FBI Virus Cracks Encryption

The FBI is developing new surveillance software that would allow agents to decode the hard-to-break encrypted data of criminal suspects, MSNBC reported Wednesday.


Many tech-savvy criminals encrypt their electronic communications to evade law enforcement. Known as "Magic Lantern," the FBI's new software is designed to eliminate this digital loophole.


Magic Lantern works by infecting a suspect's computer with a virus that installs "keylogging" software -- a program that can capture the keystrokes typed into a computer. If agents can track what a suspect types, they could obtain information that would let them access the key a suspect uses to encrypt and decrypt data.


That's because encryption keys are protected only by the pass phrase used to start the Pretty Good Privacy program, similar to the passwords used to control access to a network. If agents can decipher a suspect's pass phrase by examining what he types into his computer, they can gain access to his encryption keys. The keys can then be used to unscramble the suspect's encrypted messages.

ADVERTISEMENT



To infect a suspect's computers with the keylogging virus, the FBI could enlist a suspect's friends or relatives to email the virus inside an attachment, a source told MSNBC. The FBI could also infect a target computer by exploiting known security vulnerabilities, the source said.


According to MSNBC's source, Magic Lantern is one of a series of enhancements the FBI is currently making to its Carnivore project, the name given to the agency's email-spying tool.

-------------------------------------------------------------------------
I got really really upset when I read this. Its bad enough I've got to keep an eye on script kiddies. Now the Gov;t has gone so far as to invade my space...... Its almost enough for me just to go out and Doss Those *******s!!!!!.......................

With the respect to you american people. I have no respect to your Goverment!!!!! There just turned in to terrorists!!!

Today is a sad day!!!!

Quote:

---

Originally posted by -=solarismka=-

With the respect to you american people. I have no respect to your Goverment!!!!! There just turned in to terrorists!!!

---

I have to agree......:fpissed:



Could you give me the link to the site that you got this information from?

For that to work, they would need the co-operation of the anti-virus companies out there. After all these types of viruses/worms are hardly new are they? Even if they somehow managed to persuade the anti-virus companies (which is highly unlikely), then I'm sure it wouldn't be long before details were posted on various sites.
Perhaps they assume that there are people who know about email encryption, but not about the dangers of running email attachments without scanning them first.
As an aside, the only viruses I have ever received were from friends, who did not realise they had (a) got the virus, or (b) were transmitting it :D

This is a good topic to be discussing. The only thing I want to know is why is everyone thinking that this is something new? The feds are always trying to keep a step ahead of so-called hackers which in reality they are the hackers/crackers. I have no beef with the way that the feds are doing things but just come out from the dark and reveal to people that you can never be invisible online. They are just doing this to have the lead-way to just go into someones computer. Trust me...someone will be capalizing off of this little game. That is the his-story of the good ole United States. "Lets make the net safe for everyone but in reality they are the main ones that infest the net with all of the exploits. Trust me this is not new at all and to close this out...PGP is not "pretty good at all" because if you knew the sequence/formula then you would know that it is a weak program to begin with! It is stictly logical...anything that can be ciphered can be deciphered!

Quote:

---

Originally posted by darkes
For that to work, they would need the co-operation of the anti-virus companies out there. After all these types of viruses/worms are hardly new are they? Even if they somehow managed to persuade the anti-virus companies (which is highly unlikely), then I'm sure it wouldn't be long before details were posted on various sites.
<snip>

---

No they don't.
This is paranoid & hypothetical
What if the US gov had taken Billy Gates to one side and said something along the lines of... "let us plant trojans in your windows update site and well let you off your world domination / monopoly shite"
Billy bows down and hey presto kids, the next time you update the latest gaping micro$oft hole you get a free keyboard logger hidden by a micro$hite signing cert. The Anti-virus companies are non the wiser and your in the hands of the feds before you know it.
I'm not saying this has happened but it makes you wonder, it is possible.
and... as XP has an auto update feature, this could happen begind your back without you even choosing to update / patch your box.

Food for thought!

