FBI Remotely Installs Spyware to Trace Bomb Threat

cnet-declan writes "There have been rumors for years about the FBI remotely installing spyware via e-mail or by exploiting an operating system vulnerability from afar — and now there's confirmation. Last month, the FBI obtained a federal court order to remotely install spyware called CIPAV (Computer and Internet Protocol Address Verifier) to find out who was behind a MySpace account linked to bomb threats sent to a high school near Olympia, Wash. News.com has posted a PDF of the FBI affidavit, which makes for interesting reading, and a summary of the CIPAV results that the FBI submitted to a magistrate judge. It seems as though CIPAV was installed via e-mail, as an article back in 2004 hinted was the case. In addition to reporting the computer's IP address, MAC address, and registry information, it also gave the FBI updates on which IP addresses the user(s) visited. But how did the FBI get the spyware activated and past anti-virus defenses? Two obvious ways are for the Feds to find and exploit their own operating system backdoors, or to compromise security vendors..."

the answer is simple

They use both.

Re:the answer is simple

Neither. In the current security climate most security vendors will bend over straight away and turn a blind eye on an "authorised" Troyan. In fact at least one of the US ones is known to have done so and that was leaked to the press around 2004 (sorry forgot which one). Even further, I would not be surprised if some of them go as far as "facilitating" its installation.

Re:the answer is simple

But what if you (as any sensible person would do) simply block anything that is executable from being received via mail?

Re:the answer is simple

Even then, the Acrobat process would need write-access to system files. On a decently managed system, it hasn't.

From the summary:
A MySpace account linked to bomb threats sent to a high school.

Chances of this system being secure, updated, well-managed? 0
Chances of this system being a Gateway laptop that takes 10 minutes to boot, loads 5 IM apps on startup, has 4 different IE toolbars, and constantly warns that the Norton Antivirus subscription lapsed 16 months ago? Our survey says yes!

How long will it be before ...

... FBI (and some if-it-will-save-one-child-it-is-worth-it legislators) demand all the OS vendors to install backdoors so that it can come in and install whatever spyware it wants to be installed?

Re:How long will it be before ...

First they came for the library records, you did not care because you cant read

Then they came for net access records, you did not care because you don't need privacy there ...

Someday they will come for you, and there will be no one left to care

They did have a warrant.

The warrant isn't really the point.

The warrant isn't really the point. The point is that they have the tech to get past firewalls and antivirus software, and can plant spyware on your machine. This time it was legal, because the FBI got the warrant. But what about the CIA/NSA/RIAA using the same tech to spy on you? Some government agencies don't need warrants.

Re:The warrant isn't really the point.

The bigger problem isn't only Government bodies or even the RIAA (who would have to disclose their methods of evidence collection as a means of validating the evidence). If they can do it, ultimately anyone can do it.

There is no magic at play here. If it's a secret, someone can learn it. If it's a method, someone can learn it. If it can be done by one, it can be done by all and whether or not you trust your government or your legal system is almost irrelevant to the larger point. If there exists that serious of a chink in your armor, SOMEONE will exploit it and it may not always be for the right reasons or by the right people.

Re:How long will it be before ...

And now, they don't even want to bother with that formality.

I'm kind of new here

But posts like this really irk me.

What exactly do you want?They got a warrant. Isn't that kind of oversight what we want? I don't understand why you think making a comparison to the Gestapo (and did they really have warrants?) adds a single thing to the conversation.

Please tell me what your solution is, so I can put your comment in some kind of context. I've seen it and its like from several other posters, but not a single one of them goes on to make a coherent argument after making it, and neither did you.

The FBI has a job, in this case it seems a job that we'd all like them to be proficient at, that of preventing bombings. They pursued evidence through the correct channels, got a warrant, set up an operation, and did their jobs. In light of that, doesn't the "Gestapo" comment seem a bit reactionary and irrational?

So what the hell is with the specious Gestapo comparison? Do you think someone's rights were violated somehow, or the FBI overstepped their authority, or what exactly? Or is it vogue here to toss out inflammatory comments for no reason other than to provoke a reaction? I thought that's what the "troll" mod was for?

Lastly, the Gestapo also pandered to the fears and insecurities of the populace, so I'd be careful throwing around such comparisons if I were you.

