Malware Is a Threat to Americans (Unless the FBI Does It)

[roo_ster]

http://www.wired.com/threatlevel/2013/08/freedom-hosting/

http://www.welivesecurity.com/2013/08/07/stop-using-windows-tor-project-advises-users-after-malware-outbreak/

Security researchers tonight are poring over a piece of malicious software that takes advantage of a Firefox security vulnerability to identify some users of the privacy-protecting Tor anonymity network.

The malware showed up Sunday morning on multiple websites hosted by the anonymous hosting company Freedom Hosting. That would normally be considered a blatantly criminal “drive-by” hack attack, but nobody’s calling in the FBI this time. The FBI is the prime suspect.

“It just sends identifying information to some IP in Reston, Virginia,” says reverse-engineer Vlad Tsyrklevich. “It’s pretty clear that it’s FBI or it’s some other law enforcement agency that’s U.S.-based.”

If Tsrklevich and other researchers are right, the code is likely the first sample captured in the wild of the FBI’s “computer and internet protocol address verifier,” or CIPAV, the law enforcement spyware first reported by WIRED in 2007.

The inevitable conclusion is that the malware is designed specifically to attack the Tor browser. The strongest clue that the culprit is the FBI, beyond the circumstantial timing of Marques’ arrest, is that the malware does nothing but identify the target.

The supposition is that the malware is the FBI's and the FBI was using it to get MAC & IP addys of kiddie-porn downloaders.  Of course, the many, many others who used the service for non-kp purposes had their MAC and IP addys collected, too.  I am sure those will be quickly wiped from the FBI databases.

Now, I am fine with finding & skinning kiddie-pornographers, but I sure don;t see how mass-hoovering of addys complies with the 4th Amendment.

[CNYCacher]

There was never a question that the .gov installed it.  They are the ones who seized the servers and replaced the website with a page that said "Down for maintenance, come back later". That same page was the one that contained the malware. The discovery of the phoning home was interesting, and it was originally discovered to be contacting a hard-coded IP address in a block assigned to the NSA.

The discovery of the phoning home is not what implicated the .gov, it's the fact that the page they put up to replace theserver is the source of the spyware.

[Levant]

Let me beat the defenders to the punch:

If you have nothing to hide why do you care if the government installs monitoring software on your PC and identifies your computer to the government?


McAfee and Norton have both stated in the past that they will not protect against government viruses.  That's why I would never use either.