J.
:rolleyes:

First off, I'd like to say that I've got nothing against the american government..

every government of the world tries somethign at one stage or another that is really unlikely to work, and would cause a lot of privacy problems if they implemented it... thats called an attempt to gain power...

but by doing this.. if they are developing a virus to do this thing.. then what is to stop it infecting other computers... ****, I've seen a small virus that was made by a friend take down his whole network.. this thing was simple as.. didn't have a complex replication method, just exploited FPS..

And aside from the whole minimum control on this situation.. installing a keylogger.. why don't they just hire script kiddies... they could do exactly the same recording... at least in this fashion they would have more control over what is happening...

#DISCLAIMER#
I've been drinking for a long time.. feel free to ignore me... :D

In reply to jcdux:
==============================================
This is paranoid & hypothetical
What if the US gov had taken Billy Gates to one side and said something along the lines of... "let us plant trojans in your windows update site and well let you off your world domination / monopoly shite"
Billy bows down and hey presto kids, the next time you update the latest gaping micro$oft hole you get a free keyboard logger hidden by a micro$hite signing cert. The Anti-virus companies are non the wiser and your in the hands of the feds before you know it.
I'm not saying this has happened but it makes you wonder, it is possible.
and... as XP has an auto update feature, this could happen begind your back without you even choosing to update / patch your box.
==============================================
From a practical point of view, I can't really see that happening.
Apart from anything else, that would cost MS loads of $$, if it could be proved (loss of customers, potential law suits etc.)
I very much doubt that the security loopholes that exist in MS software are created deliberately by MS - its more a case that because it is the most widely used OS in the world, it is more vulnerable to attack.

Oh, and in reply to mr_unforgiven, PGP is pretty good (difficult/ impossible to crack by sheer brute force), but like any other system, it is totally worthless if the key(s) are known.

Agreed.
I don't think it's right that any government monitor the internet generically, they may target specific people they are looking for info on, though... if they suspect someone to be involved in crimes over the net, then by all means let them log everything they do... but what I don't want is people reading all my personal e-mail, and knowing everything I type into my computer!

Somehow, untrustworthy as MS are, I don't think they'd run the risk of losing their reputation by letting the FBI put a keylogger in Windows Update... paranoid may have been a slight understatement?

I think it would be useful to take a long-term view of this. On one hand, as computers become more and more complex, less and less of the operation will be understandable by Mr. Does-not-devote-his-life-to-machine-code. Programs are essentially pre-packaged knowledge, the hardest part of programming is finding out how to make the computer do what you want from a few hundred tiny building blocks.

Hueristic scanning is what's going to become the rage, I think. That is, scanning to determine unfavorable code by trying to figure out what it DOES and then determine if you want it, as opposed to checking it against a known list of viruses... The problem is that you have to be smart enough to code a hueristic algorithm that detects code that other people want to be secretive.

What if you got a nice big supercomputer... had it emulate a few hundred slower computers... Whenever one of the emulated sub-systems fails... it gets wiped out and replaced with a random system that is still responding. Have some near-totally-random polymorphic code (in other words, let it be able to try to randomize it's own randomization routine, the very part of any polymorphic code that is usually never altered)...

This AV routine should be allowed to move around some dummy files (whether these still exist is part of the determination of whether a sub-system is 'failed'), but only so that it keeps a certain maximum-limited area on the disk for itself to move around in...

Then, you get programmers feeding known viruses to this little bugger.

Although it is entirely possible that you won't have the kind of evolutionary curve that would make this feasible (it might take a year before you get a version that survives it's first virus in any way but dumb luck), it would certainly be interesting.

After all, this has a parallel in nature. The most sucessful viruses are the ones which don't kill the host. You're breeding an immune system which continuously changes, and if it fails, it gets zapped and replaced with a random version of itself.

I wen't WAAAY off topic now, I guess... but as for 'Magic Lantern', Maybe some hueristic scanning... If these FBI people had been REALLY smart, they wouldn't have it as a program that is sent to the bad-guy/oppressed-guy by his relatives... Instead, they'd patch up Carnivore/DCS1000 so that the next executable file he downloads of about the right size contains the program instead. On-the-fly data replacement. Yummy.

