McAfee Will Ignore FBI Spyware 571
Drew writes: "The Washington Post is reporting on the FBI's new spyware called 'Magic Lantern.' According to their article, 'At least one antivirus software company, McAfee Corp., contacted the FBI on Wednesday to ensure its software wouldn't inadvertently detect the bureau's snooping software and alert a criminal suspect.' It is ridiculous that the software companies that are supposed to help us protect computers purposefully leave in loopholes for the FBI to operate their spyware."
Fucking Great (Score:5, Insightful)
Fabulous, I hope everyone feels safer already.
Re:Fucking Great (Score:3, Interesting)
Best thing: Download software from trusted companies and entities only, make backups of your registry and boot drive often, don't open attachments in email from those you don't fully trust not to carry viruses, and keep up to date on what new viruses are out there and how they operate.
This doesn't affect me much. Just wish we knew how the FBI's virus would work so it could be stopped at the router or mail server level.
Re:Fucking Great (Score:3, Insightful)
I end up relying not only on you, but on the people you claim to be trusted.
This is remarkably similar to trusting physically promiscuous people to not carry something transmittable to me.
I approve of the steps you take, but how can I be sure all the people you trust take those steps as well?
Re:Fucking Great (Score:3, Funny)
Re:Fucking Great (Score:2)
FBI fights crime by being criminal... (Score:2)
"So you have all this incredibly nasty software sitting happily on some (criminal enough to get the FBI's attention) hacker's computer, conveniently within his reach."
Exactly.
They'll spend $30,000,000 of your money (if you are a U.S. citizen) on software to exploit security flaws. Then they'll broadcast that software free to criminals. This will teach some of the criminals how to exploit security flaws. Then there will be more crime. Then the FBI will get more money to fight crime. They will see this as a big success.
The CIA used this same method in Afghanistan. They trained Arabs in terrorism. Read about that in: What should be the Response to Violence? [hevanet.com]
How many criminals smart enough to use computers will be smart enough to run Tripwire [tripwire.org], or some program like it, such as the one that comes with Mandrake? At least some, is my guess. Those criminals will know immediately that their computers have been compromised. The criminals will then use the compromised computers to write email saying how much they believe in law enforcement, and to send Paypal payments to charities.
You didn't read the article. (Score:2)
You didn't read the article.
You can start reducing violence by being less mentally violent.
Re:Fucking Great (Score:2)
Re:Fuck McAfee. (Score:2, Insightful)
Magic Lantern benefits crackers! (Score:4, Insightful)
The point is, these aren't loopholes for the FBI. McAfee will ignore this loophole, and that will allow CRACKERS to get into your system. This program, which is intended to prevent people from getting into your computer, will happily ignore all cracking that takes place through the same loopholes as this so-called Magic Lantern.
Oh well... Next time, use OpenBSD.
Re:Magic Lantern benefits crackers! (Score:3, Redundant)
It certainly raises the possibility ... but if McAfee is competant, it's only a small one. Magic Lantern is probably going to log information passively, and maybe send it to fbi.gov . It's not going to open up ports with shells attached to them. It's not going to propagate itself. It's not going to mail passwords to leet@haxors.ru . It's basically not going to do anything that a self-respecting malware author wants.
So sure, maybe you could write Amazing Lightbulb, that McAfee can't distinguish from Magic Lantern. But it probably couldn't do anything interesting, because if it tried, McAfee would know it isn't Magic Lantern.
(Ultimately, of course, malware versus anti-malware is an arms race, and a sufficiently clever hack can no doubt evade McAfee. Possibly, Magic Lantern code in McAfee might make it marginally easier; but anyone who's smart enough to evade McAfee can probably do it either way. And in a week or three, McAfee will issue an update, and the next round will begin.)
FWIW, my take is that if court-authorized spyware warrants get the FBI to relax their anti-encryption stance, they're probably a good thing.
Re:Magic Lantern benefits crackers! (Score:3)
It's still based on signatures, not operating patterns.
Re:Magic Lantern benefits crackers! (Score:2)
It's still based on signatures, not operating patterns.
Ok, I admit I haven't used a virus scanner since I last ran Windows, which was over 4 years ago. If McAfee is operates only on signatures, then obviously there is no need to impersonate Magic Lantern to evade it: any original code (that doesn't match existing signatures) will do. And since any code that does something more than Magic Lantern must necessarily be different from Magic Lantern, McAfee can write a signature for it after it's discovered. So, against signature-based defenses, impersonating Magic Lantern buys you exactly nothing. Is there anything I'm missing here?
In my original post, please replace "McAfee" with "a hypothetical clever anti-malware product".
(From memory, though, I thought that McAfee did guard against things like suspicious file modifications. Maybe that was a different product.)
Re:Magic Lantern benefits crackers! (Score:3, Interesting)
Correct. This is one of the major problems with virus scanners, they tend to be vulnerable to The New Virus.
Yes. McAfee calculates the signature from the code. Presumably, the way it works around Magic Lantern is by some code that looks like this:
if virusSignature == magicLantern then return(1);
else doCleanVirus();
Therefore, if an enterprising virus writer can synthesize a virus that does something different, but causes McAfee to detect the same signature, it's happycakes time.
That said, McAfee has always sucked donkey donuts. Norton is better; however, the only PC-based antivirus product I ever really had a lot of respect for was IBM AntiVirus, partly because it was the only one that could detect virii it didn't already know about. Sigh. It's long gone though.
