then, if I found it on my machine, I could stop the goverment-sponsored theft of my CPU cycles. Of course, I'd then call the FBI and offer to let them reinstall it given adequate monetary compensation - but that's just me, you might take some other action.
--Charlie
J. Edgar Hoover lives on... (Score:4, Interesting)
If government seeks to use clandestine and furtive methods to monitor citizen actions, it can ill afford to complain should the citizen insist on a method to effect his right to know he is under such surveillance.
Judge Joseph Ryan, Superior Court, District of Columbia
Granted, its only a district court, however it is a compelling opinion, and a brilliant interpretation of the Fourth Amendment. IR detection/imaging and monitoring utility bills have been tossed out on similar grounds. I wonder what AVP is going to choose... Perhaps this is a great opportunity for Free Software, I just wonder how a free software anti-virus lab would work. Anyway, end of my rant.
Its a non-problem (Score:3, Insightful)
I just wonder how a free software anti-virus lab would work
Easy- we fix the problem instead of treating the symptoms:
If there are exploits, they get fixed. So you would never have to worry about an email or webpage hijacking your machine.
And so long as you stick to source-available code (not necessarily the same as open-source) which has at least a moderate distribution, you dont have to worry about trojans.
The run-away virus problems you see in windows are a direct result of a closed source culture where all software is delivered and exchanged via inscrutable black-box binaries. A typical windows user thinks nothing of downloading a .exe file from an untrusted source then running it, whereas a typical unix user would get shivers just at the thought of doing so.
Virus scanner software is just a huge patchwork of duct tape that is fundamentally incapable of solving any problem- or providing any security.
(for example nimda: it had already done its damage by the time it was in the pattern files)
If an open-source system and philosophy were ta take hold of the desktop- an entire industry (virus scanning/recovery) would simply disappear.
Re:J. Edgar Hoover lives on... (Score:3, Interesting)
- they're trying to retain the confidence of the middle-american software purchaser (both private and commercial) that would revolt* against them as "un-american" if they obstructed anything the FBI proposed.
- they'd probably face some sort of frivolous or trumped up charge of aiding terrorism or maybe even sedition if they'd announced plans to detect magic lantern. not that such a charge would stick (on appeal).
[*]said middle-american probably doesn't understand the security implications of permitting a class of trojan software to do its work (not that i do, but i acknowledge it has the potential to be quite a problem). said middle-american would also dismiss the raising of any privacy or civil rights concerns with a hearty "NONE OF THAT MATTERS ANY MORE! WE'RE AT WAR NOW!" and probably a "don't bring any of that unamerican talk into my $location" or a "the FBI is on our side, they wouldn't do anything to hurt us." for good measure.Re:J. Edgar Hoover lives on... (Score:3, Interesting)
The CEO of symantec get's labled as a terrorist by Ashcroft.
He can now be detained infinately without charges. His confinement is not public nor are his charges (if any).
Life without parole without a trial or charges being filed. If he happens to be non citizen he can be tried by a military tribunal (AKA kangaroo court) and be sentenced to death.
Would you react any differently?
just say no (Score:5, Insightful)
If US software companies want to sell crippleware in the interests of "patriotism" that's their business. There are plenty of companies willing to fill the gap.
What about KGB/Mossad/MI6 trojans? (Score:4, Funny)
Stance of non-us companies? (Score:4, Interesting)
possible detection still exists (Score:4, Informative)
also, what about personal firewall programs? I use a Tiny Software's PF (yes, under Windows, sad isnt it) that checks the md5 of an executable before granting internet access. on top of that, it can allow you to block certain apps from making/accepting connections from various sites. for example I have it set to not allow Mozilla access to ads.x10.com.
Here, two things exist: the lantern has to find a way around the md5 and also find a way around "PGP wants to connect to [fbi-ip-address], allow it?" Getting through one or the other might prove difficult.
international terrorist: fbi (Score:5, Insightful)
... then again, there is Echelon [echelonwatch.org].... apparently no one minds...
The funny part... (Score:4, Interesting)
Are they writing this "virus" for BeOS? how about OS/2?
What about a linux box running as only old a.out?
I can think of at least 70 ways to make their "virus" not work on my machine. (I highly doubt that this "virus" will run on my Linux development box that uses a Hitachi SH4 processor)
all this hubub about company X or software Z will or will not detect this virus app is pure marketing and hype. Noone who is really threatened by this could care as it is easily defeated from ever infecting the system by simply changing the archetecture...... Hey FBI, not everyone runs windows on Intel hardware.
Hmm... (Score:3, Funny)
Who needs 3rd party software? (Score:3, Insightful)
Someone help me figure this one out..? (Score:3, Insightful)
First off:
Everyone keeps talking about how it will just be a matter of time before a wild version of "green lantern" or something of the sort shows up in the wild....