Quote:

---

Originally posted by -=solarismka=-
If agents can decipher a suspect's pass phrase by examining what he types into his computer

---

Using "decipher" here is an abuse of language (although I'm sure everyone knows) since you don't decipher the passphrase, you merely save it…

Quote:

---

Originally posted by mr_unforgiven
PGP is not "pretty good at all" because if you knew the sequence/formula then you would know that it is a weak program to begin with!

---

What do you mean by "sequence/formula"???


Ammo

Quote:

---

Originally posted by Rewandythal
Agreed.
I don't think it's right that any government monitor the internet generically, they may target specific people they are looking for info on, though... if they suspect someone to be involved in crimes over the net, then by all means let them log everything they do...

---

We've been over this before. My major concern is who decides if someone should be monitored? A fat polotician who has lost touch with the general public? No thanks.


For example.... Just say I've just ran a search @ google for the infamous Anarchists Cookbook. Do alarm bells start ringing in some spooks office? Am I know considered a criminal? Will I be monitored? Will some Anti Terrorist Organisation kick my door down in the middle of the night?


jcdux- I don't think you're being paranoid at all. Actually, I'm quite impressed by the way you think..........:thumbsup:

OK OK I meant KNOWN CRIMINALS. I keep doing this today, not making myself clear enough.

If you're searching for stuff like the anarchists cookbook, youre most likely a 12 year old who's gonna read it then not have enough money to try anything from it [i have friends who've been there a couple three years ago!]

the govt. probably know that
But if you're exchanging millions of credit card numbers every day using PGP encrypted files, well surel;y the govt. have every right to get the key and decrypt it to stop you?

I'm talking about building evidence in ongoing investigations, not monitoring evertyones internet searches and e-mail

I disapprove of that myself, I dont want people knowing what I put in my e-mails, but i think people overreact a bit sometimes maybe.

I'm not saying don't be paranoid, but if you;ve nothing to hide, why use PGP anyway?

Rhetorical Question - cos i know everyone will try to answer it!!

Anyway all im saying is, yes be paranoid, take care of what you send to who and how, use encryption, use AV scanners and firewalls, but in the end as long as your not the FBIs most wanted, do they REALLY care that much about you?

Quote:

---

Originally posted by Rewandythal

I disapprove of that myself, I dont want people knowing what I put in my e-mails, but i think people overreact a bit sometimes maybe.
I'm not saying don't be paranoid, but if you;ve nothing to hide, why use PGP anyway?

---

I'd like to quote Negatives' signature if I may-

Trust and you'll be trusted, says the liar to the fool.

I think I'll just leave it at that. I assume that all the regulars know my position on antiprivacy laws and I won't go to the trouble of repeating myself, not to mention boring everyone...

OK. I'm starting to think more & more that all this monitoring is wrong actually... In the course of a few hours I've read up on it on the net... and My opinion is gradually changing!

Quote:

---

Originally posted by mr_unforgiven
Trust me this is not new at all and to close this out...PGP is not "pretty good at all" because if you knew the sequence/formula then you would know that it is a weak program to begin with! It is stictly logical...anything that can be ciphered can be deciphered!

---

Well, actually, no. Let's say that I make an algorithm to cipher something. Except my method of making ciphertext involves making random characters. That's it. Are you going to decipher a file made of totally random characters? :D

Do you mean PGP is weak because of: (check all that apply)

Weak Keys
Weak Algorithm
Bad implementation

Key length is pretty variable, I was given to understand. Just keep adding bits until you have it as powerful as you need, since the possibilities increase exponentially for a linear increase in key size...

As for the algorithm... What do you mean? It's PUBLIC/PRIVATE key cyptography. Just because I can encrypt a message with my key X, turning it into ciphertext, doesn't mean I can decrypt the exact same ciphertext with the same key. It is set up so that is not possible.

Basically, you can only decrypt messages made with key A with key B, and only decrypt messages made with key B by using key A to decrypt... Were you thinking that PGP was a single-key system? The algorithm code isn't secret.