Re:How long will it be before ...

First they came for the library records, you did not care because you cant[1] read[2a]

Then they came for net access records, you did not care[3a] because you don't need privacy[3b] there[2b]

[1] First they came for the apostrophe Nazis, and I did not care because I know how to use apostrophes.
[2] Then they came for the end-of-sentence punctuation Nazis, and I did not care because I punctuate my sentences.
[3] Then they came for tense agreement Nazis, and I did not care because I know that 'do not need privacy' (even abbreviated as don't) is present tense while 'did not care' is past tense.

Then I realized that it matters not, because if someone can't read, they aren't going to care about net access records regardless of the privacy issues.

Re:How long will it be before ...

I only use my car for groceries. So why should I be against complete surveillance and GPS positioning of every single car? Hey, it doesn't affect me, ya know?

I only use my credit card to pay for my phone bill. So why should I be against complete surveillance of CC payments? Hey, it doesn't affect me, ya know?

I only...

Open letter reply to that kind of law

"Thank you. You just made hacking a whole lot easier."

The Germans already proposed something like that. It was retracted when they realized that it pretty much opens the door to any kind of espionage, and that this could quickly turn AGAINST them.

No backdoor is secure. Word will get out and it will be abused. Worse yet, if you force AV and firewall manufacturers to keep that hole unplugged, you open yourself and all the businesses in your country to industrial sabotage and espionage.

Think the feds are THAT stupid? Even if, do you think their lobbyists will allow them to?

Re:Open letter reply to that kind of law

Think the feds are THAT stupid?

Yes.

Re:Open letter reply to that kind of law

The Germans already proposed something like that. It was retracted when they realized that it pretty much opens the door to any kind of espionage, and that this could quickly turn AGAINST them.

Its already happened to Greece's wiretapping software. Someone broke into the main cell phone company and hacked the software installed for legal wire taps to listen in on government official's cell phone. They didn't notice it until they tried to upgrade the software and realized someone had been using it.

http://www.spectrum.ieee.org/jul07/5280/1 [ieee.org]

NSAKEY

Microsoft denied it, they said that the key's variable name being called "NSAKEY" was just an ... uh, you know ... coincidence.

http://en.wikipedia.org/wiki/NSAKEY [wikipedia.org] is a good primer.

It was covered extensively at the time by the likes of Bruce Schneier and others, his comments [schneier.com] said:

Suddenly there's a flurry of press activity because someone notices that the second key in Microsoft's Crypto API in Windows NT Service Pack 5 is called "NSAKEY" in the code. Ah ha! The NSA can sign crypto suites. They can use this ability to drop a Trojaned crypto suite into your computers. Or so the conspiracy theory goes.

I don't buy it.

First, if the NSA wanted to compromise Microsoft's Crypto API, it would be much easier to either 1) convince MS to tell them the secret key for MS's signature key, 2) get MS to sign an NSA-compromised module, or 3) install a module other than Crypto API to break the encryption (no other modules need signatures). It's always easier to break good encryption by attacking the random number generator than it is to brute-force the key.

Second, NSA doesn't need a key to compromise security in Windows. Programs like Back Orifice can do it without any keys. Attacking the Crypto API still requires that the victim run an executable (even a Word macro) on his computer. If you can convince a victim to run an untrusted macro, there are a zillion smarter ways to compromise security.

Third, why in the world would anyone call a secret NSA key "NSAKEY"? Lots of people have access to source code within Microsoft; a conspiracy like this would only be known by a few people. Anyone with a debugger could have found this "NSAKEY." If this is a covert mechanism, it's not very covert.

I think the jury is still out on exactly what was really going on; if it was an NSA backdoor, it was a pretty boneheaded one. Alternately, if it was just Microsoft being redundant, then it shows that they didn't plan very well and don't seem to understand security very well. Given the choice between the two, I think boneheadedness on MS's part is more likely.

NSAKEY

... FBI (and some if-it-will-save-one-child-it-is-worth-it legislators) demand all the OS vendors to install backdoors so that it can come in and install whatever spyware it wants to be installed?

Where have you been [wikipedia.org]?

User

But how did the FBI get the spyware activated and past anti-virus defenses? Two obvious ways are for the Feds to find and exploit their own operating system backdoors, or to compromise security vendors...