Re:Magic Lantern benefits crackers! (Score:2)
if virusSignature == magicLantern then return(1);
Sure. But after a Magic Lantern impersonator is discovered and analyzed, McAfee adjusts the signatures to distinguish the impostor from the original. So the situation is the same as for any other virus: undetected at first, but stopped after McAfee analyzes it and issues a signature update. Really, all McAfee would be doing is ensuring that none of their "bad" signatures matches Magic Lantern.
That said, McAfee has always sucked donkey donuts.
Yes, I do seem to remember that....
Re:Magic Lantern benefits crackers! (Score:2)
- Modify c:\windows\hosts, point fbi.gov to the ip of haxor.org
- Mail all passwords to me@fbi.org
Virus writers are smart. Very smart some times... keep this in mind please
Re:Magic Lantern benefits crackers! (Score:3, Troll)
- Mail all passwords to me@fbi.org
This particular example is silly: any software smart enough to detect and stop outgoing mail would probably 1) use the IP address of fbi.gov to allow Magic Lantern and 2) flag the modification of the hosts file as suspicious. However, ...
Virus writers are smart. Very smart some times... keep this in mind please ;-)
(Heck, if Magic Lantern does send mail to spooks@fbi.gov, and you can subvert the router on the victim's network, you can just infect him with the real Magic Lantern and you win!)
Re:Magic Lantern benefits crackers! (Score:2)
I suspect that the FPI would react on this simple fix with varying IP addresses - and that gets you back to a loophole for everyone...
Re:Magic Lantern benefits crackers! (Score:2)
Re:Magic Lantern benefits crackers! (Score:2)
Unless, of course, the first thing that Amazing Lightbulb does is shut off all run anti-virus software and delete the executables to prevent them from running later.
Re:Magic Lantern benefits crackers! (Score:2)
Tasty.
a call for a document (Score:2, Interesting)
does anyone know of a URL for a well-written anti-microsoft screed that would be understood by my grandmother? something that intelligently synthesizes arguments against hailstorm/passport/closed source/key escrow/etc. and for the adoption of free software?
Re:a call for a document (Score:2)
If you find one, let me know. My experience is there aren't any. Pretty much most documents I've read on the subject either fall WAY too heavy on the "FREE AS IN SPEECH" aspect of things (which I don't agree with - not *every* piece of software should be FREE like that imo), or it falls into the "micro$haft"-style of writing - making overly broad criticisms of MS and overpomising on the benefits on 'non-MS' stuff.
"My Lunix box has been up for 8 years without a reboot!" doesn't really mean jack-squat to most people, especially when they don't often experience downtimes with Windows. I can match every "WindoZe sux!" story with equally painful Linux experiences (X basically sucking, software crashing, etc.)
There does need to be some more good literature on this topic - the Cathedral and Bazaar wasn't bad, but I lost my copy and we need more anyway!
What about linux users? (Score:4, Funny)
So I guess for linux users, the email would probably look like the following:
Dear Sir or Madam,
Please make sure you are root when you execute this file.
Thanks,
The FBI
Re: linux user could be vulnerable... (Score:2, Insightful)
Re:What about linux users? (Score:4, Funny)
I think it is more likely that the trojan would look like:
if(uptime()>3500000) {
ExploitLocalRootHole();
DoEvilStuff();
} else {
WaitUntilNextLocalRootHoleDiscovered();
ExploitNewLocalRootHole();
DoEvilStuff();
};
Well actually (Score:2, Insightful)
Some potential ways to protect oneself from Magic (Score:2)
Another option: I wonder what a port sniffer/firewall would see while the Magic happened? If anyone posting to slashdot thinks the Feds might want to shine a Lantern on them, could you try this experiment? We won't know whether you really have ML installed until you're disappeared, of course, but at that point your data might prove useful.
Re:Some potential ways to protect oneself from Mag (Score:2, Insightful)
That's a hell of a bet to make if you're a criminal. There are a reasonable number of remote-root exploits for Linux, and it's possible that they're may be unknown ones out there.
I mean, Christ, the FBI isn't that stupid, I'm sure they have the resources to port software to different platforms, even if they need a totally new codebase.
Re:Some potential ways to protect oneself from Mag (Score:2)
Next week's headlines:Also, I'm wondering how long it will be before some enterprising soul catches a copy of the lantern, analyzes it for a
Or better yet (for suitable notions of "better"), use McA to detect it, but rather than replacing it just install a script to fake a safe log for the FBI's reading pleasure?
US dictating foreign users rights as well? (Score:3, Insightful)
OK, I really need to get this off my chest here.
How will this affect copies of software sold countries outside the US? Will my AV software end up crippled and able to be exploited by those who have reverse engineered the "FBI Friendly" code?
Why is this acceptable? Because the good old US Government wishes to remove the much-lauded freedom of its citizens, the rest of the world also loses those freedoms. Will McAfee for example really bother to have a US-only version with the FBI-lover code in it, and remove that code from all other versions? Even if they say they have, how will we know???
Grrrrrrrrr....
