Feeds

FBI docs out home-brewed spyware probes

Browser vulns optional

Security for virtualized datacentres

The FBI for at least seven years has relied on a home-brewed package of spyware to infiltrate the computers of criminals and secretly send a wide range of information to servers controlled by the bureau, according to an investigation by Wired.com.

The software, dubbed CIPAV, or computer and internet protocol address verifier, played a starring role in the investigations of a cast of criminals, including a Massachusetts man who tried to extort Verizon and Comcast by cutting off telephone, cable TV, and internet service for thousands of Boston residents and then demanding protection money. Agents trying to track the man's whereabouts were thwarted by his use of a German anonymization service until they obtained a warrant to use CIPAV in February 2005.

Although documents didn't provide the criminal's name, the facts of the case closely match those of Danny Kelly, an unemployed Massachusetts engineer who later pleaded guilty to extortion and was sentenced to five years probation.

According to a 2007 affidavit, CIPAV "gathers and reports a computer's IP address; MAC address; open ports; a list of running programs; the operating system type, version and serial number; preferred internet browser and version; the computer's registered owner and registered company name; the current logged-in user name and the last visited URL."

It then settles into silent mode, in which it surreptitiously monitors the machine's internet usage, including the IP address of every site it visits. Documents suggest that agents in some cases may exploit browser vulnerabilities to sneak CIPAV onto machines of suspects. In the case of a 15-year-old Washington state student suspected of making bomb threats, agents installed CIPAV after planting it in the private chat room on his MySpace account.

In a separate case targeting a hacker suspected of penetrating thousands of computers at Cisco, NASA's Jet Propulsion Laboratory and various US national laboratories, an agent sought approval to "plant CIPAV through an undercover operative posing as a Defense Department contractor" using a computer network connected to JPL's system, the article, penned by Kevin Poulsen, said.

Wired.com's investigation was based on 152 pages of heavily censored documents the FBI released in response to a Freedom of Information Act request. The bureau withheld another 623 pages.

The documents catalog additional cases where CIPAV has been used, including:

  • The attempted extortion of a person after the person's Hotmail account was hijacked. FBI agents obtained a search warrant allowing them to send the intruder a CIPAV to uncover the suspect's location.
  • An undercover agent's request to use CIPAV to locate the computer of a person suspected in a case involving "WMD (bomb & anthrax)."
  • The deletion of an unnamed company's database that resulted in demands for payment for it to be restored. The FBI prepared a search warrant request authorizing agents to deliver the CIPAV through the suspects Yahoo email account.

The documents suggest that the FBI sought court orders before using CIPAV.

They also show the bureau was concerned that overuse of CIPAV could ultimately result in cases being thrown out of court.

"While the technique is of indisputable value in certain kinds of cases, we are seeing indications that it is being used needlessly by some agencies, unnecessarily raising difficult legal questions (and a risk of suppression) without any countervailing benefit," warned a March 7, 2002 memo from the Justice Department's Computer Crime and Intellectual Property Section. ®

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
NOT OK GOOGLE: Android images can conceal code
It's been fixed, but hordes won't have applied the upgrade
Apple grapple: Congress kills FBI's Cupertino crypto kybosh plan
Encryption would lead us all into a 'dark place', claim G-Men
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.