[ISN] Law-enforcement DIRT Trojan released

From: InfoSec News (isnat_private)
Date: Fri Mar 15 2002 - 04:37:24 PST

  • Next message: InfoSec News: "[ISN] Koizumi Web site made visitors' data vulnerable to hackers"

    http://www.theregister.co.uk/content/55/24433.html
    
    By Thomas C Greene in Washington
    Posted: 14/03/2002 at 20:43 GMT
    
    Disgraced former policeman and convicted felon Frank Jones of Codex
    Data Systems has had his Web site hacked and his overpriced cop-spy
    Trojan, aptly named D.I.R.T., released to the public.
    
    One would hope that the security community will make use of the above
    .zip file, provided courtesy of Cryptome's John Young, examine the
    product and publish a tool for making a Windows box DIRT-proof easily
    and effectively. The .zip contains the main executable, the installer
    and the user's manual. It is not a working example, as the activation
    key is lacking.
    
    Jones has been hustling his rip-off product to LEAs (law-enforcement
    agencies) and military organizations as an elite crime-fighting tool.  
    But in reality it's a common Trojan horse which permits over-zealous
    cops to upload files (i.e., plant incriminating evidence) on a
    victim's computer without any auditing mechanism which would record
    this criminal activity by the authorities. Thus it's been a hit in
    quarters where this sort of abuse is unlikely to be challenged, such
    as Asia, Africa and South America.
    
    It's fair to say that the chief use of this tool will be to plant
    evidence and thus to extort confessions from targets unpopular with
    local and State authorities. It could also be used illicitly to
    produce evidence at trial, if the defense is foolish enough not to
    challenge it, or if the prosecution should trick the judge into
    keeping its details secret, as the FBI managed to do in the case of
    Nicodemo Scarfo and the key-logger used against him.
    
    In that case the keylogger was not used to produce evidence intended
    to be introduced at trial; but the judge's willingness to keep the
    defense from knowing what they were dealing with has rather chilling
    implications in context of Jones' loathsome little Trojan. Indeed,
    key-logging is one of the features DIRT offers (as do BO2K and
    SubSeven, only for free); and there has been rumor (none of it
    substantiated) that DIRT was what the FBI used against Scarfo, under
    the name 'Magic Lantern'.
    
    If this were true, then the FBI has been dealing with a man banned
    from accepting contracts with the US government, following his
    conviction on fraud charges for selling bogus wiretap gear, and
    functioning wiretap gear to persons ineligible to receive it.
    
    Interestingly, the terms of Jones' ban allow the head of a federal
    agency to grant him an exception where that agency's interests would
    be served. Again, I must point out that the Magic Lantern connection
    is based on rumor, and that I personally doubt the FBI would trust
    Jones to fetch coffee and doughnuts for them.
    
    Another interesting feature of DIRT is how preposterously expensive it
    is, going for $2,000 for a single-target version up to $30,000 for a
    250-target version, and yet it accomplishes nothing that the free
    Trojans BO2K and SubSeven can't. As such it's one of the most
    monumental rip-offs we know of -- one which will, of course, be bought
    with taxpayers' hard-earned cash wherever it's deployed.
    
    Jones has also been trying to cash in on the 9/11 atrocity with an
    atrocity of his own, a grotesquely mawkish collage on his home page,
    showing a grieving Dubya and images of overwhelmed firefighters
    superimposed over no fewer than four shots of the burning World Trade
    Center towers.
    
    "Codex will provide its D.I.R.T. software for FREE to all US Law
    enforcement agencies, US Intelligence agencies and US Military
    agencies to aid in the identification and apprehension of the person
    or persons responsible for the events of September 11, 2001," the
    putatively patriotic felon says.
    
    Of course, "US" is the key modifier here, and certainly none of these
    agencies will be foolish enough to use Jones' crummy product. He's
    only trying to give it to people who won't buy it -- and who can't buy
    it while he's on the contract ban list. The real market is overseas,
    in countries where human rights are a joke, and Jones knows this.
    
    The 9/11 publicity scam is even more loathsome because Jones' real
    customers may well look at that page and imagine that US LEAs are
    actually using his overpriced toy.
    
    Jones' marketing materials are filled with overstatements regarding
    DIRT's effectiveness and stealth. As we reported earlier, the Trojan
    installs three files on the victim's computer, named, by default,
    desktop.exe, desktop.log, and desktop.dll. However, savvy operators
    may well change the file names, hence the need for a proper DIRT
    cleaner.
    
    The toy is apparently not effective against *nix or Mac users, though
    according to some of Jones' materials, it seems possible that the Mac
    limitation is currently being addressed, or has very recently been
    overcome. On the other hand, Jones' materials are always chock full of
    exaggeration and wishful thinking, so this may not be worth worrying
    about.
    
    What is worth worrying about are the gross human rights violations
    this loathsome package will invite. A positively criminal tool,
    marketed by -- what else? -- a convicted criminal.
    
    
    
    -
    ISN is currently hosted by Attrition.org
    
    To unsubscribe email majordomoat_private with 'unsubscribe isn' in the BODY
    of the mail.
    



    This archive was generated by hypermail 2b30 : Fri Mar 15 2002 - 08:01:23 PST