Symantec Will Not Detect Magic Lantern 582
An anonymous reader contributes: "In this article on Declan McCullagh's Politech, Symantec chief researcher Eric Chien stated that provided a hypothetical keystroke logging tool was used only by the FBI, Symantec would avoid updating its antivirus tools to detect such a Trojan, echoing a similar stance Network Associates allegedly took with its McAfee anti-virus software earlier this week. 'If it was under the control of the FBI, with appropriate technical safeguards in place to prevent possible misuse, and nobody else used it -- we wouldn't detect it,' said Chien. 'However we would detect modified versions that might be used by hackers.'"
No need to use Norton AV... (Score:3, Insightful)
Re:No need to use Norton AV... (Score:4, Insightful)
Your OS is certainly more esoteric, but it has holes like all the rest of them do. Your immunity thus far isn't an indication that there are no holes -- there are always holes -- but that the *nix enviroment hasn't yet been able to cultivate & propagate any really serious viruses yet.
One of two thing is likely to happen: Linux's popularity will crest & wane, and people will stop using it (unlikely, I hope :), or it will continue to get more popular, and as it does so it will provide an ever more appealing target for virus writers, licking their chops at all the complacency out there....
Re:No need to use Norton AV... (Score:3, Insightful)
Re:No need to use Norton AV... (Score:5, Insightful)
Mac OSX is becoming an interesting case study in Unix For The Masses. Default Linux is, as the Register recently noted, [from memory, can't find a link] "a paragon of Stalinistic control freakery", and that has made it more secure out of the box than the average WinME box, but more importantly it has also scared off millions, and rightly so. Apple's engineers knew well that if they wanted to bring this architecture to the masses -- the way the Gnome & KDE folks do -- then they'd have to encapsulate & hide as much of that control freakery as possible.
And for the most part they've done a good job, but there have been some serious glitches, like programs that would launch themselves as root, or a broken iTunes installer that wiped out whole disk partitions because of one mistyped "rm" command in an installer script. Pay attention, you seething Linux hordes, because if you want to hit the big time then this is your future. You too will face these problems as the system matures & seeks out a wider audience.
The only "secure" system is either (pick your punch line) the one that hasn't been built yet, or the one you bought a decade ago and still haven't plugged in yet. All of the others -- all of them -- have problems of one kind or another, and all of them always well. Welcome to real life, kids.
Re:No need to use Norton AV... (Score:3, Insightful)
You know what the difference is between Linux and Mac OSX? Linux is written by control freaks. Fortunately, the fine folks who are working on the various parts of the Linux system differ from your average Slashdot sheep in that they care more about system security and less about "widespread Linux adoption". That's why you will never see such a thing as "insecure Linux".
Yes, it's possible that Linux companies will eventually start putting out windows-ified Linux distros that will sacrifice security for ease of use to make it more appealing to the unwashed masses, but so what? Viruses work so well in Windows territory because there's Only One Windows, and everything works exactly the same on millions of computers. Look at all the different Linux distros from a virus writer's perspective and ask yourself if you could really write an effective virus and expect it to work the same on all of them. My answer is no. Not with the huge diversity of libraries and programs and kernel versions out there. What's a virus writer to do? Spread the virus as source file and ask the user to type ./configure? I guess you could do that, but you'd be the laughing stock of the virus writers' community, if there is such a thing.
And if you're going to suggest that Linux will eventually standardize and everybody will use the same distro (or all distros will be functionally identical), and all the programs and libraries will reach stable versions updated only once every six months in service packs, then you obviously have no idea what you're talking about, which is what I would half expect from someone who says things like "welcome to real life, kids".
Re:No need to use Norton AV... (Score:2, Insightful)
Er, no.
If the average windows user were the average linux user, then you'd see viruses. They'd either have "Please insert root password here", use their own dictionary, or use the first program made for newbies (Think the AOL-Linux Distro).
I used windows for many years, and still do use it at work and at home, and I've never been infected with a virus. I have downloaded over 40 gigs of files, including several execuables, and have never had any problems.
The only additional "security" linux offers is user permissions, and even then, that is a rather fragile barrier, prone to user mistakes and security holes (think ramen worm). Plus, really, to propigate, a worm like the annoying worm wouldn't need root to spread, only an appropriate IM client.
So, don't think Linux keeps you safe. Only good security practices and common sense keeps you safe.
Re:No need to use Norton AV... (Score:5, Informative)
Don't be so sure. We have had UNIX worms and even VMS worms. Unlike the designers of UNIX, VMS started with a security architecture and actually recieved B2 certification rather than describing itself as 'B2 equivalent'.