Re:US dictating foreign users rights as well? (Score:2, Insightful)
www.kaspersky.com (Score:2, Informative)
Beyond Here Lies Paranoia (Score:3, Insightful)
For those that would point out that convincing someone to click on an attachment is social engineering and not really an exploit, I'd like to point out that there are mechanisms that can be put in place both at by the OS or the mail reader to make things like clicking attachments less dangerous (automatically running attachments as a user with minimal privileges is one of them). But given that the FBI is relying on OSes not to make doing this easy would applications or OSes that tend towards security start to face the same stigma and negative association that encryption has faced since the events of 9-11?
Re:Beyond Here Lies Paranoia (Score:2)
It doesn't need to be as complex as that. They could just require that all computers contain a user account named 'fbi', group 'root', password 'jedGaRHoOVer'. Simple.
Failure to support the account would be considered an act of harboring terrorists. Civilians using this account would be considered impersonating a federal agent: that's illegal, so there won't be a problem with unauthorized access.
Re:Beyond Here Lies Paranoia (Score:3, Insightful)
I think we all have a reason to be paranoid...
"REAL SMART" (NOT) (Score:2)
I'm glad the PC world feels safe with virus scanners installed.
Here's McAfee's contact page (Score:4, Informative)
http://www.mcafee.com/aboutus/contact_us.asp? [mcafee.com]
McAfee.com Corporate Headquarters
McAfee.com
535 Oakmead Parkway
Sunnyvale, CA 94085
USA
Telephone: (408) 992-8100
Fax: (408) 720-8450
Why? (Score:2)
Or is that the NSA?
But honestly, if virus writers can bypass virus-scanners, why can't the Feds?
Is There a Difference? (Score:5, Funny)
They've been ignoring viruses for years. Why change now?
;)
Knunov
Norton won't do this (Score:3)
If McAfee does not, then they should be investigated by the FTC for marketing a low quality product.
Re:Norton won't do this (Score:2)
Re:Why rely on Norton? (Score:2)
Does anybody know what the subnets for fbi.gov are? It'd be pretty easy for people to block outgoing connections to them...
FBI - Classic magician's trick? (Score:4, Insightful)
It just may be that the FBI's so-called "Magic Lantern" is a classic magician's trick. They are telling the whole world that this Magic Lantern is a technology that will seek out and destroy every dangerous criminal on the face of the planet. They're marketing it as an unbeatable technology that works on EVERY SINGLE COMPUTER IN THE WORLD (that is, every one that's running Windows). They're causing lusers to think that there really is some kind of crimefighting technology when it's really nothing more than a bug which allows crackers to compromise Windows.
Then, the criminals who are trying to avoid the FBI see this and talk to someone who understands computers. That person tells them how to patch their system to remove the vulnerability.
Here's where the classic trick takes place. The criminal thinks he's immune from the Lantern, so he goes on with business as usual. He writes down his drug trafficking records or whatever, and then the FBI goes in behind his back, using some other system that nobody knows about, and gets the information.
I'm not saying this is what's going on. On the contrary--government people are really stupid, and even more so when it comes to computers. But I'm saying this is a possibility, and I'll try not to discount the FBI's intelligence just yet.
Oh well.
Re:FBI - Classic magician's trick? (Score:2, Insightful)
Re:FBI - Classic magician's trick? (Score:2, Informative)
This statement reminded me of a page full of various thought traps people fall into, in particular this one:
Government Trap #5: The belief that government people can do anything better than other people. Government people don't have any special magical powers.
Also worth calling attention to are:
Government Trap #9: The belief that government provides protection. Just look at the crime statistics. (or recent events in New York City)
Government Trap #10: The belief that certain activities or functions must be done by government. Government consists of people. These people don't have any special magical powers.
Government Trap #13: The belief that government exists as a volitional entity. This is an aspect of the Group Trap. When having to deal with "government," you always have to deal with individual human beings. Realizing this helps make you much more effective in warding off any attempts by individual government people to violate your freedom. Rather than having to handle "the government," you have to handle one or a few specific individuals. Frederic Bastiat said. "The State is the great fictitious entity by which everyone expects to live at the expense of everyone else." [emphasis added]
Read the rest of this report, "Harry Browne's Freedom Principles" here [buildfreedom.com].
Re:FBI - Classic magician's trick? (Score:2)
Today's irony: Who collects and collates those statistics? Government, of course, even though the page makes it sound like government is pointless and useless.
I suppose that pointing out a decade of falling crime statistics doesn't earn me any points toward proving that government can offer protection?
Re:FBI - Classic magician's trick? (Score:2)
After 25 years, the LP is a complete and utter failure.
There are more libertarians in office now than ever before. It sounds to me as if you could use a little improvement in your thinking skills, but I'll let you make that determination for yourself.
"There are many ways to respond to the information you receive. One way is to instantly and automatically reject it. Another is to instantly and automatically accept and believe it.
"Another is to evaluate it: 'Might there be something useful for me here?'
"Another is to see if it fits with your current knowledge. If there's just one thing "wrong" with any of it, then reject all of it."
(src [buildfreedom.com])
Re:FBI - Classic magician's trick? (Score:3, Informative)
I'll assume you are talking about American Government.
The government in America does have one, very special, magical power that you seem to be neglecting, it has the support of the people it is regulating. This is from where it derives its power, and its authority to use such power. So in one sense, sure the government is just a bunch of people, a bunch of people who have the support of a majority (well...) of the rest of the people
--Alex Fishman
Re:FBI - Classic magician's trick? (Score:2)
Anti-virus isn't security (Score:2)
In this case, they'll probably just not write a detector for ML, and it won't get caught. If someone writes something similar to ML, they'll probably just test their detector to make sure it only catches the intended virus and not ML.
