Feeds

German hackers snare wiretap Trojan, accuse gov of writing it...

Who would admit to writing crappy code anyway?

5 things you didn’t know about cloud backup

German hackers have captured and analysed a cyber-sleuth Trojan which they claim may have been used by police to tap Skype calls and IM chats of criminal or terrorist suspects.

German wiretap laws do in fact permit the use of a "Bundestrojaner" ("Federal Trojan"), which has been used by police to record VoIP conversations for a few years.

But the so-called R2D2 (AKA 0zapftis) Trojan – which has not been confirmed as a creation of the German government – has far more capabilities than this, including the ability to download updates from the internet, log keystrokes, eavesdrop on IM chats and take screenshots. The backdoor function exceeds what's permissible under German law.

Sophos has said:

We have no way of knowing if the Trojan was written by the German state – and so far, the German authorities aren't confirming any involvement.

The comments in the Trojan's binary code could just as easily be planted by someone mischievously wanting the Trojan to be misidentified as the infamous Bundestrojaner.

The R2D2 Trojan was captured by the Chaos Computer Club (CCC) and made public over the weekend, sparking a huge row in privacy-sensitive Germany.

A CCC spokes-hacker said:

This refutes the claim that an effective separation of just wiretapping internet telephony and a full-blown Trojan is possible in practice – or even desired. Our analysis revealed once again that law enforcement agencies will overstep their authority if not watched carefully.

Hackers from the group reverse-engineered samples of the malware code before analysing the functions built into the software. It concludes that any machine infected by the Trojan might be easily seized by third-party hackers.

The screenshots and audio files it sends out are encrypted in an incompetent way, the commands from the control software to the Trojan are completely unencrypted. Neither the commands to the Trojan nor its replies are authenticated or have their integrity protected. Not only can unauthorised third parties assume control of the infected system, but even attackers of mediocre skill level can connect to the authorities, claim to be a specific instance of the Trojan, and upload fake data.

A English-language statement by CCC on its find can be found here. The German chancellor's press secretary denied that the R2D2 trojan has been used by the BKA, the German Federal criminal police. This denial has failed to stem speculation.

One popular theory is the Trojan might have been created by Digitask for the Bavarian government. Such speculation in interesting, though not based on any evidence outside of papers released by WikiLeaks suggesting Digitask had at least offered to create this sort of software.

Security firms say it is impossible to know who created the code from the evidence available.

Net security firm F-Secure writes:

"We have no reason to suspect CCC's findings, but we can't confirm that this Trojan was written by the German government... As far as we see, the only party that could confirm that would be the German government itself.

Anti-virus firms including F-Secure and Sophos have already added detection against the malware, along with commentary on the row (here and here, respectively). Other security outfits can be expected to follow suit; they are obliged to add detection for any blob of malware they come across regardless of who created it. Turning a blind eye to state-sponsored malware, especially in the post-Stuxnet era, would be commercial suicide. ®

Bootnote

The R2D2 name comes from a string of ASCII, "C3PO-r2d2-POE", found in the mystery Trojan. Likewise, the 0zapftis name also appears, a phrase meaning "the barrel is open" that's used by the Munich mayor in opening Oktoberfest every year.

Security firms agree with CCC that the Trojan is lame. F-Secure's Mikko Hypponen tweeted amusingly:

It's not well written. Which, I guess, makes it *more* likely it's developed by a Government...

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
JLaw, Kate Upton exposed in celeb nude pics hack
100 women victimised as Apple iCloud accounts reportedly popped
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.