At the other end of the scale the security architecture of MAC O/S has until a few months ago been stuck at the MSDOS level, lacking even protected memory, yet MAC viruses are none too common these days.
The significant factor is the proportion of the network population that uses a particular O/S. As with a biological infection there are definite inflection points that determine whether a virus spreads fast enough to cause an epidemic or a pandemic.
When the Wang Worm hit it could propagate because close to 100% of the computers on HEPNET were VMS systems. Equally the Moriss worm took out the Internet when the vast majority of nodes were UNIX boxes running sendmail.
The proportion of UNIX machines on the Internet today is probably close to critical mass for allowing a viral epidemic. The saving factor is not the design of the O/S, it is the variation between the O/S implementations. Anyone who thinks that sendmail is a lesser security risk than Outlook should read a few CERT advisories.
The separation of administrative privs is not actually significant when it comes to the propagation of email viruses. If that was the case Windows XP would solve the virus problem completely (it won't). The problem is that the boundary between code and data has been blurred. For some reason the people who felt they had to foist Java and Javascript winky-blinky features on the world had no clue when it came to security. (Don't get me started about the Java sandbox model, the code does not match the marketing hype, the implementation does not correspond to what I would regard as a sandbox design)
The other reason that UNIX boxes tend to be more secure is that the use of winky-blinky features is nowehere near as widespread. The proportion of terminally clueless users in the Windows world is (acording to my studies) approximately 92.931%, in the Linux world that figure is only 23.428%. So not only is the userbase smaller, the propability that a user sent the virus will execute the program and cause it to replicate is much smaller.
Again, look at biological models of propagation. x^n is a very big number if x > 1, it is a very small number if x Therefore the day that AOL ships AOL for Linux will be the day that Linux will start to get virus problems. It will have the active code to support winky-blinky features and thus be vulnerable to attack, it will introduce the terminally clueless into the Linux user base.
Re:No need to use Norton AV... (Score:2, Informative)
I suppose that worm that almost brought down the internet way back when wasn't really a serious virus because nobody lost their drive full of mp3/porn/quicken files. Unix has had plenty of time to cultivate serious viruses. It was just designed better than the platforms that have the widely publicized problems. Of course it still has holes, but they are harder to exploit becuase of the multiuser nature (most apps aren't run as root, so they don't propagate as easily or destroy as much data). Why do you think Mac and Windows are gravitating to unix beneath the GUI? The NT kernel has been implementing plenty of new stability and multiuser features that Unix has enjoyed for years, and Mac is Unix under the GUI, no pretense of innovation there.
Not likely at all. (Score:3, Insightful)
1) most people don't read their email while logged in as root. This is the number 1 reason why viruses easily spread in Windows systems is because in Windows, just about everything is done with an account that has full control over the system.
2) In Windows-land you generally run binary-only programs and you have no idea what the source looks like. Most programs in Linux come with the source code. You are not likely to run a binary only program in Linux unless you know for sure who its coming from.
So, to reiterate, viruses are executable programs. They need both permission to execute and a means of spreading themselves. Windows systems were already set up to allow these things to happen by default. Linux systems will never be set up that way, at least not on a widespread basis.
I don't think we will ever see problems as widespread and damaging such as Nimda or Sircam on Linux systems, no matter how popular Linux gets. Its just not designed to easily allow programs to be run, without someone explicity giving it permission. Even exploits of commonly used server programs are limited in the damage they can do, because most servers do not run as root. No, the virus writer has a much much harder job to do on Unix systems. Why bother when Windows is so much easier?
Uh, the answer is simple... (Score:4, Insightful)
Anyway, I don't use Windows, so this is not my problem. Ask yourself; is it really yours? :-)
Re:Uh, the answer is simple... (Score:5, Insightful)
Here's why it IS your problem. If you think the FBI is going to limit their spying to Windows, you are pretty naive. Count on one of the following:
They will find a way to make it work in every consumer OS.
They will find some other way to acheive the same thing with other OSs.
They will outlaw the use of an OS that can be used to evade law enforcement.
Re:Uh, the answer is simple... (Score:2, Funny)
Remember, Carnivore is written in VB.
Re:Uh, the answer is simple... (Score:5, Insightful)
All that is happening here is that
Sometimes I honestly feel pity for Americans!
Re:Uh, the answer is simple... (Score:2)
All that is happening here is that
All non-US parties will purchase non-US anti-virus software losing the US anti-virus software produces $xxxxxxxxxx/annum and meaning the US software will have a smaller user base and be more likely to be less secure
I think one of the main points of this arguement that you are missing is that all of these companies have said that they won't block Magic Lantern, but they haven't said that they're going to make a second English language version of their software that WILL detect it for countries like Canada, the UK, and Australia. They also haven't made any comments about whether or not versions of their software in other languages will have separate patches and virus detection lists that will detect Magic Lantern.
