Magic Lantern (FBI Keystroke logger)

Trojan

This has been discussed on a couple of crypto/sec lists[1] for quite a while now, zdnet have finally caught up with the story:

http://dailynews.yahoo.com/h/zd/20011205/tc/warning_we_know_what_you_re_typing_and_so_does_thefbi__1.html

Some comments:

> The FBI
>would want to guard against two other possibilities: Future antivirus
>software detecting an installed ML, and future antivirus software
>detecting an attempt to install ML.

There's a balancing act here: Do you risk your Trojan being discovered by
McAfee and Symantec, or do you risk someone blabbing when you ask them to
avoid blocking it, when the odds are they won't block it in the
foreseeable future?

Given what I know of leaks to the media I wouldn't even think of
approaching the AV companies about this.

Also the fact that Norton AV would make a killing when ppl don't trust the other 2.

1. "cryptography-request@wasabisystems.com" with a one-line message saying "subscribe" amongst others.

[edit]vbb borked my link[/edit]

ConUladh

Also the fact that Norton AV would make a killing when ppl don't trust the other 2

The other 2 being McAfee and Symantec? Isn't Norton Symantec's AV product?

Think this all started when someone at one of company's commented on the possibility of allowing FBI keyloggers through, hope for the company's sake that his day job isn't PR, it's not going to happen cause no-one would wnat the product

Koopa

anyone who relies on anti-virus software to protect against trojans or keyloggers (as long as they dont try to infect other files virus-style) needs their head examined anyway

moist

Originally posted by Koopa
anyone who relies on anti-virus software to protect against trojans or keyloggers (as long as they dont try to infect other files virus-style) needs their head examined anyway

Well the article indicates that the keylogger may most likely be distributed as trojans within email.
Which I think is rather funny!
Perhaps the FBI et. al. _encourage_ vulnerabilities in software
so that they can slip in the back way
hmm...

Well at least a virus scanner is better than nothing.
Can't they check programmes for known virii/trojans before they will allow them run ?
Havn't playes with scanners in a while, I forget what they do...

Mind you, there is little you can do to stop someone who can get physical access to your
machine and has the funding and potential technical resourses of someone like the FBI...

Koopa

how is the virus scanner going to know what to look for in a trojan?
most virus scanners find viruses which are not in their database only because the viruses try to copy bits of themselves onto other files, and get caught doing it
that tactic doesnt even work for all viruses, virus scanners rely heavily on their internet databases of virus to be up to date.. its useless to rely on a virus scanner to protect you vs a "non-generic" trojan/virus