My guess is that nothing quite so sophisticated was necessary since the user downloaded and ran an unknown attachment from an email message

Occam's razor at work

We have: A teenager who used his computer to send bomb threats through myspace.

Assumption 1: He doesn't know jack about computer security like 99% of the users out there and simply clicks everything sent to him.

Assumption 2: The FBI keeps a hole open in Windows that only they know about.

Assumption 3: AV vendors are forced to keep holes open, as well as firewall vendors and everyone else who could technically find it.

Assumption 2 and 3 bear a heavy load. Assumption 2 implies that EVERY Windows OS can be remotely exploited. Now, it IS possible to reverse Windows. And since there are Windows emulators out there that can handle calls to functions most people don't even know exists, it's safe to assume that quite a few people already reversed some parts of Windows. A hole would have been found by now. More important, such a hole could easily be used against US companies when, say, China finds them and uses it to eavesdrop on confidential data. If such a hole existed, the first thing the FBI would do is make sure that no US company dealing with critical or sensitive information (nuclear, biological, you name it) uses Windows as their main operating system.

Thus I consider it rather unlikely.

Assumption 3 includes that every AV vendor on this planet knows about the hole/malware and keeps his mouth shut. Now, a good deal of such AV vendors sit in countries that are not the US, worse, some of those countries are economical competitors to the US. Think they'll keep silent? Or that they would include it into their software? Hardly likely.

I'd stay with assumption 1: He was careless, clicking on everything and running no AV kit.

Re:Occam's razor at work

Still, there has to be some kind of code providing for such a signed tool. And a branch that gets never accessed is something absolutely irresistable for every reverser, especially if it looks like something that could run code on privileged levels.

Hold it, hold it...

...where does it say that the guy even had any kind of AV software on his computer?

Heuristics and spyware

Two obvious ways are for the Feds to find and exploit their own operating system backdoors, or to compromise security vendors...

Would it even be necessary to compromise security vendors? While heuristics and malware detection has been something long promised, it is my understanding that the vast majority of security software works purely by comparing against their dictionary of known attacks. If the police have highly specialized, very limited deployment spyware, it seems that most security software wouldn't have any inkling that it's malware in the first place.

I have no doubt that organized crime and government agencies are aware of and abusing exploits. Given that they don't blast it to the world like a giddy teenager looking for attention, no one knows what to look for.

Why are people so stupid anyway?

WTF would you make bomb threats using your own PC, at home, anyway? For crying out loud, if you're going to commit a felony, go find an open wireless relay, using a borrowed, rented, or stolen notebook.

Criminals are dumb.

Click here for free movies!

From: [e-mail]
Subject: Click here for free movies!
Attachment: not_spyware.exe

Hello! You have been selected to receive free movies at no cost to you! All you have to do is install the attached program to start downloading all the latest Hollywood hits free of charge!

Hello World

Two obvious ways are for the Feds to find and exploit their own operating system backdoors, or to compromise security vendors...

There are other ways:
-Social engineering (either against the person, or his mother)
-Breaking into the basement^W house and installing the damn thing
-Hiding it in porn

Getting past defenses?

But how did the FBI get the spyware activated and past anti-virus defenses?

Easy, they sent it to some kid on MySpace. It's a rather large assumption that he had any anti-virus defenses at all, much less that AV vendors are being complicit with the FBI trojan.

Something seems fishy about the whole story, though. This guy was apparently savvy enough to use a proxy in Italy to send his Gmail bomb threat emails, so he was at least trying to cover his tracks... But he was dumb enough to open a random email attachment? It strikes me as more likely that the CIPAV is deployed through a browser exploit (or perhaps even "legitimately" as an ActiveX control or BHO, people will install anything).

Re:Getting past defenses?

Using an onion router is no sign of computer knowledge. Some pal might have pointed him to The Onion Router [eff.org], he saw it, went "wow, they can't track me if I got that", and that's it.

Just because someone does something the "average Joe" cannot or does not do, doesn't mean that he knows more than said Joe. He might just have gotten some clue from a pal, without said pal telling him the whole story.

It's simple script-kid style. Yes, some of the malware that circulates is pretty well written, but the people using it are sometimes so dumb that you wonder if they ain't better off serving fries. They're bound to be caught.