Currently, I believe that all English-speaking countries are using the same versions of both Norton Antivirus and McAfee, and non-English-speaking countries are using the same virus block lists in those programs, but with a different language in the program's interface. With that in mind and both Norton Antivirus and McAfee not blocking Magic Lantern, there's a good chance that your non-US antivirus software won't detect Magic Lantern, either intentionally, unintentionally, or just for the sake of simplicity.
If I were you, I wouldn't just laugh. Because there's a good chance that you're in the same boat as us, and thus going over the same privacy waterfall.
Re:Uh, the answer is simple... (Score:2)
Guess I'll have to move out of the US if they make it illegal for me to run tripwire, netstat, ps, (etc.) to detect the FBI's software having been planted on my computers. I use those (and more) on the systems I run at work and I'll take them off only when the company's legal department tells me to.
Personally, I wouldn't have thought that the FBI would be thinking far enough ahead to consider infesting any systems that were running anything other than Windows. Maybe it's just me but I see IBM's ``server heist'' commercial and see the ``authorities'' brought in to investigate as FBI agents. And I wouldn't be all that surprised to hear a real one actually say ``What's a server?'' (My wife once said ``Oh, heck, they probably don't even know what an email is.'' when that commercial was on.) Just listen to some of the FBI's Carnivore apologists. Their computer literacy is, um, not what you'd like to see in someone who's making the sort of decisions that are being made regarding computers, networking, etc. It'd be funny if it weren't rather frightening.
Re:Uh, the answer is simple... (Score:2)
Re:Uh, the answer is simple... (Score:3, Insightful)
I don't think it is useful to assume that you are safe because you are using Ye Sacred Linux. If a Linux version of the trojan were written, it could be installed in 3 ways (that I can see):
But you're still right with most of your point. It's not my problem (because I don't live in USA) and it's not your problem (because you have not done anything to attract the attentions of the CIA/FBI/NSA/FDA/TLA have you)
I really don't think they'll install it without cause - and even if they did, who's going to monitor keystrokes on every computer in America?
Oh, for the stupidity example, I'm assuming that Magic Lantern wouldn't be sent to Linux users as source...
Re:Uh, the answer is simple... (Score:2)
Um, would you continue using a system that had been tampered with in this way?
Actually, it's even simpler... (Score:5, Interesting)
Such an arrangement would be next to impossible to compromise, as you would need to break all three programs within the check cycle of all three of them. Either that, or you need to break all three hashing algorithms, in such a way as to find a synonym in all three key spaces. Synonyms in a single key space are going to be common, simply because you're using fewer bits. Two coinciding synonyms will be very rare, and there's no guarantee that the software could be moulded into one. THREE coinciding synonyms will be so vanishingly rare that it wouldn't be worth anyone's while to search for one that's even remotely usable.
There. Problem solved. And all it took was a bunch of Tripwire clones. And someone thought it was difficult?
Re:Actually, it's even simpler... (Score:2)
Re:Actually, it's even simpler... (Score:5, Informative)
These utilities, when used together, would offer a defence, using a slightly different technique. Here, you'd be warned, the moment any intruder attempts to connect to your machine, OR your machine mysteriously attempts to connect to someone else. You also get the warning on when a file is changed.
(By relying on only one verifier, you're not quite so secure, but it was the best I could find in a short time. Apologies for that.)
Are you sure? (Score:3, Flamebait)
McAfee Ignoring Magic Lantern Is Bogus?
Re:Are you sure? (Score:2, Offtopic)
http://www.slashduh.org/article.php?sid=133&mod
AP Reporter Says It's Real (Score:2)
-Waldo Jaquith
Nice ... (Score:2, Interesting)
So much for trusting either (Score:2)
Backdoor (Score:2, Insightful)
-inno
not good...... (Score:2, Insightful)
opensource (Score:2, Insightful)
Open Source Solution? (Score:4, Interesting)
Im having Deja-Vu here ... (Score:2, Interesting)
But one would have to wonder
Re:Im having Deja-Vu here ... (Score:2)
Would they pay... (Score:3, Funny)
...if anyone sent them a bill for the CPU usage?
I'd sure love to hear of a defense lawyer bringing that up the FBI's theft of electricity in court.
Silly to the extreme (Score:5, Insightful)
But it isn't the idea of the FBI trying to use these tools that offends me. I expect them too, and I don't have anything to hide. But the issue of a company that I pay money for to help protect me to turn a blind eye to government intrusion is insane.