McAfee is in the business of stopping particular exploits, not of fixing anything. That's why people keep getting new viruses that aren't significantly different from old viruses.
Of course, ML doesn't seem to be designed to spread all over the net, so McAfee probably wouldn't do anything about it anyway, any more than they do anything about other non-automated security breaches.
Evidence of Cluelessness at Every Level (Score:3, Interesting)
But moreover, it shows an economic cluelessness, inviting competitors to provide a service they do not. Even worse, it is one thing to sell a "here's some filters, we're trying to keep the buggers out," program, but another thing entirely to sell one KNOWING that it will permit viruses to go undetected. That additional scientermight even invite litigation from companies injured by their recklessness.
In short, it is amazing what a little jingoism can do to get people to lose their minds.
All they have done is make a nation weaker. . . (Score:3, Informative)
Net result is that we have made an internet security infrastructure even weaker than it was before. While this overall approach is not likely to beat up on well-informed criminals and terrorists, it does weaken everybody else's system, making the nation even more vulnerable to actual cyberterrorism than it was before.
All we have done is to make a nation weaker.
Interesting Situation (Score:5, Informative)
1) signatures -specific byte patterns which are searched for in files, and
2) heuristics - in this case algorithms which seek unlikely looking data to determine whether the user should be alerted to a possible intrusion attempt.
McAfee can of course omit signatures for this 'Magic Lantern' (ML) software from their database. However, in the case of the heuristics, avoiding user notification of ML requires either:
a) a weakening of the heuristic(s), presumably to such an extent that other viruses may penetrate the system or
b) the presence of a special signature in the McAfee software which (on recognizing ML) can 'override' the heuristic
Case (b) is interesting. If McAfee do this with a simple byte pattern search this will immediately provide viruses with a neat little 'binary tag' which permits them to evade McAfee's software
The alternative must be to use a cryptographic hash which can be used to identify ML but which cannot be readily forged by other virus code. Using this checksum technique also demands that the ML 'payload' remain unchanged. Very restrictive for code which needs to be stealthy.
But the most important side-effect of both of these techniques - and any others McAfee might choose to use, would be that it provides an easy route for developers to produce software which can check for ML.
In other words, McAfee cannot both provide useful levels of virus detection and avoid alerting the user to Magic Lantern without giving other developers a blueprint to locate it.
Re:Interesting Situation (Score:2)
Actually, B is more interesting than some people may realize. Allow me to illustrate:
If we take the stance that such software (Magic Lantern) *would* have to be frequently modified to remain stealthy, we end up with a whole new problem on our hands. In order to keep up with the newest "ignore versions", McAfeee would have to release new descriptor files/lists containing this info.
So, now that we have the concept of an "ingore list" rather than just "detect lists", let's say that a virus author decides to exploit some weakness in the McAfee product itself to add his/her nasty code to the ignore list. It's not that I think the McAfee coders are *completely* incompetent... I just think any company willing to take "ignore" action on finding an unauthorized program (worm) can't be very intelligent in the first place.
Web hosting by geeks, for geeks. Now starting at $4/month (USD)! [trilucid.com]
If you're gonna email, use the public key!
Re:Interesting Situation (Score:2)
if (checkKnownSignatures() == INFECTED || checkHeuristics() == MAYBE_INFECTED) {
alertUser();
}
That would indeed call for a weakening of heuristics. I reckon you could avoid this "stupid" situation by a slight change to your logic:
if (checkHeuristics() == MAYBE_INFECTED) {
if (checkKnownSignatures() != INFECTED_BY_MAGIC_LANTERN) {
alertUser();
}
} else if (checkKnownSignatures() == INFECTED) {
alertUser();
}
How to smack the FBI (Score:2)
- Create message on machine isolated from any network.
- Encrypt message, then copy to floppy
- Load floppy on networked PC
- Send to all your buddies!
- Don't forget to take isolated machine with you when you leave your hideout...
Bad FBI, no donut!Probable cause? (Score:2)
Does this qualify as wire tapping?
Does the international cybercrime treaty apply here?
Can they install this virus on a computer in another country ? (where US due process may not apply?)
Just some thoughts.
I'm going to vote with my dollars.... (Score:5, Interesting)
Will be interesting to see what the marketplace thinks of this move when their stocks start trading again on Monday.
F-Prot [f-prot.com] isn't based in the States, and maybe they will provide the protection users want.
How long will it be... (Score:3, Interesting)
You can lock a UNIX box down tighter than a virgin whore if you know what you're doing. And with the current IT job shortage, I bet Don Parcheesi can find a pet UNIX geek or three dirt cheap. Or some trustworthy ones for a bit more.
Humm, 3rd party programs. (Score:2)
My computer is a warzone, as long as I have the tools I can win the war. I wonder how long before my tools will be outlawed.
-
Politics is the art of preventing people from taking part in affairs which properly concern them. - Paul Valery
The real irony. (Score:3, Funny)
Trust is absolutely necessary to have democracy. (Score:5, Insightful)
We need to protect ourselves vigorously from crime. However, creating secret agencies who are able to commit crimes themselves is not the way to protect ourselves.
