The Feds have a little software update for you! Click here!

Meh? let 'em have that floppy disk drive in an old IBM.

It's the cheapest, and one of the better hardware firewall solutions out there.



 

Wait, they said it doesn't record content...

Then how could they of possibly known that it was HIM who did the threats if all they did was scan his computer information, rather than read the content?

Isn't the smoking gun him typing "haha dude u kno snt thos threats to skool? haha". And since when do keyloggers not log "content of electronic communications"?

Edit: Hahaha, I love 15 year old crackers (hackers), I use to be one until I got caught by the INTERPOL which then told the FBI which then told my mother. That's what you get for shutting down multiple web servers, an IRC Server, and trojaning 13 computers just to see what files they have. (Which aren't located in the US...) I smiled when I read he DoS-ed...

[edit on 20-7-2007 by Vinci]

Originally posted by Vinci
Edit: Hahaha, I love 15 year old crackers (hackers), I use to be one until I got caught by the INTERPOL which then told the FBI which then told my mother. That's what you get for shutting down multiple web servers, an IRC Server, and trojaning 13 computers just to see what files they have. (Which aren't located in the US...) I smiled when I read he DoS-ed...

[edit on 20-7-2007 by Vinci]

really? you got busted by INTERPOL and they told the feds, and the feds just, told your mom? that doesnt seem right to me...hell i used to know a guy in highschool that got busted creating Admin accounts on the school network and screwing with it, his life got messed up right after. He was under house arrest, couldnt go near a PC in the school, had to go to court a whole bunch of times...I dont want to call you a lier, but that whole senario doesnt sound very realistic.

Well, the whole story is I got caught shutting down an IRC server and this guy from Australia reported me, and it got to the FBI and they discovered all I did, but I was really young and the damage I did wasn't THAT horrible...everything I did wasn't beyond repair...

Ended with letters/my online activity being monitored directly for 90 days/me not being able to use the internet at school...and I think something about the library's internet but I didn't use the library back then anyway.

Originally posted by InSpiteOf
I can see the pratical applications for such a thing, but man this has far reaching implications too. An undetectable rootkit, i figured such existed, but hoped the use of such a program would be limited.

I dont really think im on an FBI watchlist to warrent such a program on my PC, but it still scares the hell out of me. Do you know of any way to detect it outside of the firewall rules and virus definitions? Hell would anti-virus software vendors even classify this as a virus considering its use in law enforcement?

There are some good rootkit detection programs out there that will find all sorts of stuff anti-virus/anti-spyware will not. I use Anti-vira (german) - it's an anti-virus program, but it also has a good rootkit detector built in...my advice? Use it.

J.

Originally posted by DazedDave

Originally posted by NoobieDoobieDo
Avoid the problem all together : Use Linux or Unix.

Or even better...Don't be a terrorist.

Or be left wing. Or criticise your government...or, or.... Orwell anyone?

J.

Originally posted by Tom Bedlam

Originally posted by InSpiteOf
Im sorry i need a little more clarification. From the way im reading this sentence, your saying if my firewall or virus scanner was installed first, it could potentially detect this rootkit?

Can you also recomend a relatively inexpensive hardware firewall?

Oh, sorry, I wasn't very clear about that. In terms of rootkits, the first rootkit in can pretty much hide from anything. In terms of user programs, they have a tough time detecting a rootkit ever.

You could conceivably build a pretty good rootkit detector if it was guaranteed to be the first one that loaded.

There are some freeware rootkit detectors of varying degrees of capability.

We run one from Microsoft, you can get it free here.
I don't know if it would spot CIPAV. I've seen "defender" mysteriously fail to spot some programs on purpose, so it's possible that this would also, caveat emptor.

There's a nice document at that link that describes how it works. We are writing a rootkit here that does something beneficial (you'd install it on purpose), and we use this program to see if we can be spotted.

As far as hardware firewalls go, ours is actually a pretty capable Linux computer system that sits in a rack with the servers so it wasn't cheap. It watches for all sorts of different attacks, not that you couldn't get something past it, I suspect.

If I get some time I will look around and see if there's anything in the home user market.

PS - when you run Rootkit Revealer, it will list a lot of stuff even if you don't have an infection - use discretion if you start deleting stuff, some of it is necessary for you to run!


My only thought about this is that MS have been playing ball with the Bush government for years. If there's one rootkit detector that WON'T find it - it's probably this one in my estimation..

J.
[edit on 19-7-2007 by Tom Bedlam]

Originally posted by jimbo999

My only thought about this is that MS have been playing ball with the Bush government for years. If there's one rootkit detector that WON'T find it - it's probably this one in my estimation..

Yeah, that's why I said that bit about Defender mysteriously not picking up some malware. You'd think that MS could spot any sort of infection, yet there are "semi malware" packages that it shuffles right on past, and that are caught by other scanners such as AdAware or Spybot. I have heard and don't really doubt that MS is either paid or legally threatened by some of these guys and just ... doesn't detect them.

I have an old copy of rootkit revealer that was done before MS borg'ed them. But I'm pretty sure we are going to be able to hide from these guys eventually with our own rootkit, so I'd expect if we were working on it full time with maybe MS's consent/help we could have had it long ago. My impression at the moment is, the first rootkit in can hide from damn near anything if done properly, except an inspection of the filesystem done by another machine.

Originally posted by InSpiteOf
I can see the pratical applications for such a thing, but man this has far reaching implications too. An undetectable rootkit, i figured such existed, but hoped the use of such a program would be limited.

I dont really think im on an FBI watchlist to warrent such a program on my PC, but it still scares the hell out of me. Do you know of any way to detect it outside of the firewall rules and virus definitions? Hell would anti-virus software vendors even classify this as a virus considering its use in law enforcement?

Mod Edit: BB Code.

Mod Note: ATS Handbook – Please Review This Link.



[edit on 24/7/2007 by Mirthful Me]

Mirthful, im pretty sure the entire post that jimbo put up was by me. I think he ment to add something to it afterwards but just didnt...

reply to post by Tom Bedlam


Updates on CIPAV in the current news via FOIA documents.

FBI spyware used to nab hackers, extortionists

April 17, 2009

The FOIA documents indicate that the FBI turns to CIPAV when a suspect is communicating with police or a crime victim through e-mail and is using an anonymizing service to conceal his computer's Internet protocol address. If an anonymizing service had not been used, then a subpoena to the e-mail provider would normally be sufficient.

Documents: FBI Spyware Has Been Snaring Extortionists, Hackers for Years

April 16, 2009

the documents released Thursday under the Freedom of Information Act show the FBI has quietly obtained court authorization to deploy the CIPAV in a wide variety of cases, ranging from major hacker investigations, to someone posing as an FBI agent online. [...]

it gathers and reports a computer's IP address; MAC address; open ports; a list of running programs; the operating system type, version and serial number; preferred internet browser and version; the computer's registered owner and registered company name; the current logged-in user name and the last-visited URL.

After sending the information to the FBI, the CIPAV settles into a silent "pen register" mode, in which it lurks on the target computer and monitors its internet use, logging the IP address of every server to which the machine connects.

[edit on 4/18/09 by makeitso]