Quote:

---

Originally posted by Conf1rm3d_K1ll


I have to agree......:fpissed:



Could you give me the link to the site that you got this information from?

---

The address is at www.techtv.com/news/

I was just thinking, M$ being what it is I figure that the FBI would brobably be able to crack any of the M$ Boxes and deploy the virous. But could they do it on another operating system like linux, BSD or even Apple..............


And could they crack M$ O.S's in the first place.

Attachments is one thing but what about the exploits that M$ Has.

Like in WinXP The could spoof a packet to exploit the remote Desktop Feature that comes with Xp and the off load the Virous.........

Would an anti virus software detect the problem or would they just ignore it, just because its the FBI that did it????.............

I was thinking mabe we should start writing our own Dat files. They said that it is similar to Magic Lantern. If mabe I can get my anti-virous software to detect it then maybe that in itself would give me a leg up..... Or mabe I should just change OS'es or something. Right now I'm using Win ME for my desktop and linux for my server. Mabe I should use linux for my desktop as well or mabe some BSD system????....................

Hhhhhhhhmmmmmmmmmmmmmmmm

I knew that pgp isn't all that good, there was an Open Source encription program that was better that gov't standards, damn what was it called ?????........................

What are you all people talking about saying that PGP isnt all that good??!?! Heck, it's been peer reviewed by hundreds of experts and has been an industry standard for years...

Anyone cares to explain???

In reply to ammos post about PGP.

The original algorithm for PGP was published in a scientific journal about 20/25 years ago. At the time it was accompanied by a mathematical analysis of the algorithm used, which as far as I know has not been refuted to this day. Mind you, even with a maths degree, this is pretty difficult to follow (speaking from personal experience!).

In essence you take two very large numbers (the private & public keys), and use these to do the encryption. To decrypt you need the number (private key) of the recipient. From a mathematical viewpoint it relies on the fact that you have an extremely large number X, which is made up as a result of multiplying Y * Z.
X is freely available, but to decrypt the message as an outsider you need to find out what Y or Z are. If I gave you a number that was several hundred digits long, could you tell me what two original numbers were multiplied together to create it?

Of course, the real weakness is not in the algorithm itself, but how it is used in practice (e.g. using non random keys, allowing unauthorised access to the PC etc. etc.)

Darkes,

I know... (I've read about PGP at least 5 years ago and used it ever since and understand very well how it works..)

My point in my post was to hear the story of those who claimed it "wasn't all that good"...

Of course it can be circumvented with keylogging, anything can... (Not pointing this against you Darkes) An analogy would be watching over someone's shoulder dialing in a safe's combination... Sure you can then get in the safe, but the safe worked as advertised...

Ammo

If anyone is interested just to clarify my posts about how PGP works.
To encrypt a message you use your private key, together with the recipients public key. When the recipient receives the message they, in turn, use their own private key together with your public key.
Sounds strange but you do not need to know the private key of the person who sent you the message in the first place (you'll have to work through the maths to see why that is so!).
From a mathematical point of view the only weakness is if you can somehow deduce a users private key from the public key that has been made available. In theory this is possible (one lucky guess would do it), but in practice it is very difficult.
So unless you have some criminal/terrorist intent in sending emails, PGP is pretty good (it will protect you from any hacker/ commercial organisation attempting to eavesdrop on your message). And any government would need to invest considerable effort to try and break the message, which they would be unlikely to do without good reason.

The name of this virus... Is Sub7

This "Magic Lantern" must be pretty magical. I mean, considering what -=solarismka=- said:

I was just thinking, M$ being what it is I figure that the FBI would brobably be able to crack any of the M$ Boxes and deploy the virous. But could they do it on another operating system like linux, BSD or even Apple..............

