FBI Spyware: How Does the CIPAV Work? — UPDATE

0 Comments

Following up on my story on the FBI’s computer-monitoring malware, the most interesting question unanswered in the FBI affidavit (.pdf) is how the bureau gets its “Computer and Internet Protocol Address Verifier” onto a target PC.

In the Josh Glazebrook case, the FBI sent its program specifically to Glazebrook’s then-anonymous MySpace profile, Timberlinebombinfo. The attack is described this way:

The CIPAV will be deployed through an electronic messaging program from an account controlled by the FBI. The computers sending and receiving the CIPAV data will be machines controlled by the FBI.  The electronic message deploying the CIPAV will only be directed to the administrator(s) of the “Timberinebombinfo” account.

It’s possible that the FBI used social engineering to trick Glazebrook into downloading and executing the malicious code by hand — but given the teen’s hacker proclivities, it seems unlikely he’d fall for a ruse like that. More likely the FBI used a software vulnerability, either a published one that Glazebrook hadn’t patched against, or one that only the FBI knows.

MySpace has an internal instant messaging system, and a web-based stored messaging system. (Contrary to one report, MySpace doesn’t offer e-mail, so we can rule out an executable attachment.) Since there’s no evidence the CIPAV was crafted specifically to target MySpace, my money is on a browser or plug-in hole, activated through the web-based stored messaging system, which allows one MySpace user to send a message to another’s inbox. The message can include HTML and embedded image tags.

There are several such holes to choose from. There’s an old hole — patched early last year  — in the way Windows renders WMF (Windows Metafile) images. Cyber crooks are still using it to install keyloggers, adware and spyware on vulnerable machines.  Last year it even popped up in an attack on MySpace users delivered through an ad banner.

Roger Thompson, CTO of security vendor Exploit Prevention Labs, says he’d bet on the fresher Windows animated cursor vulnerability, which was discovered being exploited by Chinese hackers last March, “and was quickly picked up by all the blackhats everywhere,” he says.

For a couple weeks, there wasn’t even a patch available for the animated cursor hole — in  April, Microsoft rushed one out.  But, of course, not everybody jumps on every Windows security update, and this hole remains one of the most popular browser bugs among black hats today, he says.

There are also holes in Apple’s QuickTime browser plug-in — fixing it means downloading and reinstalling QuickTime. Like the animated cursor hole, some of the QuickTime vulns allow an attacker to gain complete control of a machine remotely. “They might have embedded something in a QuickTime movie or something,” says Thompson.

If you have any theories, let me know. (If you know something for certain, there’s THREAT LEVEL’s secure feedback form) .

 

Update:

Greg Shipley, CTO of security consultancy Neohapsis, says it’s no surprise that anti-virus software didn’t protect Glazebrook (assuming he even ran any). Without a sample of the FBI’s code from which to build a signature, AV software would have a tough time spotting it.

Some of the more “heuristic” techniques that profile application behavior might flag it … maybe. However, IMO one of the most basic signs of good Windows Trojan design is an awareness of installed packages and default browsers, both alluded to in the text.  If the trojan is browser-aware (and in turn, potentially proxy-aware) and HTTP is used as the transport protocol, heh, you’re pretty fscked.  That’s the makings of a great covert-communications channel, and one that will do quite nicely in 99.9% of the environments out there …

In short, stock AV probably isn’t gonna flag this thing unless they got a copy of it and built a sig, neither of which is likely.

 

http://www.wired.com/threatlevel/2007/07/fbi-spyware-how/

By


Readers Comments (0)





Powered by sweet Captcha

Disclaimer & Fair Use
This website may contain copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available in efforts to advance the understanding of humanity's challenges and ideally to help uncover valid, achievable solutions for those challenges [self-imposed evolutionary limitations]. This website preserves & archives valuable information that is now more often being censored or wiped from its original source. Thus, we find this constitutes a 'fair use' of any such copyrighted material as provided for in section 107 of the US Copyright Law. In accordance with Title 17 U.S.C. Section 107, the material on this site is distributed without profit to those who have expressed a prior interest in receiving the included information for research and educational purposes. Reading the articles posted on this website represents such a request for information. Consistent with this notice you are welcome to make 'fair use' of anything you find in the archives. However, if you wish to use copyrighted material from this website for purposes of your own that go beyond 'fair use', you must obtain permission from the copyright owner. You can read more about 'fair use' and US Copyright Law at the Legal Information Institute of Cornell Law School.