The U.S. Federal FBI uses sniffing software to extortionists, terrorists and hackers to track. Now is a document has been published, showing how and, above all, how often the so-called spyware is used.
Â
Have the documents seem at first glance not to disclose, but it actually read like a high-tech thriller. It appears that FBI employees plenty of trouble to read all the passages that are even now still be classified as secret. Actually, this is also the
152 pages authorities digitized paper (PDF) shows would have none of it before the year 2033 will be made public. But this plan failed. Even now the material is a deep insight into the high-tech investigative methods of the U.S. federal police.
That the documents classified as secret at all to the public domain, is the American Freedom of Information Act, the Freedom of Information Act, to thank. This law allows every citizen the right to inspect government records to obtain. And it is precisely this insight into the FBI files, the U.S. magazine "Wired" is now called - and get approved.
A total of 623 pages, with the question of espionage-related software, holds the authority continues to decline. At 152 pages, but the FBI has released and it is primarily made public, how often and how intense the police department has for years been hacking methods to fall back to suspect things to do.
The investigators sniffing software is the popular
The Schüffelsoftware the FBI was already in the summer of 2007 revealed to the public. Already at that time had "
Wired 'reports about how the FBI with the help of the spy program, the 15-year-old Josh Glazebrook was convicted. The student had emailed anonymous bomb threats at his school, but with traditional investigative methods to locate.
The use of this software called an FBI agent as "Computer and Internet Protocol Address Verifier" CIPAV shortly. Once on the computer of the suspect set, determined according to the program "Wired" various information about the software, hardware and Internet connection of the hijacked machine. The so-collected information to the software then to an FBI server in the state of Virginia and then moved into a surveillance mode to become active again if needed to be.
Previously it was assumed that the software only in a few cases have been set up. But this is apparently not so. As the now published documents show that the spying program was probably used so inflationary that an FBI employee was already on the first page in a memo pointing out that often can not be justified using "difficult issues" and conjure up the risk the software could be unmasked.
Hacker methods to the police authority
That is with the publication of the FBI papers done. Thus, the documents show how the malicious program on the computers of the suspects will be introduced. Instead of the old secret methods to use, perhaps home or office to break the target person and the software manually on the PC of the person concerned to install, the investigators use modern and totally unimaginative Cybercrime methods.
To use the FBI specialists vulnerabilities in the Web browser of the target person to be unnoticed access to their computers to wrongfully. With simple tricks to lure the suspects to well-prepared web pages, they animate to a specific link to click, so the sniffer program installed. Precisely in this way is that the investigators also Josh Glazebrook into the trap, by whose case "wired" to the software has been carefully.
Klappt's not always immediately
The papers that had the web address as attractants groomed site MySpace in a private chat room to place for the student's advantage. No sooner had the Internet investigators went to the glue, began CIPAV data on its online activities to the FBI to send - even when he Drohmails sent to his school.
Interestingly: The American spy program records only the Internet addresses of computers that the suspect ourselves. Records of the contents of e-mails or angesurften Web sites are not prepared. Quite similar work in Germany Vorratsdatenspeicherung the ISPs who are also only addresses, but not content recorded.
HARMFUL AND spyware SOFTWARE: SO CO AND OPERATION TROJAN.
Click on the keywords to learn more
Trojans
Like the Trojan horse in Greek mythology Computer Trojans hide their real task (and harmfulness!) Behind a fairing. Most occur as a harmless software: screensavers, video file, access program. They are, for example as an e-mail attachment, spread. Who the program starts, is thus always a hidden malicious function: Most of this is the opening of a so-called backdoor, a backdoor to the computer system over the Internet opens, and the other malicious programs are downloaded.
Virus
Computer viruses infect existing files on the computers of their victims. The landlord files work? at least for a while - to continue as before. Because viruses are not discovered. They spread not independently, but rely on that computer users infected files to pass them by e-mail, to a USB stick copy or sharing settings. Of the other harmful and Spähprogrammen is a virus spread by the sole method. What damage it causes depends solely on the will of its creator from.
Rootkit
The small compound, the words "root" and "kit" together: "Root" is for Unix systems, users with administrator rights, even in the depths of the system must intervene. A "kit" is a collection of tools. A rootkit is thus a set of programs, with full access to the system of a computer equipped. This allows the rootkit widespread manipulation, without that, for example, from virus scanners can still be perceived. Either the rootkit software includes, for example, disable security scanner, or it builds a so-called shell, which is regarded as a kind of mini-operating system operating in all suspicious transactions to the host is hidden. The majority of the outstanding Rootkits can be used, trojans, viruses, and other additional malicious software over the Internet message. Rootkits are among the most severely compromise a computer traceable.
