Feeds

FBI sought approval to use spyware against terror suspects

Magic Lantern reloaded

Choosing a cloud hosting partner with confidence

Reality Bites

Would-be terrorists need only use Ubuntu Linux to avoid the ploy. And even if they stuck with Windows their anti-virus software might detect the malware. Anti-virus firms that accede to law enforcement demands to turn a blind eye to state-sanctioned malware risk undermining trust in their software, as evidenced by the fuss created when similar plans for a "Magic Lantern" Trojan for law enforcement surfaced in the US some years ago.

Graham Cluley, senior technology consultant at Sophos, said that its policy remained that it not give "special treatment" to malware written by the authorities.

"If CIPAV came into our labs we would add detection. The software would be unlikely to have a 'copywriter FBI' notice on it so it may be that we already detect it," Cluley told El Reg.

A seminal academic paper written by Fred Cohen in 1984 showed that it was mathematically impossible to write something that was undetectable, or by similar reasoning, to write a perfect antivirus scanner. Faced with that possibility law enforcement officials would have little option but to request security vendors to deliberately ignore their spyware, an approach Sophos reckons is unworkable.

"If a customer suspects they may be under surveillance and sends a Trojan horse to us, we're going to provide protection against it. We have no way of knowing if it was written by the German or US authorities and, even if we did, we wouldn't know whether it was being used by the police or if it had been commandeered by a third party wishing to spy on our customer," Cluley explained.

The picture gets even more complex if different nations develop their own law enforcement snooping software.

Cluley went on: "The Americans could theoretically write a piece of spyware to spy on criminals in its country and ask us not to detect it. The French may then ask us to detect the American spyware (in case the Americans use it against them). Who should we obey?"

"Security vendors can't play favourites," he added.

It would only require one security vendor (or indeed individual) to write a program which detects the authority's spyware and the idea of convincing the world to turn a blind eye to detecting would fall down like a house of cards, Cluley concluded.

Tapping a phone line and installing malicious code on a user's computer are sometimes compared as equivalent but important differences exist, according to Cluley. "Malicious code on a user's computer can be copied, archived, adapted and - potentially - used by people who do not work for the authorities to spy on completely innocent victims," he explained. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.