Dude, if you have Green Lantern on your computer and you find out about it, you've got a lot more things to worry about then sharing it with the hacker / cracker community!
Second of all:
Who cares that the anti-virus software won't recognize it. They haven't detected half the viruses for years!
Heck, Just create your basic client server in c++ or whatever and you'll notice that it is not recognized by the software anyways..... I started to learn sockets and create client/server chats, remote access for work, etc. My anti-virus, anti-trojan software never picked up on it... only my Zone Alarm caught it.
Not these company's job anyway (Score:5, Insightful)
If the FBI is doing their job well, that's not the situation here. The way they've been describing this working is that they set it up to attack the particular person against whom they've obtained a warrent. It doesn't email itself to the target's addressbook, it doesn't attack random IPs, it doesn't try to infect floppies. That would be both illegal (since it could destroy the data of non-targets) and probably invalidate their evidence (since they don't have a warrent to investigate every individual in the US).
So a virus scanner shouldn't catch Magic Lantern, because it's not really a virus, in the sense that they're scanning for. It's an attack tool, which uses the methods often employed by viruses. Virus scanners don't fix security holes; they look for particular malicious and spreading code on your computer and clean it up. They won't stop Magic Lantern, they won't stop someone hijacking your passport account, and they won't stop even script kiddies breaking into your webserver, because their purpose and system design just aren't good for that.
So far I haven't heard of any IDS companies saying they will ignore ML, nor have I heard of any companies saying they won't fix security holes that ML uses. That's what would be significant.
What I don't get... (Score:3, Interesting)
There would be no issue at all here if this program was something that had to be manually installed. If the FBI got a warrant to enter a suspect's home, install a 'tap' on his PC, and then retrieve the data, there would be no issue.
Any criminal savvy enough to detect that sort of intrusion is also savvy enough to detect and subvert Magic Lantern. Hell, if I had something to hide, I'd keep it away from the networks, on an encrypted drive, wired to destroy the data if I failed to log in correctly - and I am NOT a criminal mastermind.
All ML does, by being a Trojan, is get non-criminal technologists pissed off over civil rights and such.
Sure, it may make the 'tap' easier to set up remotely (does it really? only with very ignorant criminals I think) and to pull data off as it's being generated, so that a logfile can't be easily found (but anyone with something to hide is likely to be sniffing their own packets anyway, no?).
There's something else going on here. It could be about testing the waters for industry compliance to Federal backdoors (PGP anyone?). It could be to increase the anxiety level of technologically inept/newbie potential terrorists.
The publicity level of this strikes me as a diversionary tactic, because the technological aspects of ML are surely defeatable (we can look at our own packets down to the bit after all) and the audacity of it (Big Brother factor) is sure to kill it.. The next step is to have each cell phone sold with a listening device that the FBI could turn on remotely. Even the technologically ignorant would not stand up for that, or for this.
Could Magic Lantern be buit into Windows XP (Score:5, Insightful)
Re:Could Magic Lantern be buit into Windows XP (Score:5, Informative)
'Hadn't thought of that option before. Of course, I will now. Probably not get any sleep for a few days, too.
Parent
Re:Could Magic Lantern be buit into Windows XP (Score:3, Informative)
Not true. I think one of the earlier posts about ML indicated that one mode of its operation allowed it to simply record keystrokes locally (hidden away in an OS registry or a "special" file of some sort, if we're talking about a closed-source implementation) and those recordings could then be recovered physically upon serving a warrant on the user.
Of course, the paranoid among us would do their best to determine where those recordings get kept and utilities would no doubt be written to clear or obfuscate those recordings. But my point is that the feds don't necessarily need it to generate any network traffic for ML to be a useful tool.
Re:Some need to clue in (Score:3, Insightful)
Your analogy is, unfortunately, incomplete. Let's review:
In such a case, the following is expected to happen:
Now, in the case of Magic Lantern, the following *might* happen:
So, what's missing here? Simply enough, the agents did not have the consent of the court to infect your computer, and you've been deprived of the knowledge of what occured. This is the major issue here. I wouldn't want them poking inside my computers as much as the next guy, but if they're going to, I'd like to know when they're doing it, and they better have that bloody warrant in hand.
Re:Some need to clue in (Score:5, Interesting)
Government agencies have no reason to "crack" a system, if they're really interested they can get a search warrent and examine the system. The search and ceasure laws were designed to put all government investigative action in public view. Secret searches cannot be justified. If there is no good way to get the passwords for the keys, then the government is SOL. So they don't have one piece of evidence, I hope that the evidence that they do have would be more than just bits on a hard drive.
Parent
Would they pay... (Score:3, Funny)
...if anyone sent them a bill for the CPU usage?
I'd sure love to hear of a defense lawyer bringing that up the FBI's theft of electricity in court.