If I pay someone to give me security, I expect them to provide it against anyone who wants my information. Pure and simple. And I'm not worried about the "Oh, we won't check the FBI's version - but we would check variants."
Oh, that makes me feel *much* better. Imagine a cracker getting his fingers on the FBI software and using that on my systems. Gee, thanks for not checking that, Symantec.
Of course, you have to admit that Symantec and McAfee are in a bind. If they state they're going to detect the FBI software, then they're anti-government. If they don't, then they're aiding big brother. But considering that the United States was formed from a healthy distrust of our government (and that distrust has only proved to help us, thank you Hubert Hoover and your bra collection), I would rather have the security companies on my side and make my government work just a little harder to prove guilt. Or at least, that's what my tax dollars should be going to.
Of course, this is just my opinion. I could be wrong.
Re:Silly to the extreme (Score:2, Troll)
If I pay someone to give me security, I expect them to provide it against anyone who wants my information.
So if you hire private security guards to protect your house, do you expect them to forcibly keep out the FBI when they have a warrant?
Re:Silly to the extreme (Score:2, Interesting)
Re:Silly to the extreme (Score:3, Insightful)
So if you hire private security guards to protect your house, do you expect them to forcibly keep out the FBI even if they don't have a warrant?
These companies are ignoring the FBI trojan altogether. They aren't requiring a warrant to ignore it.
Re:Silly to the extreme (Score:2)
So if you hire private security guards to protect your house, do you expect them to forcibly keep out the FBI even if they don't have a warrant?
Actually, the warrant is irrelevent. I believe the FBI/police can enter your house if they perceive an immediate danger (like someone inside screaming for help).
But to answer your question, yes, I expect a private security guard to get the hell out of the way if the police or FBI tell them to get the hell out of the way. You are not allowed to have private armies, sorry. If they don't have a warrant, then sue them after the fact.
Re:Silly to the extreme (Score:2, Insightful)
Re:Silly to the extreme (Score:2)
Re:Silly to the extreme (Score:5, Insightful)
This analogy doesn't work because if the FBI presents a warrant I already know they're searching my house.
A more accurate analogy might be: What do you expect your security guards to do if they find out that your house is bugged? Should they not tell just because the bugs carry "FBI" labels?
Re:Silly to the extreme (Score:2)
I belive this is still being argued in the courts, however they at least need a wiretap order.
It is however irrelevant for the analogy. The security guards will stand down for the police wether they have a warrant or not, as would you if you were home yourself. But iot doesn't matter. If the police collects physical evidence illegaly or the FBI collects your keystrokes illegaly the result will be the same. The evidence that they gather as a result will not be admissable against you. And that is a string detterant if your job is law enforcement.
Re:Silly to the extreme (Score:2, Funny)
Quick, we -must- destroy the Aquantis Hub!!!!
Re:Silly to the extreme (Score:3, Interesting)
Your free to live in the USA as long as you have the same morals, if you don't its off to prison with you. Over a million people are in prison in the US for minor drug related charges, Over 2 million are on parole for minor drug offenses as "Position of marijuana"
The moral majority in the US has passed laws to keep freedoms from you. They empower the jacked boot thugs to take everything you own, lock you away, and forget about your speedy trial. They can ruin your life, walk away and say "All in a days work, protecting the innocent..."
Crime is murder, rape, arson, robbery, identify theft, violence and abuse...
NOT backing up software, fair use, recording a tv show, downloading an mp3, having sex, smoking, erotica, fiction writing, speaking against the government, abortion and sexual orientation...
At least they cant put me in prison for detecting a trojan, right?
-
The law, in its majestic equality, forbids the rich as well as the poor to sleep under bridges, to beg in the streets, and to steal bread. - Anatole France (1844 - 1924)
Re:Silly to the extreme (Score:2, Insightful)
Fear not what you would have to hide now, but instead fear what you may have to hide in the future...
I wish people would stop allowing invasions of their privacy because they have nothing to hide.. that's not the point. You have the luxury of saying that currently because the PEOPLE (read: YOU) and the GOVERNMENT coincide on your beliefs of what is "hideable". However, if these invasions of privacy keep occurring, it will become easier for the GOVERNMENTS "hideable" secrets to diverge from yours with a lessening ability to respond by the PEOPLE.
Why must history endlessly repeat itself when it's all there for us to read about?
Re:Silly to the extreme (Score:4, Insightful)
I have a better conspiracy theroy though
huh? (Score:5, Insightful)
What about Norton Firewall? Will it still detect unexpected outgoing connections? How can I expect it to reliably detect and permit FBI-approved software, but not hacker software with a similar MO?
Oh, maybe there'll be a hard-coded IP address in the outgoing connection -- now THERE'S a nice target for DDOS!