Not the guys only issue

If this guy will open random e-mail attachments, there is a good chance he already has tons of spyware/adware/viruses on his machine anyways. I doubt he would have noticed one more.

Where's the provision for any federal police squad

I keep re-reading my Constitution, and I don't see where it allows for a police power for the Federal government to go after bomb threats or any similar crime.

Is a bomb threat considered piracy?

Is a bomb threat considered treason?

Is a bomb threat considered counterfeiting?

If it isn't, there is NO Federal allocation of power to go after bomb threats, period. What the FBI is doing is not just unconstitutional, but any political leader who took an oath to uphold the Constitution is violating the only oath they took.

It is time that the residents and citizens of the United States of America ask where the government has gotten these powers from. I know that many of the previous generation is afraid of terrorist attacks, but we are all being attacked already in having our natural rights taken away from the very government that has one major purpose: to protect us from the State who wants to take those rights away.

It is fairly simple. The FBI has no provision in the Constitution, nor in any Amendments to said Constitution, and should just go away. Let the local State police force worry about bomb threats. If it happens from across State lines, let both State police forces work together.

Interesting speculation

The Feds would have the $$$ and be able to hire the skill labor to build some pretty sophisticated spyware tools. On the other hand, I wouldn't be surprised to find out Microsoft included a back door in Windows. That rumor has surfaced before.

The problem with either of those options is if they get out in the wild. How many people have access to those tools and how is their deployment managed? Who wouldn't be tempted to do a little sideline testing if they had those goodies in their tool chest.

Thank Goodness

They got a court order, seem to be going through all the proper channels, aren't trying to pull any "national security" secrecy bullshit, and just seem to be doing this by the book. It's nice to see representatives of the law obey the law and actually be able to feel good about what the FBI is doing. Am I just jaded?

Woot!

They think this guy really did it! I fooled 'em good!

livecd

Wouldn't a using a livecd have prevented the software from being installed?

A far more likely way

Is that it simply used social engineering to convince the recipient to run the tainted executable, thus infecting himself, rather than relying on being able to exploit a hole that may or may not be present. Male teenager? Offer him free porn, he'll barely be able to double-click the exe fast enough...

Linux...

There's now no reason for criminals not to use Linux. Thanks FBI, you just made us dangerous by default.

smileys.exe

I keep getting prompted to run smileys.exe when I connect to MySpace, but Synaptic Package Manager barfs on it sayings it not a valid package file? I did a 'file' on it, and its some sort of executable for a system called "MS DOS" - is that like ProDOS?

Sorry FBI, I'd like to help, but it seems your wiles only affect chimps.

Use MySpace?

Why not just get MySpace to send an e-mail out to the user containing the spyware? That way it looks fairly legitimate and is (almost) guaranteed to get to the right person.

Of course there is still the chance that a firewall or piece of security software would pick up the offending malware. Chances are the kid didn't have a very secure setup as others have suggested. The FBI probably thought they'd give the spyware thing a try and it worked out - I doubt they need to make use of OS exploits. They probably had enough data about the kid to create a highly targeted piece of spam or advertising that he was simply not able to resist.

Why is this even on /.?

I know this site is a big echo chamber but the simple fact of the matter is Federal law enforcement coordinates very closely with every computer vendor that has anything of interest to them. The coordination efforts are expressly for purposes like this. I seem to recall photochop will throw an error if you try to scan U.S. currency. It's like that, only everywhere and no error messages.

Law enforcement is very deep into every aspect of computer activity. It's been this way for more than a decade.

The /. moral outrage rings very hollow because no one will fight for anything different.

The Problem

I support surveillance by law enforcement agencies. I also believe in fairly stiff penalties for breaking the law (though I would add that I feel that harsher penalties for real crimes should be balanced with reducing the breadth of behavior that the government restricts). However, I am opposed to the use of spyware on the suspect's property for such surveillance. Why this conundrum?

The problem is that technology is getting closer to us all the time. The barrier between man and machine is becoming much narrower. And that is a good thing. At the far end of the spectrum people have long been getting artificial hearing enhancers, and now we are starting on intelligent artificial eyes and limbs. People with epilepsy are getting electronics embedded in their brains. At the nearer end of the spectrum, a large percentage of the population now carries a small computer with them everywhere (their cell phone). The man/machine split is disappearing.