Already there is a serious problem with people committing some destructive act and claiming it was done by the CIA or other U.S. government secret agency. There is no good defense against this, because people worldwide know that the U.S. government secret agencies routinely break the law. How could it be proven that the FBI, CIA, or NSA, or some other secret agency didn't do a particular crime?
The U.S. FBI, CIA, and NSA are now worldwide surveillance agencies. They are supported by Americans who are not allowed to know how much of their money is spent on surveillance. United States citizens are not allowed to know what the U.S. government secret agencies are doing, so they don't know if the agencies are doing things they would now support.
The people who work for the FBI are often not smart people. They don't realize that trust is absolutely necessary in a democracy. They have often in the past not shown understanding of the other needs of democracy. They have often acted like secret police. They often believe in killing or other ways of being destructive as a way of curing some ill in society.
Now they will be attacking computers like the criminals. They will say that they are doing it only to solve crimes, but it is socially impossible to control this kind of thing. Once the principle is established that a secret agency can break the law, there is in practice no limit to what some people in that agency might feel "justified" in doing. Consider your own experience. When has the boss had complete knowledge and complete control over the actions of employees? Never. A company's only good policy is to hire open and honest people and to encourage honesty and genuine caring.
The FBI's influence will mean that the U.S. taxpayer's money will become a powerful force in preserving security holes, instead of closing them. Generally, this kind of software has had holes of its own. You may be attacked by a cracker exploiting a security hole created by FBI software. Governments will detect FBI snooping software and feed the FBI erroneous information.
This is all support for people who like snooping and sneaking. It is not actually a way to reduce crime. It is for adults who like to treat the whole world as a video game. It is for the kind of people who think of themselves as James Bond, who like the idea of being able to kill other people legally.
How U.S. government policy contributed to terrorism: What should be the Response to Violence? [hevanet.com]
Re:Trust is absolutely necessary to have democracy (Score:2)
When has the boss had complete
knowledge and complete control over the actions of employees? Never.
During the Industrial Revolution, many had to buy from company stores, live in company housing, etc.
And nowadays, H1-Bs can basically be deported by their employer.
I hope something can be done. (Score:2)
I'm a little more positive. I hope something can be done. But it is VERY scary.
Reference (Score:2)
http://slashdot.org/comments.pl?sid=23995&cid=259
Some (IMO) sane legal questions (Score:2)
- Are these devices legal?
- Will they detect wiretaps placed by the police?
This is EXACTLY the same situation. What is the legal precedent?"Betrayed users' trust" (Score:2, Interesting)
Multiple abuses of Magic Lantern.(Long) (Score:3, Interesting)
Do illegal stuff online, and be conspicuous about it. If you are already involved in organized crime, this will be easy. Do all your stuff using PGP on a Windows 2000 base install. Regularly talk on the phone to your buddies about those idiot FBI agents who can't read your encrypted email. Make sure to do everything with LCD montitors so that the FBI has to crack the email instead of just tapping your CRT. Get a geek to learn a lot about virus operation so that he can regularly check the system and snag the virus.
As soon as the virus pops up, keep playing along. Send out encrypted crap messages that make no sense, and appear to be written in code words so that the FBI spends more time trying to crack THAT code after cracking the message. At the same time, decompile the virus and figure out how it works. Alter the virus to be self-propigating and extremely malicious, destroying all filesystems on infected machines and shutting them down while residing only in memory to prevent people from finding the virus on disk.
After a few days, set up an online store selling anti-virus software at $19.95 a seat licensing. Encrypt everything the program contains with the exception of an executable, so that no other virus company can figure out how it works without violating the DMCA.
Laugh at the FBI agents who are too busy trying to figure out what all your code words are to notice you raking in millions with a foreign company selling anti-virus software, move to Zug, and retire.
I admit, that scenario is a bit of a stretch. A more likely scheme (And what will likely happen very soon.) is a few good crackers decompile antivirus software from McAffee and Norton, both American companies that will allow the FBI virus through, and compare it with antivirus software from foreign firms, which will likely block the FBI virus to prevent the USA from spying on their companies as the USA does with echelon. Bingo, killer virus in no time flat, watch it take the world by storm. And before any of you bother to post about how the FBI will manage to keep all the details secret so that this doesn't happen, think about this; if the FBI could manage to keep a secret, we would not know about things like Magic Lantern and Carnivore to begin with.
I want to thank the FBI for fucking over America with their inability to realize the dire consequences of their poorly-planned actions. By doing this the FBI is screwing over:
1- All of the companies around the world, especially in the US, that will spend a ton of money dealing with the downtime caused by the first virus to exploit the Magic Lantern backdoors.
2- All of the American antivirus software companies who will lose market share to foreign software companies who do not leave FBI backdoors in their products.
3- Microsoft, who will likely be accused of leaving FBI backdoors in Windows, and who will lose market share when a virus sweeps the Windows world on a level that shames Code Red I and II.
4- All the Windows admins out there who will now have to rebuild all of their compromised machines, and switch to antivirus software by companies that do not leave backdoors for the FBI.
MS/DOJ settlement coincidence? (Score:2, Insightful)
Very Bad News (Score:2)
Insert Sig Here.
The genius of McAfee (Score:2)
I quit not long after that, as did a lot of other people. Whee.