Great - It's a three way race (Score:4, Interesting)
Eventually, I'm gonna need a scorecard to keep all this striaght.
New virii (Score:2)
At least under linux there's 'rpm -Va', assuming the hacker hasn't mucked your rpm database.
--Bob
I can hardly wait (Score:5, Insightful)
Malda might as well start composing (and spellchecking) the headline now, because it's a sure bet he'll get to use it.
Re:I can hardly wait (Score:2, Informative)
The Nicky Scarfo case seems to be the precedent for computer surveillance so far. Savy enough to use a computer, but I doubt he was any kind of virus hunting guru.
Would the FBI be willing to risk exposing the signature of magic lantern to the general public by using it on users more likely to know how to find it?
If the virus companies roll over and let the FBI sqeak by easily, they effectively help the FBI keep the honest people honest while people with enough incentive go about there wrong doings march on. As a bonus they leave a wide backdoor open in the protection that honest people rely on to protect their data from wrong-doers.
This idea is so great I bet that the brain surgeon behind it has at least 2-3 previous dot-bombs under their belt.
Savvy (Score:5, Interesting)
Ten minutes, tops. (Score:5, Funny)
Keep "Magic Lantern" out of the hands of criminals.
How does "Magic Lantern" work?
The FBI sends it to criminals.
What if... (Score:2, Insightful)
That's a risky assumption.
'However we would detect modified versions that might be used by hackers.'
How do you know if a [cracker] is using an unmodified version on my PC and is watching me? You don't.
There is no such thing as an 'appropriate technical safeguard'; the way to defeat it simply has not been discovered yet.
Is this any real suprise? (Score:2, Interesting)
The other assumption people seem to be making is that the people who are being tapped in this way, will understand that they have been infected by a virus and then sending it off to the anti-virus companies or someone else clued up for analysis.
- It would be a very stupid idea for the FBI to use it to spy on hackers..
Jason
Re:Is this any real suprise? (Score:2, Insightful)
Maybe you HAVE seen the "Has my property been trespassed on service(tm)" [adt.com], or the "Can someone surveil me through my windows service" [levelor.com]? People should have a right to protect their privacy and security without it being assumed that they are criminals, and companies should have a right to provide the tools to do so without being accused of abetting criminals.
Not all spies/intruders work for the FBI you know.
One URL says it all... (Score:2, Informative)
Re: a/v software (Score:5, Insightful)
The FBI? Do anything illegal? Who would ever imagine that such a thing could happen?
<repressed_memory>
</repressed_memory>
Hmmm, I can't seem to think of any examples of how police spy powers have been abused in the past, can you?
Re: a/v software (Score:3, Insightful)
COINTELPRO [icdc.com]
And this time we're GIVING the government this power by agreeing to be spoon-fed this 'for our own good' and 'war on terrorism' bullshit.
I say no thank you. If there was a tracking device installed subcutaneously on every single American citizen in the country, and our borders were closed, THEN would you people feel safe?
Re: a/v software (Score:2)
--Blair
"Hey! Isn't that John Ashcroft...in a dress?"
Reverse engineers line up here - (Score:4, Interesting)
Well, if the antivirus vendors are going to include a sufficiently detailed signature in their products for the FBI's virii, that should help anyone trying to build a detector.
I'm sure somebody will try to build malware that impersonates this so-called "Magic Lantern" - I hope they call it "Magic Latrine" :^).
But wouldn't it be nice to see a GPL'd program to detect the FBI's virus? Then, if I found it on my machine, I could stop the goverment-sponsored theft of my CPU cycles. Of course, I'd then call the FBI and offer to let them reinstall it given adequate monetary compensation - but that's just me, you might take some other action.
--Charlie
J. Edgar Hoover lives on... (Score:4, Interesting)
If government seeks to use clandestine and furtive methods to monitor citizen actions, it can ill afford to complain should the citizen insist on a method to effect his right to know he is under such surveillance.
Judge Joseph Ryan, Superior Court, District of Columbia
Granted, its only a district court, however it is a compelling opinion, and a brilliant interpretation of the Fourth Amendment. IR detection/imaging and monitoring utility bills have been tossed out on similar grounds. I wonder what AVP is going to choose... Perhaps this is a great opportunity for Free Software, I just wonder how a free software anti-virus lab would work. Anyway, end of my rant.
Its a non-problem (Score:3, Insightful)
I just wonder how a free software anti-virus lab would work
Easy- we fix the problem instead of treating the symptoms:
If there are exploits, they get fixed. So you would never have to worry about an email or webpage hijacking your machine.
And so long as you stick to source-available code (not necessarily the same as open-source) which has at least a moderate distribution, you dont have to worry about trojans.