So what? Well, we have a problem developing if the government assumes that anything that does not have your genome is fair game for them to crack. Today it is the suspect's computer. This already poses a problem if the suspect is, for example, engaged in legitimate contracting for some corporation - should the government have the right to compromise the security of that corporation because one of their employees is breaking the law?

But what of the more tightly coupled technology? Should the government be allowed to plant a bug in my hearing aid? Should they be allowed to tap the signals coming from my artificial eyes? Should they be allowed to monitor the same brain activity patterns that my seizure mitigating device monitors?

The problem is that we are becoming more closely coupled with technology, and that is a good thing. We are the first species in history to actively engage in our own evolution. But if we cannot trust our technology, it creates a barrier to that evolutionary step. I have the right not to self-incriminate. But if a computer is part of me, where does the line get drawn?

Thee title !!!

Might be offtopic, but cant resist a comment :) First glance at the title, and I read "Dont wait for FireFoX III" ...

Read the real version of the story

Declan not only ripped this story off from Wired without attribution, he got it wrong. There's no way the police could have emailed the tracking software to the kid as an attachment. Myspace doesn't allow attachments. Want to see the real story with real reporting: try the original story here: http://www.wired.com/politics/law/news/2007/07/fbi _spyware [wired.com]

Where is the 'Duh' tag?

Why else do you think they call it 'Spyware'. Geez.

Privacy vs. security

I'd be rather upset, if an American government agency were unable to find a way to find a (legal) way to penetrate an American-made operating system with or without cooperation of American computer-security firms to investigate bombs threats against an American school...

Yes, privacy is very important — unless you are dead, that is...

To protect a few hundreds of innocents from McCarthy-like harassment, America shackled its intelligence services in the past, which appears to have contributed substantially to the deaths of several thousands (and billions of dollars worth of destruction) in 2001 alone.

The pendulum is now swinging into the other direction and already there are dimwits, who break Godwin's Law [slashdot.org] and still get moderated to heavens by fellow dimwits... Something tells me, I will not be :-)

Warrant and Receipt

From the search warrant:

...leaving a copy of this warrant and receipt for the person or property taken...

I wonder how they did that. Surely just dropping a PDF in with the CIPAV software would be considered contempt (about as legal as burying a physical search warrant in the backyard). Waiting for the 60 day gathering period to expire seems too long, but sending notice and receipt for each day's take would make the whole thing a waste of time.

sounds familiar

in germany the government did the same thing (they say it was "only" 12 times so far) until a court forbade it... now our equivalent of the DHS tries to legalize it.
interestingly the head of our DHS, Wolfgang Schäuble, is trying to pass pretty much the same laws, that hitler did - and using the same "this is neccessary against terror" propaganda that hitler did....... and appallingly 60% of our stupid citizens are with him... I think one "successfull" act of terrorism in our country would be enough to start the fourth reich... (and remember that hitler staged the terrorist attacks back then)

Happening right now.

Too much info has been released and I can explain what is occurring right now. This is not speculation.

- E-mail account made at a foreign e-mail hosting site that has an extremely terse address so as not to be hit by spambots (i.e. [e-mail])
- E-mails are sent from a stolen laptop through a public wireless access point that are copycats of this crime to illicit the same FBI response.
- E-mails are then checked each day from different public access points each day using a different MAC address at each access point. [The only e-mail that should be coming into this account would be the one from the FBI. Probably easy to verify by checking DNS records of the e-mails originating IP or IP block.]
- E-mail is received and copied to disk.
- Laptop is destroyed.
- CD with e-mail is then analyzed on a Linux/Unix machine that has no internet connection.
- Backdoor/exploit vector is discovered and used for "other" purposes.

Grey-market exploits

The answer is right in front of you [securityfocus.com]. Governments and spy shops pay for exploits before they're made public, so they can use them to enter your machine as they need to. In this case, we don't know how CIPAV was delivered, but it might be as simple as an undiscovered exploit in Outlook or a browser-based email system. While none of us trust government, I equally don't trust my fellow citizens, so the "ethics" of this point are moot.

try this:

Set up a computer in another country. Set up a site to site VPN to your network in the US. Do something to catch the FBI's eye. They think they're installing spyware on a computer in their jurisdiction, and they've got a warrant to do so. But they're actually breaking into a computer on foreign soil. Fun foreign relations.

