Feeds

German hackers snare wiretap Trojan, accuse gov of writing it...

Who would admit to writing crappy code anyway?

Secure remote control for conventional and virtual desktops

German hackers have captured and analysed a cyber-sleuth Trojan which they claim may have been used by police to tap Skype calls and IM chats of criminal or terrorist suspects.

German wiretap laws do in fact permit the use of a "Bundestrojaner" ("Federal Trojan"), which has been used by police to record VoIP conversations for a few years.

But the so-called R2D2 (AKA 0zapftis) Trojan – which has not been confirmed as a creation of the German government – has far more capabilities than this, including the ability to download updates from the internet, log keystrokes, eavesdrop on IM chats and take screenshots. The backdoor function exceeds what's permissible under German law.

Sophos has said:

We have no way of knowing if the Trojan was written by the German state – and so far, the German authorities aren't confirming any involvement.

The comments in the Trojan's binary code could just as easily be planted by someone mischievously wanting the Trojan to be misidentified as the infamous Bundestrojaner.

The R2D2 Trojan was captured by the Chaos Computer Club (CCC) and made public over the weekend, sparking a huge row in privacy-sensitive Germany.

A CCC spokes-hacker said:

This refutes the claim that an effective separation of just wiretapping internet telephony and a full-blown Trojan is possible in practice – or even desired. Our analysis revealed once again that law enforcement agencies will overstep their authority if not watched carefully.

Hackers from the group reverse-engineered samples of the malware code before analysing the functions built into the software. It concludes that any machine infected by the Trojan might be easily seized by third-party hackers.

The screenshots and audio files it sends out are encrypted in an incompetent way, the commands from the control software to the Trojan are completely unencrypted. Neither the commands to the Trojan nor its replies are authenticated or have their integrity protected. Not only can unauthorised third parties assume control of the infected system, but even attackers of mediocre skill level can connect to the authorities, claim to be a specific instance of the Trojan, and upload fake data.

A English-language statement by CCC on its find can be found here. The German chancellor's press secretary denied that the R2D2 trojan has been used by the BKA, the German Federal criminal police. This denial has failed to stem speculation.

One popular theory is the Trojan might have been created by Digitask for the Bavarian government. Such speculation in interesting, though not based on any evidence outside of papers released by WikiLeaks suggesting Digitask had at least offered to create this sort of software.

Security firms say it is impossible to know who created the code from the evidence available.

Net security firm F-Secure writes:

"We have no reason to suspect CCC's findings, but we can't confirm that this Trojan was written by the German government... As far as we see, the only party that could confirm that would be the German government itself.

Anti-virus firms including F-Secure and Sophos have already added detection against the malware, along with commentary on the row (here and here, respectively). Other security outfits can be expected to follow suit; they are obliged to add detection for any blob of malware they come across regardless of who created it. Turning a blind eye to state-sponsored malware, especially in the post-Stuxnet era, would be commercial suicide. ®

Bootnote

The R2D2 name comes from a string of ASCII, "C3PO-r2d2-POE", found in the mystery Trojan. Likewise, the 0zapftis name also appears, a phrase meaning "the barrel is open" that's used by the Munich mayor in opening Oktoberfest every year.

Security firms agree with CCC that the Trojan is lame. F-Secure's Mikko Hypponen tweeted amusingly:

It's not well written. Which, I guess, makes it *more* likely it's developed by a Government...

New hybrid storage solutions

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.