The run-away virus problems you see in windows are a direct result of a closed source culture where all software is delivered and exchanged via inscrutable black-box binaries. A typical windows user thinks nothing of downloading a .exe file from an untrusted source then running it, whereas a typical unix user would get shivers just at the thought of doing so.
Virus scanner software is just a huge patchwork of duct tape that is fundamentally incapable of solving any problem- or providing any security.
(for example nimda: it had already done its damage by the time it was in the pattern files)
If an open-source system and philosophy were ta take hold of the desktop- an entire industry (virus scanning/recovery) would simply disappear.
Re:J. Edgar Hoover lives on... (Score:3, Interesting)
- they're trying to retain the confidence of the middle-american software purchaser (both private and commercial) that would revolt* against them as "un-american" if they obstructed anything the FBI proposed.
- they'd probably face some sort of frivolous or trumped up charge of aiding terrorism or maybe even sedition if they'd announced plans to detect magic lantern. not that such a charge would stick (on appeal).
[*]said middle-american probably doesn't understand the security implications of permitting a class of trojan software to do its work (not that i do, but i acknowledge it has the potential to be quite a problem). said middle-american would also dismiss the raising of any privacy or civil rights concerns with a hearty "NONE OF THAT MATTERS ANY MORE! WE'RE AT WAR NOW!" and probably a "don't bring any of that unamerican talk into my $location" or a "the FBI is on our side, they wouldn't do anything to hurt us." for good measure.Re:J. Edgar Hoover lives on... (Score:3, Interesting)
The CEO of symantec get's labled as a terrorist by Ashcroft.
He can now be detained infinately without charges. His confinement is not public nor are his charges (if any).
Life without parole without a trial or charges being filed. If he happens to be non citizen he can be tried by a military tribunal (AKA kangaroo court) and be sentenced to death.
Would you react any differently?
Re:J. Edgar Hoover lives on... (Score:2)
(end of first paragraph) [wikipedia.com]
just say no (Score:5, Insightful)
If US software companies want to sell crippleware in the interests of "patriotism" that's their business. There are plenty of companies willing to fill the gap.
What about KGB/Mossad/MI6 trojans? (Score:4, Funny)
Stance of non-us companies? (Score:4, Interesting)
possible detection still exists (Score:4, Informative)
also, what about personal firewall programs? I use a Tiny Software's PF (yes, under Windows, sad isnt it) that checks the md5 of an executable before granting internet access. on top of that, it can allow you to block certain apps from making/accepting connections from various sites. for example I have it set to not allow Mozilla access to ads.x10.com.
Here, two things exist: the lantern has to find a way around the md5 and also find a way around "PGP wants to connect to [fbi-ip-address], allow it?" Getting through one or the other might prove difficult.
cut out the middle man (Score:2, Funny)
Security through Obscurity and Windows. (Score:2)
However, this will be good for companies besides NAI/Symantec, since it might give them an opportunity to appeal to the smaller, security-concerned windows users. Could be a veritable shot in the arm for them. If you are using Windows, might I recommend some Other [tucows.com] virus scanners?
Also, not to turn this into an Anti-MS, Pro-Linux rant, but this is a perfect time to make the switch if you haven't already. None of this argument even applies to those running Linux. (except for those who have stock in those companies
Press Coverage (Score:2)
Most likely some researcher will post signatures from the file anyways, and somebody will create a detection utility just for the purpose of detecting this one "virus".
international terrorist: fbi (Score:5, Insightful)
... then again, there is Echelon [echelonwatch.org].... apparently no one minds...
The funny part... (Score:4, Interesting)
Are they writing this "virus" for BeOS? how about OS/2?
What about a linux box running as only old a.out?
I can think of at least 70 ways to make their "virus" not work on my machine. (I highly doubt that this "virus" will run on my Linux development box that uses a Hitachi SH4 processor)
all this hubub about company X or software Z will or will not detect this virus app is pure marketing and hype. Noone who is really threatened by this could care as it is easily defeated from ever infecting the system by simply changing the archetecture...... Hey FBI, not everyone runs windows on Intel hardware.
Hmm... (Score:3, Funny)
I am not an American! (Score:2, Interesting)
Who needs 3rd party software? (Score:3, Insightful)
Someone help me figure this one out..? (Score:3, Insightful)
First off:
Everyone keeps talking about how it will just be a matter of time before a wild version of "green lantern" or something of the sort shows up in the wild....
Dude, if you have Green Lantern on your computer and you find out about it, you've got a lot more things to worry about then sharing it with the hacker / cracker community!
Second of all:
Who cares that the anti-virus software won't recognize it. They haven't detected half the viruses for years!