Sorry, had to ask...

...but will it run on Linux?

Updated

How Does the CIPAV Work? [wired.com]

Three words...

National Security Letter [wikipedia.org].

Two of the largest, most successful companies in the world with respect to computer security and they've not responded to said questions. Hmm...

(BTW, I refuse to argue whether MS is "successful" under any circumstances; they own what, 80% market share in the PC server and workstation OS world, that's success regardless how they attained it.)

no special software needed to find an IP

it's quite simple you dont have to install anything remotly to see who is doing what

As a basic firewall (and some CMD commands) show you who is connecting to you remotely. Next thing is look for the ISP owner and give them a call.

Or perhaps the FBI doesnt work with ISP's wich is a bit strange if it was like that probaply some have double pay rolls overthere... i just gues or they have some signed agreement to help them out. Most likely google yahoo hotmail etc etc all havce similair commitmends (oh whack is that why they are all american??).

Well any way there is no real hidding at the internet.
In otherwords please please use the internet for stupid actions as it is more easy to find 'terrrible' people. .

Government Ethics

First, any fool who makes bomb threats deserves to be busted, tossed in jail, and treated like a criminal because that is exactly what they are.

The internet is like a highway, on the internet how can anyone have any reasonable expectation of privacy?

Did the police (FBI in this case) overstep their bounds? Apparently a judge did not think so, he authorized the warrant.

Frankly, I am glad that they took this criminal off of the streets at least for now.

A bigger question really is being asked: "Should the FBI and police be allowed to use tools that would be illegal if used by civilians?" That question is a bit harder to answer but ultimately, we have a long history of giving our law enforcement officers tools that the general public is not allowed to use or, can only use in very limited ways. Examples of this would include machine guns, Tasers, two-way police radios, and mobile display terminals connected to restricted databases. The government has a right to employ some tools that in other hands may be illegal or unethical.

Did they use a known hole or did some one in a company somewhere create a hole for them? I don't know. Frankly, I would feel more comfortable ethically if they had discovered the hole on their own or used an accidental one. If they are using one that is custom designed, then I think that they are helping create a security vulnerability that could be exploited by someone else and that, I would think is wrong.

Re:If it weren't for spyware...

Is freedom dangerous? Hell yeah, sure it is. Since police can't simply go from door to door and do a routine search of your property, there are certainly thousands of loonies out there building bombs at home in preparation for day X. Some of them snap and use them.

Though what's better, freedom or the golden cage? We ain't far from the ability of total surveillance, to make sure that everyone complies with the law (whatever it may say). It's far from impossible. We do have the technology to create the world of 1984.

Personally, I'd prefer freedom to controlled safety.

Re:Oh no ev1l!

Or it could be that we hear about this one operation because it gets immediate support, while the same op against, say, filesharers, might not be looked kindly upon.

So, now excuse me, I gotta go buy more tinfoil.

Re:If it weren't for spyware...

If it weren't for spyware...You might not be sitting here right now and your neighborhood might have more of a crater shape. Think about that the next time you boot up Windows.

Funny thing about might, it don't always equal will.

I might also be sitting here right now in a perfectly normal neighborhood, without any craters beyond the ones my dogs are digging. I might win the lottery . . . one day.

I might live in a country that stops to consider the "why" of bad behavior, instead of just the "how to" of punishment. The leadership of this country might think something like, "You know, people seem to be generally angry, and a large part of the anger seems to be directed at those in positions of power. I wonder if a little self analysis might be in order."

Then again, they might not think any such thing.

Re:Its not just FBI Magic Lantern program! FACTS.

Have any sources to back up your "facts"?

Re:Its not just FBI Magic Lantern program! FACTS.

The Mac OS (not OSX) Mac OS 9 ironically is the only os in history never ever to be remotely exploited in history. Check BugTraq immense database if you do not believe me. Using it, or in an emulator, with a much older Netscape or iCab is a good solution for sandboxing and avoiding all possible FBI magic lantern activity.

I'm pretty sure that MSDOS 5.0 has also never been remotely exploited too.