[ISN] FBI surveillance bonanza in BadTrans.B worm

From: InfoSec News (isnat_private)
Date: Wed Dec 19 2001 - 00:27:10 PST

  • Next message: InfoSec News: "[ISN] DIRT-Magic Lantern Firm Barred from Gov Work"

    By Thomas C Greene in Washington
    Posted: 18/12/2001 at 05:51 GMT
    Millions of Outlook and Outlook Express users have been infected by
    the BadTrans.B worm, which logs keystrokes in every open window and
    periodically sends the log files to one of several e-mail dumps,
    presumably for later retrieval by nosey hackers.
    Or Feds. According to a story from Rotten.com, an ISP which hosts one
    of the e-mail dumps, MonkeyBrains, has received a request from the FBI
    to turn over all the relevant log files.
    MonkeyBrains has instead turned the tables on the FBI by making part
    of the database available to everyone on their Web site here.
    If the story is true, then the FBI's intention is clear. They plan to
    assemble the data and grep for various key words and names in hopes of
    stumbling upon the passphrases of known and suspected evildoers. It's
    Magic Lantern on steroids, and yet it's just a dumb accident -- but
    one which could dump an absolute mother lode of otherwise forbidden
    data in the Feds' laps.
    While it's inconceivable that the FBI could get a search warrant for
    such a giant bonanza, there's nothing in the law which prevents the
    ISPs concerned from turning over the spoils voluntarily.
    At press time, MonkeyBrains claimed to have logged 5,857,277 BadTrans
    messages; and they host only one of a score of dumps.
    We've been unable to confirm the story due to temporal difficulties;  
    but we will be checking with DoJ flacks, MonkeyBrains and several
    other ISPs believed to be hosting BadTrans mail dumps. We'll post a
    follow-up to this intriguing story as soon as we get the straight
    ISN is currently hosted by Attrition.org
    To unsubscribe email majordomoat_private with 'unsubscribe isn' in the BODY
    of the mail.

    This archive was generated by hypermail 2b30 : Wed Dec 19 2001 - 12:25:31 PST