Feeds

German states defend use of 'Federal Trojan'

Skype-snooping Bundestrojaner legal, insists gov

SANS - Survey on application security programs

Five German states have admitted using a controversial backdoor Trojan to spy on criminal suspects.

Samples of the so-called R2D2 (AKA "0zapftis") Trojan came into the possession of the Chaos Computer Club (CCC), which published an analysis of the code last weekend.

German federal law allows the use of malware to eavesdrop on Skype conversations. But the CCC analysis suggests that the specific Trojan it wrote about is capable of a far wider range of functions than this – including establishing a backdoor on compromised machines and keystroke logging. The backdoor creates a means for third parties to hijack compromised machines, while the lack of encryption creates a mechanism for miscreants to plant false evidence. The CCC slams the code as being both "amateurishly written" and illegal.

Although the Federal police denied using this specific Trojan, at least five German states – including Baden-Württemberg, Brandenburg, Schleswig-Holstein, Bavaria and Lower Saxony – have admitted that local police have used the spyware, Deutche Welle reports. The so-called "Bundestrojaner" (Federal Trojan) has been used in criminal cases, some involving drug investigations, for around two years.

Local government officials said the Trojan was used within the law, contrary to CCC's claims. Bavarian Interior Minister Joachim Herrmann said local authorities had acted within the law but nonetheless offered to review the use of the technology.

Justice Minister Sabine Leutheusser-Schnarrenberger said that federal and state governments ought to mount a joint investigation into the technology.  The sample of the Trojan obtained by the CCC was apparently placed on a suspect's laptop when he passed through customs at the Munich International airport. German lawyer Patrick Schladt, the defence lawyer in the case, handed over the laptop to the CCC, with the permission of his client.

Documents leaked via WikiLeaks suggest that the German Customs Investigation Bureau purchased surveillance services from German software developer DigiTask valued at more than €2m. The same set of documents suggest that DigiTask develop a commercial Trojan intended for law enforcement called Skype Capture Unit. This is significant because the installer file uses the filename scuinst.exe, short for Skype Capture Unit Installer.

Net security firm F-Secure hasn't seen the Trojan in the wild but it has seen the installer file numerous times since December 2010. That's because the installer was submitted to VirusTotal multiple times. VirusTotal analyses suspicious files using multiple antivirus engines. The service shares uploaded files with participating security firms, so anyone who uploaded the file must have cared little about keeping the technology secret and therefore effective for longer, or they were incompetent, as net security firm F-Secure notes.

Net security firm Sophos has put together a well-written and compressive FAQ on the R2D2 (AKA "0zapftis") Trojan here. ®

High performance access to file storage

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.