Worm
Computer worms are, in practice, the tuned, lowered variants of viruses and Trojans. In the strict sense of the term only describes a program, which provides its own spread - and the programs that are transported. Worms contain a nucleus is a malicious program, for example, by initiating your own mail program to spread from an infected computer makes. Your Hauptverbreitungsweg are the communication channels of the web: e-mail, chats, AIMs, P2P exchanges, and others. In practice, they are often seen as a vehicle for the dissemination of various other malicious programs used.
Drive-by
Under a drive-by is the influence of a computer or even infection of the PC by simply visiting an infected website. The method is very few years the trend: taking advantage of recent security vulnerabilities in browsers and the use of scripts, a website deposited on a malicious code on a computer influence. Thus, virus spread, sniffer programs installed, the browser requests redirected to websites that pay for and more. Drive-BYS are particularly perfidious because they are from PC users no activity (such as opening an e-mail) request, but only carelessness. Victims are mostly users that their software is not through regular updates, keep up to date - that is potentially as good as any.
Botnet
Botnets are networks of computers kidnapped - the bots. With the help of Trojan programs, for example, through websites or manipulated fictitious e-mails to infiltrate the computers, make the botnet operator access to the external PC, you can control it via the Web. Such botnets to rent, can be a lucrative business. The zombie armies to be used, inter alia, to millions of spam e-mails to send, through a multiplicity of simultaneous requests websites to its knees or on a large grassy style passwords deductible. (more on blogs ONLINE)
Fakeware / Ransomware
The word is composed of "fake", ie "forgery" and "goods", the acronym for Software: It is all about "wrong software". These are programs that claim a specific performances, in fact, quite another to do so. Top form: Alleged IT security programs and virus scanners. In its innocuous variant, they are useless, but annoying: They constantly warn against any non-existent viruses, and try to make the PC user to a purchase to move. As adware programs they annoy the users with advertisers.
The perfidious form but is Ransomware: You kidnappt regelrecht the computer, makes him a hostage. It hinders or prevents normal work loads viruses from the network and makes claims to a "cleaning fee" or release fee, which is nothing more than a ransom: Only if you pay, you can use the computer to work again. 2006/2007 had often, but has since declined.
Zero-day exploits
A zero-day exploit exploits a software vulnerability already andem day on which the risk at all is noticed. Normally delivered to manufacturers of security software and the authors of malicious programs, a head-to-head races with the stopper, seal and exploit well-known vulnerabilities.
Risk No. 1: User
The biggest security risk in the world of the computer sitting in front of the computer. Not only lack of discipline in necessary software updates to make the user dangerous: He has a great fondness for free music from obscure sources, funny file attachments in e-mails and a great joy in communication oh-so-informal Plauderraum of the Web. Most damage in the IT are likely to benefit from users' fingers to mouse buttons cause.
However, the papers also show that the installation process does not always runs as smoothly as in the case of Josh Glazebrook. Thus in another action a hacker in the sights of the FBI. A total of 29-times the man visited the Web page prepared without taking advantage of the FBI catching software. Apparently had some Inkompatilität with the system of the hackers, the installation routine of the spy program paralyzed. Only when the responsible officials its technology specialists asked for help, but suddenly everything went smoothly and the software is installed.
The end of anonymity?
Despite such failures, document the FBI records that their sniffing software in many cases has been used successfully. For example, in the case of a man who supposedly Drohmails an anonymous Hotmail account sent. Even a genuine contract killer is the electronic spy into the trap when he tried to its services online through an anonymous e-mail connection.
These cases document what the view of "Wired" the specialty of the software seems to be: Internet users to unmask who seek to disguise their identity by using proxy servers or anonymizing services. Exactly this ability in 2005 have been used to determine a man thing to do, the tried, several telecommunications companies to blackmail.
The blackmailer had initially various telecommunications cables cut in Boston to meet his demands to lend, the company then asked him for a monthly protection money in the amount of $ 10,000 to an anonymous account to pay. The account data should be him on a Web page form, which he allegedly has a German anonymisation service, probably the
Project AN.ON, ourselves. But his disguise tactics availed him nothing, the FBI spying program felt it all in spite of precautions to.
This automaticity with which the FBI program appears repeatedly on PC infiltrate was now likely to lose fitness. Now criminals are more careful with their updates against computer Vulnerabilities abzudichten and anti-virus software to install.
But the FBI will be prepared. CIPAV 2.0 is definitely already in development - or even already in use.