The FBI would have to implement all OS's into this one program. I mean malacious hackers/crackers do not only use M$. Unix, Linux, Apple...MS-DOS...all are reasonable OS's for carrying out a task of mass destruction. And besides that fact, how will they single out malcious online users, ...or will they just do a mass spreading of this 'virus' ...so this keylogger will infect every home/office computer in America..or even the world, for we all know here that the US shouldn't take all the credit. :cool: . And what about cracked OS's...I have alot of OS's...but I can't look you straight in the eye and tell you that my Windows2k Pro was purchased. *cough*cough*. Might not make a difference for XP since M$ can upload to your PC without you having any prior knowledge of it.
And with this infamous keylogger, how will they regulate DoS attacks. I truely don't realize (yet at least) the purpose of this program. For you could be sending a brutal attack to the FBI itself without typing any keys or even knowing that you are.
Yet in my case, PGP is "pretty good". If it wasn't...nobody would be using it. The computing world is very similar to reality. For instance, if you have to protect your "castle" from attack, you would use a solid structure like stone to build your fortification. You would know from previous structures that a wooden wall isn't the best defece when the enemy has burning arrows. So the idea was trashed. Same with PGP, if it wasn't hard to decypher it would be needless, totally useless to advancement. But it is good. From what Darkes said, you can get a pretty clear picture of what your dealing with when your using PGP.
Obviously there are ways of decyphering the "passcode". But nothings perfect, yet PGP is pretty damn near.

Quote:

---

Originally posted by [WebCarnage]
The FBI would have to implement all OS's into this one program. I mean malacious hackers/crackers do not only use M$. Unix, Linux, Apple...MS-DOS...all are reasonable OS's for carrying out a task of mass destruction. And besides that fact, how will they single out malcious online users, ...or will they just do a mass spreading of this 'virus'

---

From what I had understood, the FBI *intends* to use this as a strictly targeted infection. They will get their wiretap permission from a judge (or not, as the case may be, given the new anti-freedom pro-liberty laws (yes, there is a difference)), and then they will target a specific machine. Perhaps 'convincing' relatives of the subject into trying to infect him/her. (The usual: "We just want to find out. It could prove him/her innocent.")

So no, I doubt this will be a full effort to spread it far and wide. They will probably have different version sfor different systems, and will take the subject's OS into account.

:fu:
we're all suprised that any govern"mental" agency would want to moniter activity on the net. Who determines who to watch? Who determines who watches? do we form a secret agency to watch the secret agency? Because i ask for a search on "sensitive" material does that make me a "cyber-terrorist" suspect? or is it the quest for knowledge? Any one who thinks for a minute that we are "free" here in cyber space should look into paid E-mails for profit. and buy a few bridge's. If you conduct yourself in a manner that is less than noble, you should expect reprecusions, if you don't you should be :pissed:

Happy trails

Yeah... that's what happens when 10% of the people who could vote do vote.

Quote:

---

Originally posted by dumbdawg
:fu:
we're all suprised that any govern"mental" agency would want to moniter activity on the net. Who determines who to watch? Who determines who watches? do we form a secret agency to watch the secret agency? Because i ask for a search on "sensitive" material does that make me a "cyber-terrorist" suspect? or is it the quest for knowledge? Any one who thinks for a minute that we are "free" here in cyber space should look into paid E-mails for profit. and buy a few bridge's. If you conduct yourself in a manner that is less than noble, you should expect reprecusions, if you don't you should be :pissed:

Happy trails

---

I know I'd be on the "pissed" end of the scale :D

Good question though, who does call someone a terrorist?...........

I also have to agree on a previous post that there is probably versions of the virous for all OS's....................

The question is can someone like ourselves be able to catch them on our systems.... Nuke there virous and be on our marry way???
:jester:

It's a sad day in America (land of the free?). The sad part of all this is the american people seem to be willing to relinquish more and more of their personal liberties in the name of 'protection'. The Constitution is full of checks and limitations on the federal governments power. These were put there for a reason! If the people keep asking for the gov. to become more involved in our personal lives we are heading down a very treacherous road indeed!:(

Quote:

---

Originally posted by hillbilly75
It's a sad day in America (land of the free?). The sad part of all this is the american people seem to be willing to relinquish more and more of their personal liberties in the name of 'protection'. The Constitution is full of checks and limitations on the federal governments power. These were put there for a reason! If the people keep asking for the gov. to become more involved in our personal lives we are heading down a very treacherous road indeed!:(

---

I agree!!!!! :(