An alternative problem (Score:3, Insightful)
The thing that occurs to me is that, back when I was an easily amused kid I used to capture computer viruses, dissect them and study them. If Magic Lantern is genuinely going to be an effective way to retreive data -- and if it's a virus designed by a team of top-level professionals, which it is likely to be, then it should be so -- then how long a matter of time is it going to be before everyone and his mad bastard cousin starts to make copies of this virus and mutate it for their own ends? This seems like it would quickly become a valuable corporate espionage tool, and then a personal espionage tool, and then just a total disaster area.
The problem with this is, if they design a powerful cracking tool which by its nature must be primarily built out of code resident on the target's machine, it's only a brief matter of time before such software and any upgrades thereof enter the mainstream of black-hat equipment.
Frankly, I'm not looking forward to script kiddies with tools like this...
Solution - Trojan on every computer. (Score:2)
I would also like to point out some problems I foresee. What will stop the FBI from hacking into my pc here in Canada if I install McAfee? Is this not outside of the FBI jurisdiction? Will software developpers only create software that complies to US demands the and sell it the world-over.
You better believe that in the near future more and more people will have a pc bundle and only use one (clean) pc to use the net (disconnected when not in use and removed from the network when in use) and use the others on a network to remove all data from that pc and store info. Essentially, if the trail of wires leads to and pc hd and its powered, it'll be your fault for letting the FBI access the info.
I guess we finally realise that we have no rights. Its just wishful thinking on our parts and propaganda used by the governments.
-I wish I could be sure that my thoughts werent being monitored.
-My own tragic Hero - GoV
Is the FBI that dumb?? (Score:2, Interesting)
1:Why did MCafee allow this trojan?
2:What is the FBI's purpose in creating this tool?
3:Why did the FBI tell?
4:Who is this tool targeted at(main classes of criminals)?
5:How will other anti-virus companies look at the FBI's choice?
Well, lets consider the targets first. I see the most common groups targeted at are drug dealers and computer _criminals_. It's safe to say that the Computer criminals probably will not be caught in a trap like this. The FBI's main tool is believed to be a windows executible however, don't make rash belifs that the FBI hasn't considered a *nix tool yet.
The main mode of transport is that of a binary segment sent over email. Since Outlook is the most popular form of email client, Outlook buffer hacks that 'autorun' binary code are the best transport. Next off, who said that the FBI would be sending data back through the Internet or do any dialing? If I wrote a tool like that, I'd store data (keystrokes, logins/passwds, 'certain sites') in a secure place of the computer. I'd aim for the segment after the bootsector code. There's plenty of space for a few KB of the 'best info'. The FBI would raid the machine anyways, so sending back data is useless (trace of tcp/udp streams would be evident).
However, I question why the FBI even told here. Thier purpose is to catch intrastate criminals and investigate bad political dealings. I'm questioning if the FBI even has this technology. I'm much more scared of a hardware dongle that has 5 megs of storage capibility. Those types of entering have been cleared by the courts, providing the correct documents have been presented. Malware is going to be caught, unless the FBI destroys the data before the criminal sends it away elsewhere.
The last fields of questions deal with the AV companies themselves. Why exactly did MCafee do such a thing? Perhaps they have no choice. There is such a law called Obstruction of Justice. If the AV companies do not allow some sort of loophole, they could be tried in a court of law. Most of you Slashdotters would say "So What", but this type of court battle would lead to either horrendous losses to the company, and eventually having to put the anti-FBI code in, or the destruction of the company. However all is not lost. There is more AV companies outside the US. They WILL defend thier rights to no FBI code in thier computers. I mainly count the Russian AV coders to somehow get the code and track/kill it.
Flat out, the FBI will fail only because of public outcry. They will catch a few criminals and will parade around saying how the US is a better place without the 'scum of the Earth' around. However the worst thing people could do is to assume that the FBI is stupid. They have already addressed most of the questions, better than that has slashdot crowd.
Would they let us know that?
Josh Crawley
NAI/McAffee - PGP? (Score:2, Insightful)
How can anyone trust anything NAI produces anymore?
I doubt very many people with a clue did even before this. But at that time their rather powerfull marketing machine was able to keep the $$$ rolling in from joe blows buying computers with the software pre-installed and computer "hobbyists" who think they know what they are doing and recommend software like McAffee and NAV and so on because the names are well known.
Why this makes no sense... (Score:2)
Why you makes no sense... (Score:2)
May destroy McAffee, other U.S. trusted software (Score:2)
I know somebody there and think I'll ask them if they are planning on making security holes for every local law-enforcement agency. Could be a money maker but somehow I doubt it.. if it was China they would probably have to allow the government to install keyboard loggers on your pc through this Patriotic Remote Exploit facility. Unfortunately Japanese nuclear power plants are running Windows 95 as far as I could see from a recent newspaper photo.. (+3, Cynical, Despair)
Remember the Constitution! (Score:4, Interesting)
Owning a weapon is a priviledge, let alone owning a weapon and carrying it on your person. "The right to bear arms." You need specific reason now to carry a concealed weapon, why is that? I'm an american citizen, if I want to carry a
Sorry using an example of the breakdown of our constitutional rights.