Heck, Just create your basic client server in c++ or whatever and you'll notice that it is not recognized by the software anyways..... I started to learn sockets and create client/server chats, remote access for work, etc. My anti-virus, anti-trojan software never picked up on it... only my Zone Alarm caught it.
A flawed concept (Score:2, Insightful)
You would think the government would be interested in closing all potential security holes. But now they want to run a roto-rooter straight through every firewall and defence, tell us just to pretend it doesn't exist, and assume that they won't disrupt the normal process of computer security.
I'd like to borrow a technique from the MPAA and RIAA, an irrational analogy. We might as well install FBI doors in our house. They'd all take the same key. We wouldn't be allowed to look at them or put any furniture in front of them. Eventually criminals would fashion a key to all of them and waltz in our door, steal our valuables and shoot us. But we wouldn't be allowed to defend ourself from anyone who came through that door.
A rebuttel from myself: In my heart of hearts I want the FBI to be aware of all sinister plots (which exist aplenty). I want them to be able keep us safe. I know the danger off coordinated terrorist attacks which are beyond scrutiny.
But I worry about unrestrained government, which can closely watch everyone without checks and balances.
I also think that trying to make a security hole which only the good guys can use, and the bad guys must ignore is a bit far-fetched.
Developing? May already exist. (Score:2)
Add to that even the most basic of Windows e-mail viruses and you'll recognize that this may already be installed and operational on existing machines. How many desktop users would even notice a little extra traffic now and then?
I don't doubt that the FBI can already do this - what they are doing is slowly "leaking" the idea to the public and the press to see how citizens will react. The police/gov't can obtain anything they want by illegal means, it's just not admissible in court. That doesn't prevent them from using what they found and following those leads, then claiming "intuition" or "encryption cracking farms" as an excuse as to HOW they broke the encryption.
Prior to 9/11, U.S. citizens would've fought the idea, but now many people feel that complacency will yield security. The FBI hopes that both the government and its citizens will allow this when, in reality we all recognize that it shows a blatant disregard for our constitutional rights.
Just the $0.02 of the paranoid. Let me put my tin foil hat back on...
I am in Canada A (Score:2, Interesting)
Now her is how you prevent yourself from getting the virus.
1 don't open he
2 Use a firewall. Got a fire wall/dhcp running on a p120 Linux system. This means they would literally have to hack the firewall to get to my systems. Do they really have the time to hack my system that is non US
3 Just don't run windows (or at least on the computers you ar doing bad things on).
My 2 cents plus 2 more
Will Symantec pay me back (Score:2)
I spent a lot of money in a anti-virus software to avoid that any kind of unawanted software is running in my so-called servers.
I also was hoping to minimize the risk of having any kind of confidencial data stolen from my company.
And now? how can I be sure that FBI won't steal my confidencial data (note: I know they won't use it, but still he can steal)
I want my money back.
Not these company's job anyway (Score:5, Insightful)
If the FBI is doing their job well, that's not the situation here. The way they've been describing this working is that they set it up to attack the particular person against whom they've obtained a warrent. It doesn't email itself to the target's addressbook, it doesn't attack random IPs, it doesn't try to infect floppies. That would be both illegal (since it could destroy the data of non-targets) and probably invalidate their evidence (since they don't have a warrent to investigate every individual in the US).
So a virus scanner shouldn't catch Magic Lantern, because it's not really a virus, in the sense that they're scanning for. It's an attack tool, which uses the methods often employed by viruses. Virus scanners don't fix security holes; they look for particular malicious and spreading code on your computer and clean it up. They won't stop Magic Lantern, they won't stop someone hijacking your passport account, and they won't stop even script kiddies breaking into your webserver, because their purpose and system design just aren't good for that.
So far I haven't heard of any IDS companies saying they will ignore ML, nor have I heard of any companies saying they won't fix security holes that ML uses. That's what would be significant.
Why this does not bother me (Score:2)
OTOH, finding out exactly what the hell it looks like is pretty good. I'm sorry, paranoiacs, but the chances of this thing cropping up on Joe Public's computer seem pretty slim. You'd have to be associating with some rather sketchy people before you'd ever get a glimpse of this thing in action, it seems.
magic lattern will get DDOSed (Score:2, Interesting)
What I don't get... (Score:3, Interesting)
There would be no issue at all here if this program was something that had to be manually installed. If the FBI got a warrant to enter a suspect's home, install a 'tap' on his PC, and then retrieve the data, there would be no issue.
Any criminal savvy enough to detect that sort of intrusion is also savvy enough to detect and subvert Magic Lantern. Hell, if I had something to hide, I'd keep it away from the networks, on an encrypted drive, wired to destroy the data if I failed to log in correctly - and I am NOT a criminal mastermind.
