Slashdot Log In
FBI Files Brief on Scarfo Keylogger
Posted by
michael
on Wed Oct 10, 2001 11:06 AM
from the only-as-secure-as-the-weakest-link dept.
from the only-as-secure-as-the-weakest-link dept.
Firewort writes: "In an affidavit (warning, it's a PDF) filed with a federal court in New Jersey, the FBI has disclosed some of the details of a controversial "key logger system" used to obtain the encryption password of a criminal suspect. They go into great detail describing PGP and the different methods they might have used to keystroke-log Scarfo to get his encryption key." Interesting, and more technically sophisticated than the basic keyloggers which grab keystrokes indiscriminately.
This discussion has been archived.
No new comments can be posted.
FBI Files Brief on Scarfo Keylogger
|
Log In/Create an Account
| Top
| 249 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
keystroke blackbox (Score:2, Interesting)
More keyboard logging (Score:2, Interesting)
Re:More keyboard logging (Score:4, Informative)
I doubt very much that they can break 2048 bit at the moment and I think 4096 bit is secure until some serious mathematical breakthroughs (which cannot be predicted).
The NSA could have such a device for emergency purposes.
Cheaper would be an attack on the passphrase. Most people don't have so much entrophy in their passphrase. E.g. I have only about 65 bits. Of course for this you need the secret keyring, a ciphertext sample will not be enough.
Re:More keyboard logging (Score:5, Insightful)
Would not be the first diversion with that purpose: If you cannot defeat it, undermine its credibility.
Bypassing the keylogger (Score:4, Funny)
FBI recruiters who are reading this: you know where you can contact me about that job offer.
A simple keystroke logger can be elegant, too (Score:5, Insightful)
It's important to note the fact that it doesn't log all keystrokes for 2 reasons:
1) It's impressive. Less keystrokes logged that could be potential passwords, the less manpower required to examine the logs.
2) It leaves potential exploits open for crypto software writers and users in order to trick keystroke loggers into passing them over without recording the activity.
On another note, Bruce Schneier has always reminded people that a secure system always includes at least 2 out of three things: Something you know (password), something you have (ATM card), or something you are (biometrics, fingerprint).
My point is that
Keystroke loggers could be rendered ineffectual if the crypto software used was also hooked to a fingerprint scanner or a swipe card reader in addition to a password. Or, the person could just always keep the password key on a CD-ROM that they physically take with them and can destroy at a moment's notice.
Re:A simple keystroke logger can be elegant, too (Score:4, Informative)
Re:A simple keystroke logger can be elegant, too (Score:4, Informative)
Well, there's the Dallas Semiconductor iButton [ibutton.com]. It includes tamper-resistant features that will zero its RAM under certain conditions (e.g. over-temperature), although it doesn't have an actual "erase" switch.
New FBI surveilance technology (Score:1)
Doesn't it seem strange (Score:3, Informative)
I would seriously doubt that if this 'device' was capable to record every keystroke as they claim, that if they had the opportunity to sift through Scarfo's (outgoing) email/online banking/Adult-Check/etc. they wouldn't.
Re:Doesn't it seem strange (Score:5, Insightful)
A law enforcement agency, creating a tool that is designed to operate within a limited court order - shouldn't we be at least somewhat positive of this?
Scarfo's Password (Score:3, Interesting)
Re:Scarfo's Password (Score:4, Interesting)
Ctrl-V ? (Score:3, Interesting)
Re:Ctrl-V ? (Score:5, Funny)
Solution: Chargen (Score:5, Insightful)
Of course, then you're vulnerable to those things which remotely view monitors (Van-eckman scanners?). But I suppose if you're really paranoid about something like this, you would actually search for a keyboard logger first and put 3 other monitors nearby to create interference. So I guess it's all academic.
-Ted
Scarfo Used Windows (Score:5, Informative)
The affidavit says that Scarfo used a Windows OS.
Coupled with the DOJ ruling [usdoj.gov], it just goes to prove that M$ Windows is an operating system written for criminals by criminals.
Not while connected (Score:2)
scarfo keylogger (Score:5, Funny)
Fake "real" keyboard, then USB??? bwahahahar! (Score:3, Funny)
when you go to use your pc, go to another room, take out your
nice USB keyboard, then plug that in and use that instead?
Wouldn't it be funny seeing the feds puzzled faces - you've been
sending all sorts of PGP'd email in the last month, and all thier logger has registered is "haha MOFO's!!!!" - LOL!!!!
Interesting. (Score:3, Insightful)
THIS is an interesting little statement. It says nothing about what they DID use, merely what they COULD have used. And since it's probably not an exhaustive list, the actual method(s) used may or may not be contained within it.
It's important to not assume that the FBI are being malicious in what they've put in this brief, but it's equally important to verify what is being said. The FBI are not the most open organization in the world, and it would be erronious to assume that a court filing will be any more open than anything else they publish.
A peril of open source (Score:3, Insightful)
DMCA (Score:1)
Why they do not log while online ? (Score:1)
The FBI only logs keystrokes while the modem was not active:
Why ? It make no sense to me. If Scarfo did the encryption/decryption while he was online the KeyLogger would be useless.
okay let me get this straight (Score:3, Interesting)
Did anyone read that whole thing? It seems that the FBI had a keystroke logger that only came on when the modem was off, with the belief, I assume, that the computer isn't a communication device unless the modem is on.
