Feeds

FBI sought approval to use spyware against terror suspects

Magic Lantern reloaded

Beginner's guide to SSL certificates

Reality Bites

Would-be terrorists need only use Ubuntu Linux to avoid the ploy. And even if they stuck with Windows their anti-virus software might detect the malware. Anti-virus firms that accede to law enforcement demands to turn a blind eye to state-sanctioned malware risk undermining trust in their software, as evidenced by the fuss created when similar plans for a "Magic Lantern" Trojan for law enforcement surfaced in the US some years ago.

Graham Cluley, senior technology consultant at Sophos, said that its policy remained that it not give "special treatment" to malware written by the authorities.

"If CIPAV came into our labs we would add detection. The software would be unlikely to have a 'copywriter FBI' notice on it so it may be that we already detect it," Cluley told El Reg.

A seminal academic paper written by Fred Cohen in 1984 showed that it was mathematically impossible to write something that was undetectable, or by similar reasoning, to write a perfect antivirus scanner. Faced with that possibility law enforcement officials would have little option but to request security vendors to deliberately ignore their spyware, an approach Sophos reckons is unworkable.

"If a customer suspects they may be under surveillance and sends a Trojan horse to us, we're going to provide protection against it. We have no way of knowing if it was written by the German or US authorities and, even if we did, we wouldn't know whether it was being used by the police or if it had been commandeered by a third party wishing to spy on our customer," Cluley explained.

The picture gets even more complex if different nations develop their own law enforcement snooping software.

Cluley went on: "The Americans could theoretically write a piece of spyware to spy on criminals in its country and ask us not to detect it. The French may then ask us to detect the American spyware (in case the Americans use it against them). Who should we obey?"

"Security vendors can't play favourites," he added.

It would only require one security vendor (or indeed individual) to write a program which detects the authority's spyware and the idea of convincing the world to turn a blind eye to detecting would fall down like a house of cards, Cluley concluded.

Tapping a phone line and installing malicious code on a user's computer are sometimes compared as equivalent but important differences exist, according to Cluley. "Malicious code on a user's computer can be copied, archived, adapted and - potentially - used by people who do not work for the authorities to spy on completely innocent victims," he explained. ®

Intelligent flash storage arrays

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Shellshock over SMTP attacks mean you can now ignore your email
'But boss, the Internet Storm Centre says it's dangerous for me to reply to you'
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Business security measures using SSL
Examines the major types of threats to information security that businesses face today and the techniques for mitigating those threats.