This really disturbs me. Between Carnivore and now Magic Lantern, we have pretty much given up all rights to privacy on the internet. I know that most of you will say that its been likely that the government has been monitoring traffic for some time anyways secretly, now we are publically accepting this as "ok in the name of our safety." Don't think they monitor your cell phone calls? Explain how they got voice recordings of the conversations of the doomed flight to Sommerset, PA.
This is disgusting. We are just handing over our freedom and very few people are saying a word. Funny how not all that long ago, the Supreme court ruled that aquiring search warrants based upon thermal readings from a house was illegal and yet they haven't said a word about anything the FBI has been doing.
Its really fscking sad that the alleged "war on terrorism" is really just a lame excuse to quickly remove a good deal of our rights. People in New York City are being searched randomly in Manhattan. What the hell is that? In 10 years can I expected to be searched if I walk down my street? If I have something illegal, is the search unreasonable, or does the court care more about me just having something illegal? If our phones and computers are tapped (lets assume for the moment that they are for the most part) where does the government stop? They can see what I am writing and talking about....why shouldn't they be allowed to see what I am doing in my home without a search warrant? The best part of it is, nobody would even know if they were being watched. I know this has been something people have complained about over the years (as the government has slowly crept into their privacy), but now its really in our faces. 1984 is not very far away indeed.
Let's take Magic Lantern for instance. If one were to disassemble it, it would violate the DMCA ruling. If one were to circumvent it (which likely anyone in their right mind will), the techniques used would likely violate DMCA. (Remember Skylarov?.....)
Can anyone think of software they might use that might possibly violate the DMCA ruling? I can think of a few, and I am not talking about cracking software. Also this makes me wonder about Windows....does DMCA make WINE illegal?
Indeed, the whole issue is a lot like a runaway train coming down the hill. People see it from the distance and don't realize how dire their situation is and eventually the train comes pummeling down into their sleepy little town and destroys it. I wonder how long before we lose all faith in the government entirely. Too bad we decided that we are too weak and lazy to take the government back into our own hands. What's so sad is that the more disillusioned we become with our government the more likely we will feel that it is out of our control. Judging by the recent elections and the completely disgusting turnout, it seems we are just about there. What do we do in 10 years when we don't even have enough voters voting to elect an official?
Its really time to either:
A) Do something about the slippery path we have slid on
or
B) Walk away from it, buy a huge ranch/estate/tract of land, start a community of like minded individuals, and ignore what the government does. I suggest some western states that do not tax their land so you can totally live government free.
Just some random infuriating thoughts I've had lately.....
Zos/Xavius.23
zos[@]winwood.net
Art is the realization of truth - AOS
Logical (Score:4, Funny)
High treason (Score:2)
Re: High Treason (Score:2)
But isn't the FBI prohibited from running operations outside the US?
silly - loophole has always been there... (Score:3, Informative)
Most keyloggers don't get reported by most "virus" programs. I think Norton AV does, but then again its "Corporate Edition" might not - keylogging is something a lot of corporations do, believe it or not, and that might be against their target market.
People really concerned with privacy should be using software with anti-keylogging features, which on Windoze machines includes products like Scramdisk (freeware! and with crypto module plug-in support, though not fully tested by the community), its successor DriveCrypt (commercial and untested by the community so far, but made by people who maintained Scramdisk), and I think possibly BestCrypt(commercial but tested somewhat). These all have the ability to mask input against keylogging, to varying degrees. Read the documentation and enable it.
And again, remember. For them to use the keylogger, they have to install it on your system, and have some way to retrieve the info.
Practice good data hygiene, like you should be doing anyway, and you should be fine. If you want to test whether the programs mask effectively, install some program like Back Orifice and have it log while you create and mount containers. If the log shows your password, obviously it's not working.
long history of "official" trojans not detected (Score:3, Insightful)
So, besides magic lantern, you could have the SMS part of Back Office installed, too. And with its weak encryption, it's a greater security risk than BO2K.
More BO2k docs [sourceforge.net] and info [nwinternet.com]
Re:more difficult then it sounds... (Score:2, Insightful)
Re:McAffee (Score:4, Informative)
The problem, in my opinion, is that sales of McAfee's products will NOT drop because of this. You're forgetting that 99% of the people who buy that product do so because of FUD--Fear, Uncertainty, and Doubt. These are people who do not understand computers, viruses, bugs, worms and all kinds of other "marketing" names. They buy McAfee because it will prevent "hackers" (who should be called "crackers") from entering their system and causing their CPU to melt. These people will say, "Well of course McAfee shouldn't detect the FBI's crimefighting behavior." They simply don't know that this is a loophole for crackers (the "hackers" they're afraid of) to take advantage of. And they'll never consider that a possibility.
THAT is the problem with things like this. Just wait a few more days and we'll probably get a Slashdot story about a press release by the FBI telling of a new "technology" (a 4KB program that plugs this loophole) that empowers criminals to rub the Magic Lantern and make a wish that the FBI will leave them alone.
Re:McAffee (Score:2, Interesting)
Not really true.
Most of the people who buy antivirus software do so because they know they are at risk.
You've seen you rapidly viruses can spread in the time between they're released and the time the AV companies release detection.
And you know that even after the AV companies detect the virus, the virus doesn't die out straight away because there are enough computer users who aren't running AV software to keep it alive.
If you were running IT for a large company, wouldn't you want to be protected from Sircam say, which you know is out there and you know will forward internal documents when it spreads?