So then the wiretap laws wouldn't apply when the modem is off? Is my interpretation correct?
Strange loophole..
hardware key loggers (Score:1)
erm... what about a password that's not text? (Score:1)
after this, it's a heck of alot better than the cutting/pasting idea, or even the manually typing it in...
i wonder scanning a mountain dew bottle would hold up in court as an encryption methond, so it's DMCA friendly
Must... not... ARGH! (Score:2)
OK,
- B
KLS: Hardware or software? (Score:1)
The affidavit does point out a tastey loophole: enter your passwords only when you're online.
Since it was Open Source PGP... (Score:1)
couldn't they've just replaced the executable/DLL with a compromised version that emails the password to the feds? Duh! The feds should be _glad_ that the source is available!
Uh... (Score:1)
FBI affidavit really says... (Score:1)
The FBI had a search warrant. Based on this they installed two or more "components" in someone's computer. The court records contain data from two "components".
The first component was key logger which recorded every thing he did. It had one odd property though. It turned off while the modem was active. This is a technicality to try to avoid needing to satisfy the much higher legal requirements for a wiretap.
The second component was much more specific. This component captured the password and related data directly from the encryption program, not from the keyboard. Password entry through copy/paste, disk, and/or mouse entry would not get around this.
The affidavit is very careful not to say if the components are hardward or software. IMO the second component has to be software.
I think the real issue is that the purpose of a search warrant is to SEARCH. It does not/should not allow installing things in/on your propery, and it does not/should not allow you to be recorded. IMO it's the same as the FBI installing video cameras all over your house based on a search warrant. It's ok though, because the cameras turn off when you're on the phone. (groan)
Backdoor in Windows? (Score:2)
Also, the obivous question: how did they install the keylogger in the firsrt place?
Any conspiracy theorists wanna bet that Microsoft has had such backdoors (eg, blank areas in KERNEL32.EXE or the like where the FBI, etc could covertly upload arbitrary code, if triggered by say, inserting a floppy with the right code in the bootsector, etc?
Hardware or Software (Score:1, Interesting)
Until recently I had thought the hardware approach more likely. It's easy to install a bug in the keyboard cable, and such devices already exist on the market.
But one passage in this affidavit caught my attention:
A hardware device would have been easy to install even if the computer wasn't "operative" (as long as it was actually there). This strongly suggests that the logger consisted either of software modules hacked into Windows, or possibly a hack to the BIOS firmware.
The software/firmware approach does have the advantage of being less easily detected by a naive user. The average Windows user wouldn't have a clue as to how to look for cleverly hacked DLLs or system programs.
Still, once the threat is known the countermeasures are pretty obvious:
Use an open-source operating system that can easily be rebuilt from trusted sources
Use Tripwire to detect modifications to system programs
Improve physical security. Use a laptop and keep it in a safe when not in use. Use IR motion detectors, to quietly log any intrustions in the vicinity of the safe and/or computer.
Anybody have any other ideas?
Why this is important... (Score:1)
"The B. got a prob cos she think she's....." (Score:1, Interesting)
> than the basic keyloggers which grab keystrokes
> indiscriminately.
If (PGP == RUNNING)
{
for (k = 0; k 256; k++)
{
if GetAsynchKeyState = -32767
log(key, time);
}
}
How sophisticated is that? Lame...
_____________________________________
Do YOU have "Nagelsvamp"?
www.nagelsvamp.nu
modem??? NETWORK!!! (Score:2, Insightful)
sim-ple.
Countertactics (Score:2)
where's the beef? (Score:1)
Conutertactics in Real-World Use (Score:1)
I use the Commonwealth Bank [commbank.com.au] for some of my online banking, and in it's previous incarnation, their NetBank service used to have a _very_ secure login interface.
It would prompt you for your 8 digit NetBank ID code, and then for your variable length PIN. When the time came to enter your PIN, it popped up a keypad on the screen, disabled keyboard input and you had to click on the keypad with the mouse. In addition, the keypad moved to a random location between every click, so you couldn't even track screen coordinates...
All in all, very secure and very annoying.
They've now gone 'back' to using standard keyboard input and SSL security.
--kai
warrant (Score:3, Insightful)
Re:For a second there... (Score:5, Insightful)
Five or six thousand people died in the attacks on the World Trade Center and the Pentagon. It is a horrid tragedy and I would never try to minimize it, but it pales to the number of people who have died [lsu.edu] defending democracy. In three of these defining wars, as tabulated below, there were over 350,000 deaths.
This only includes those killed in action or dead from wounds and doesn't include prisoners of war. It seems tremendously disrespectful to those who died creating or defending this country to relenquish our rights, rights earned through their deaths, so easily.
There are also 40,000 deaths per year in the US [cdc.gov], not through terrorism, but through automobile accidents. Would you also suggest that for safeties sake we ban the automobile?
Re:Two words (Score:1)
Re:Just because you're offline... (Score:2)
Does this make sense?
Not especially. They're just exploiting a legal technicality. They aren't allowed to intercept private communications, so they argue that a deactivated modem means no communicating is going on.
Those who forget history... (Score:1)
Re:Ok, where is it? (Score:1)
Re:why "warning"? (Score:1)
also-- im boycotting adobe still, becuase of the Russian.