Law-enforcement DIRT Trojan released

Is this Magic Lantern?

  • alert
  • submit to reddit

Protecting against web application threats using SSL

The DIRT files Disgraced former policeman and convicted felon Frank Jones of Codex Data Systems has had his Web site hacked and his overpriced cop-spy Trojan, aptly named D.I.R.T., released to the public.

One would hope that the security community will make use of the above .zip file, provided courtesy of Cryptome's John Young, examine the product and publish a tool for making a Windows box DIRT-proof easily and effectively. The .zip contains the main executable, the installer and the user's manual. It is not a working example, as the activation key is lacking.

Jones has been hustling his rip-off product to LEAs (law-enforcement agencies) and military organizations as an elite crime-fighting tool. But in reality it's a common Trojan horse which permits over-zealous cops to upload files (i.e., plant incriminating evidence) on a victim's computer without any auditing mechanism which would record this criminal activity by the authorities. Thus it's been a hit in quarters where this sort of abuse is unlikely to be challenged, such as Asia, Africa and South America.

It's fair to say that the chief use of this tool will be to plant evidence and thus to extort confessions from targets unpopular with local and State authorities. It could also be used illicitly to produce evidence at trial, if the defense is foolish enough not to challenge it, or if the prosecution should trick the judge into keeping its details secret, as the FBI managed to do in the case of Nicodemo Scarfo and the key-logger used against him.

In that case the keylogger was not used to produce evidence intended to be introduced at trial; but the judge's willingness to keep the defense from knowing what they were dealing with has rather chilling implications in context of Jones' loathsome little Trojan. Indeed, key-logging is one of the features DIRT offers (as do BO2K and SubSeven, only for free); and there has been rumor (none of it substantiated) that DIRT was what the FBI used against Scarfo, under the name 'Magic Lantern'.

If this were true, then the FBI has been dealing with a man banned from accepting contracts with the US government, following his conviction on fraud charges for selling bogus wiretap gear, and functioning wiretap gear to persons ineligible to receive it.

Interestingly, the terms of Jones' ban allow the head of a federal agency to grant him an exception where that agency's interests would be served. Again, I must point out that the Magic Lantern connection is based on rumor, and that I personally doubt the FBI would trust Jones to fetch coffee and doughnuts for them.

Another interesting feature of DIRT is how preposterously expensive it is, going for $2,000 for a single-target version up to $30,000 for a 250-target version, and yet it accomplishes nothing that the free Trojans BO2K and SubSeven can't. As such it's one of the most monumental rip-offs we know of -- one which will, of course, be bought with taxpayers' hard-earned cash wherever it's deployed.

Jones has also been trying to cash in on the 9/11 atrocity with an atrocity of his own, a grotesquely mawkish collage on his home page, showing a grieving Dubya and images of overwhelmed firefighters superimposed over no fewer than four shots of the burning World Trade Center towers.

"Codex will provide its D.I.R.T. software for FREE to all US Law enforcement agencies, US Intelligence agencies and US Military agencies to aid in the identification and apprehension of the person or persons responsible for the events of September 11, 2001," the putatively patriotic felon says.

Of course, "US" is the key modifier here, and certainly none of these agencies will be foolish enough to use Jones' crummy product. He's only trying to give it to people who won't buy it -- and who can't buy it while he's on the contract ban list. The real market is overseas, in countries where human rights are a joke, and Jones knows this.

The 9/11 publicity scam is even more loathsome because Jones' real customers may well look at that page and imagine that US LEAs are actually using his overpriced toy.

Jones' marketing materials are filled with overstatements regarding DIRT's effectiveness and stealth. As we reported earlier, the Trojan installs three files on the victim's computer, named, by default, desktop.exe, desktop.log, and desktop.dll. However, savvy operators may well change the file names, hence the need for a proper DIRT cleaner.

The toy is apparently not effective against *nix or Mac users, though according to some of Jones' materials, it seems possible that the Mac limitation is currently being addressed, or has very recently been overcome. On the other hand, Jones' materials are always chock full of exaggeration and wishful thinking, so this may not be worth worrying about.

What is worth worrying about are the gross human rights violations this loathsome package will invite. A positively criminal tool, marketed by -- what else? -- a convicted criminal. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
prev story


Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.