The rest is right though
Re:McAffee (Score:2)
I've got even better advice than not running virus protection programs at all: Get FreeBSD, install it, configure a good firewall, maintain the system properly, make backups of your files often, and don't run as root. You won't even need virus protection programs--the system is protected by design.
OH WELL.
Re:McAffee (Score:2)
Um...what? (Score:3, Offtopic)
-Waldo Jaquith
[1] http://www.m-w.com/cgi-bin/dictionary?book=Dictio
[2] http://www.defencejournal.com/dec98/anthrax.htm [defencejournal.com]
Re:It sounds like Anthrax story (Score:3, Informative)
There is one implied point that I can agree with - development of offensive techniques can come back to bite one. However, the example of anthrax is increadably lax in fact.
Others have already pointed out that anthrax is a natural agent. It is one of few agents known that could be deadly enough to be used as a weapon. Research in this agent have been towards defense against the weapon as well as creating a more effective strain.
One thing that hasn't been pointed out is that this is not the sole realm of the US military nor Mr. Bush (either one). Anthrax research began over 80 years ago. And not just by the US. The Biological Weapons and Toxins Convention produced many signers agreeing to prohibit offensive biological weapons research and production. But it has done little good. There are numerous states and autonomous groups (ie: terrorists) continuing development of biological weapons. And two major signers of the convention, Iraq and the former Soviet Union, later acknologed continued offensive biological weapons programs. Today, there are believed to be at least 17 nations with offensive biological weapons programs.
Iraq itself has claimed to have produced "weaponized" anthrax. There are fears that former USSR scientists have been hired by external interests for their knowledge of anthrax based weapons. And of course, it is unknown how many terrorist organizations have their own biological weapons programs. One known group Aum Shinrikyo, responsible for release of sarin in a Tokyo subway station, attempted to release anthrax and botulism throughout Tokyo on 8 occasions with (thankfully) negative resaults.
The US Army and Mr. Bush may not be helping the situation with the state of biological threats in the world. But they are far from the only cause of this threat.
The threat offered by Magic Lantern is a bit different than anthrax. Defense against biological weapons are, for the most part, a resonsiblity of the State. However, security of private networks have been, and really should continue to be, the resonsibility of those who own those networks. If those in the industry who provide key solutions to private security conserns wish to hamstring their products, then those who are responsible for their benifactor's network security should know. And adjust their contracts / purchases / strategy accordingly.
You assume too much... (Score:3, Insightful)
For all you know, it uses a simple 8-bit checksum.
Not just flamebait, you're wrong, too. (Score:3, Informative)
- The security of an iterative hash algorithm cannot be any better than that of its compression function. (Source: Menezes, Van Oorschot and Vanstone, Handbook of Applied Cryptography)
- MD5 is an iterative hash function. (Source: Schneier, Applied Cryptography Second Edition; also, Menezes)
- Collisions can be generated in MD5's hash algorithm (Dobbertin, 1996).
- Dobbertin's compression-function collision algorithm executes in just a few hours on a 586 (Dobbertin, 1996).
- Therefore, collisions in the full MD5 algorithm can be generated in the same time or less. (This is known to be true as a logical consequence of what's already been proven; if anyone has actually used Dobbertin's attack on the full algorithm, they've kept quiet about it.)
... Next time, before you quote Applied Cryptography, you might want to ask a cryptographer what the latest research in the field is.Read Dobbertin's paper. (Score:2)
The security of an iterative hash algorithm can be no greater than the security of its compression function.
This means that if you can create collisions in the compression function, then you can create collisions in the hash.
Dobbertin did not extend his attack to the full MD5 algorithm, and nobody knows quite why--maybe RSADSI asked him not to, or maybe Dobbertin wanted to give people a few years to migrate from MD5 to SHA-1 before he applied his attack to the full MD5 algorithm.
RSADSI is correct to say that Dobbertin did not break the full MD5 algorithm. But don't think that doesn't mean Dobbertin didn't break MD5 in half. By analogy, imagine a locked door. Someone comes along, picks the lock, and demonstrates that yes, the doorknob turns freely and the bolt turns. The lock manufacturer (RSADSI) says, "well, yes, Dobbertin did expose some weaknesses in the lock, but he didn't open the door."
RSADSI, by the way, nowadays recommends the use of SHA-1 as a hash algorithm instead of MD5. Given that MD5 is the brainchild of one of RSADSI's founders, I think that says worlds.
Re:Not just flamebait, you're wrong, too. (Score:2)
Yep--and cryptanalytic attacks only get better over time. While Dobbertin's attack does not directly lend itself towards generating arbitrary messages which hash out to a specific result, I'd expect that to be the next bastion to fall. Once the compression function goes, everything else soon follows.
You'd be much better off by simply writing functionally-equivalent viruses (obviously, this could be automated) and then MD5summing them.
That's simple brute force, and is usually the absolute worst way to attack a system. The best way, IMO, would be to refine Dobbertin's attack, find a general break of MD5, and go from there. I may be off my rocker here, but I feel pretty safe in saying that would be several orders of magnitude faster than brute force.
Re:why should anyone care..? (Score:2)
Re: (Score:2)
Re:Wondering is there is a open source alternative (Score:2, Informative)
By using this technique, you limit the amount of work that the developers have to do.
Re:The FBI is reading these messages??? (Score:2)