All ML does, by being a Trojan, is get non-criminal technologists pissed off over civil rights and such.
Sure, it may make the 'tap' easier to set up remotely (does it really? only with very ignorant criminals I think) and to pull data off as it's being generated, so that a logfile can't be easily found (but anyone with something to hide is likely to be sniffing their own packets anyway, no?).
There's something else going on here. It could be about testing the waters for industry compliance to Federal backdoors (PGP anyone?). It could be to increase the anxiety level of technologically inept/newbie potential terrorists.
The publicity level of this strikes me as a diversionary tactic, because the technological aspects of ML are surely defeatable (we can look at our own packets down to the bit after all) and the audacity of it (Big Brother factor) is sure to kill it.. The next step is to have each cell phone sold with a listening device that the FBI could turn on remotely. Even the technologically ignorant would not stand up for that, or for this.
Could Magic Lantern be buit into Windows XP (Score:5, Insightful)
Re:Could Magic Lantern be buit into Windows XP (Score:5, Informative)
'Hadn't thought of that option before. Of course, I will now. Probably not get any sleep for a few days, too.
Re:Could Magic Lantern be buit into Windows XP (Score:3, Informative)
Not true. I think one of the earlier posts about ML indicated that one mode of its operation allowed it to simply record keystrokes locally (hidden away in an OS registry or a "special" file of some sort, if we're talking about a closed-source implementation) and those recordings could then be recovered physically upon serving a warrant on the user.
Of course, the paranoid among us would do their best to determine where those recordings get kept and utilities would no doubt be written to clear or obfuscate those recordings. But my point is that the feds don't necessarily need it to generate any network traffic for ML to be a useful tool.
Re:Some need to clue in (Score:2)
Given your analogy, would a good guard just open the door to somebody who said "I'm with the FBI. I don't have a warrant to search the premises and I forgot my credentials back at the office."? That's a better analogy.
Re:Some need to clue in (Score:3, Insightful)
Your analogy is, unfortunately, incomplete. Let's review:
In such a case, the following is expected to happen:
Now, in the case of Magic Lantern, the following *might* happen:
So, what's missing here? Simply enough, the agents did not have the consent of the court to infect your computer, and you've been deprived of the knowledge of what occured. This is the major issue here. I wouldn't want them poking inside my computers as much as the next guy, but if they're going to, I'd like to know when they're doing it, and they better have that bloody warrant in hand.
Re:Some need to clue in (Score:5, Interesting)
Government agencies have no reason to "crack" a system, if they're really interested they can get a search warrent and examine the system. The search and ceasure laws were designed to put all government investigative action in public view. Secret searches cannot be justified. If there is no good way to get the passwords for the keys, then the government is SOL. So they don't have one piece of evidence, I hope that the evidence that they do have would be more than just bits on a hard drive.
Re:Some need to clue in (Score:2)
Re:Some need to clue in (Score:2)
Re:"Fact" Squad (Score:2)
Re:As if.... (Score:2)
(I would have replied faster, but I was too busy reading the Kaczinski link from Crime Library)
Do you keep a file on FBI miscues on hand? You better be careful, Mr Ashcroft may out you on his "enemies" list.
The Olympics and Ted K. links don't worry me so much, as they describe leaks of superficial, sensational material.
It's the second link, from the Las Vegas Sun, that really gives me pause. This describes an FBI agent secretly passing along data from their databases to a private investigator.
Now this private dick was probably investigating some real scumbags, but it isn't too hard to imagine that someone wouldn't get the Magic Lantern info for "good" purposes and then it ended up in the wrong hands.
Re:Symantec may not... (Score:2)
http://www.theregister.co.uk/content/55/22788.h
As I understand it, Magic Lantern is designed in a style similar to that of your average email virus, an executable that they try to convince you to run...and if it gets that far, chances are it can do the DLL modification that the story mentions.
Re:Don't believe the hype (Score:2)
Is this really that hard? If the FBI works with them, couldn't they check whether the file is identical to the one the FBI provides to them? Of course, this would involve having the "magic lantern" executable encoded in entirity in the antivirus software.
Re:I run linux blah blah blah!!! (Score:2)
And good luck to them if they do. They're just another bunch of crackers trying to root my machine, and I've been dealing with those for 20 years now. Nothing new. And if they do root the thing, they can forget about it going undetected. Offsite copies of Tripwire checksums on CD-R are a Good Thing.
And no, I don't do that specifically because of the FBI or even crackers. My niece is curious and possesses clue in full measure and is at that age where rm -rf / is an irresistable temptation.