Feeds

FBI sought approval to use spyware against terror suspects

Magic Lantern reloaded

High performance access to file storage

Reality Bites

Would-be terrorists need only use Ubuntu Linux to avoid the ploy. And even if they stuck with Windows their anti-virus software might detect the malware. Anti-virus firms that accede to law enforcement demands to turn a blind eye to state-sanctioned malware risk undermining trust in their software, as evidenced by the fuss created when similar plans for a "Magic Lantern" Trojan for law enforcement surfaced in the US some years ago.

Graham Cluley, senior technology consultant at Sophos, said that its policy remained that it not give "special treatment" to malware written by the authorities.

"If CIPAV came into our labs we would add detection. The software would be unlikely to have a 'copywriter FBI' notice on it so it may be that we already detect it," Cluley told El Reg.

A seminal academic paper written by Fred Cohen in 1984 showed that it was mathematically impossible to write something that was undetectable, or by similar reasoning, to write a perfect antivirus scanner. Faced with that possibility law enforcement officials would have little option but to request security vendors to deliberately ignore their spyware, an approach Sophos reckons is unworkable.

"If a customer suspects they may be under surveillance and sends a Trojan horse to us, we're going to provide protection against it. We have no way of knowing if it was written by the German or US authorities and, even if we did, we wouldn't know whether it was being used by the police or if it had been commandeered by a third party wishing to spy on our customer," Cluley explained.

The picture gets even more complex if different nations develop their own law enforcement snooping software.

Cluley went on: "The Americans could theoretically write a piece of spyware to spy on criminals in its country and ask us not to detect it. The French may then ask us to detect the American spyware (in case the Americans use it against them). Who should we obey?"

"Security vendors can't play favourites," he added.

It would only require one security vendor (or indeed individual) to write a program which detects the authority's spyware and the idea of convincing the world to turn a blind eye to detecting would fall down like a house of cards, Cluley concluded.

Tapping a phone line and installing malicious code on a user's computer are sometimes compared as equivalent but important differences exist, according to Cluley. "Malicious code on a user's computer can be copied, archived, adapted and - potentially - used by people who do not work for the authorities to spy on completely innocent victims," he explained. ®

High performance access to file storage

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.