In brightest day, in blackest night No evil shall escape my sight Let those who worship evil’s might Beware my power, Green Lantern’s light! No, not that one. No power rings here. Magic Lantern was the keylogger created by the FBI to gather information on bad guys. The successful use and deployment of what could only be called spyware hinged upon the cooperation of spyware detection companies, the OS software company, or the exploitation of unpatched (and presumed unpatchable) flaws in both. In fact, when MacAfee suggested they would create a hole for Magic Lantern, the shaving cream hit the fan and they lost market share. Since then everyone has been pretty quiet about government spyware. Until recently.
Last month the FBI used CIPAV (Computer and Internet Protocol Address Verifier) to track down Josh Glazebrook who was making bomb threats to his former high school. The FBI warrant says that CIPAV will record “any computer accessing electronic message(s) directed to administrator(s) of MySpace account “Timberlinebombinfo” and opening messages delivered to that account by the government.” The FBI stresses that CIPAV will not be used to gather the actual content of any messages. Quoting from the FBI affidavit: “In general, a CIPAV utilizes standard computer commands commonly used commercially over local area networks (LANs) and the Internet to request that an activating computer respond to the CIPAV by sending network level messages, and/or other variables, and/or registry information, over the Internet to a computer controlled by the FBI.” The use of the word ‘registry’ makes it pretty clear that CIPAV is a Windows tool. This raises questions about the FBI’s attack vector. Did they discover and exploit a Windows hole? Did they get MySpace and others to roll over? And why didn’t Josh’s security software alert him? He knew enough about computers to bounce his admin traffic off an Italian IP — surely he used protection. Have the AV vendors created holes for policeware? That last question has been asked of 13 security companies, and you can read their responses HERE. You won’t like some of the answers. Read the FBI application and affidavit for a search warrant HERE. Read the FBI warrant HERE.
