[ENCRYPTION] Govs using "FinFisher" to spy on folks

[GreyGeek]

A recent report gave the details:
https://citizenlab.org/storage/finfi...ireyesonly.pdf

The FinFisher spy software claims that it can access TrueCrypt'd HDs on Windows systems that are powered down! (But I don't see how. IF the HD isn't spinning it can't be read.)

FinFisher is built on a Linux security distro called "Bactrack-Linux".
http://www.backtrack-linux.org/

FinFisher (a.k.a "FinSpy") apparently has attack vectors on Android as well, and claims to infect (Linux systems?) through "repositories".

For the curious here is an article on how to create an encrypted file system on Linux:
http://www.linux.org/threads/encrypt...ruecrypt.4478/

"You may be paranoid but that doesn't mean they aren't spying on you!"

[tek_heretik]

Hacking did not exist "since the inception of the internet", it was a couple of universities hooked together, hacking came way later. Interesting piece though, not anything I didn't already know.

[Robtygart]

The FinFisher spy software claims that it can access TrueCrypt'd HDs on Windows systems that are powered down! (But I don't see how. IF the HD isn't spinning it can't be read.)

I have herd stories like this since I got my first computer, and I am sure its true, the government is holding back, their technology is ahead of ours, I think they can do what they say.

[GreyGeek]

Before the Internet, and before Compuserv, computerphiles like myself were connecting via RBBS. Dial-up remote bulletin board services. Using your 2400 or 4800 Hayes or Zoom modem (48Kb and 56Kb connections didn't come till it was almost too late for dailups) you dialled a phone number, usually local, listened to the hand-shaking and then got the RBBS text menu (no graphical displays then, just green screen hercs). The choices were sparse. You either hung up, uploaded a file, downloaded a file, or connected to "forum" where typed conversations were live. Here in Lincoln, NE, I usually connected to the University of Nebraska's remote ag BBS service, simply because it was the only one in town at the time and geeks there also had physics and math stuff on it.

Each client computer had to connect to a separate modem card, or chip) in the host computer. Companies began making PCI cards with 4, then 8 then 16 modems on each card. A server could have 1 to 4 cards each. I never heard of a server having more than 64 connections at once, but there may have been. Compuserv took the BBS to a new level by offering 48kB and 56Kb diallups via a free access 800 number. On Compuserv I visited the hardware and OS/2 forums.

Instead of manually redialling the BBS over and over until you got a connection, a "deamon dialler" program automatically redialled a number(s) until it made a connection, then it passed the connection off to the BBS client software to complete the connection. So, you could be doing other things. I never witnessed or heard about any "hacking" on a BBS, probably because of the way phone numbers were verified and authenticated. You couldn't hide your identity. But, that didn't stop people from leaving behind various executables that did mischief if you downloaded and ran them.

When the TCP/IP protocol was adopted by ARPANET, universities and the military, and later when NFSNET was mothballed, it opened up commercialization of the existing networks in 1995. Prior to that ARPANET was just a good ole boys club. That old BBS daemon dailler became the Internet daemon logger, jumping from one IP address to the next looking for easy handshakes that didn't require passwords. That's when all the real mischief started.

Intrusions have gotten so sophisticated in the last 5 years that even Linux is susceptible to attacks above the script-kiddie level. FinFish claims it is equally effective on Linux as well. However, it also claims it can crack TrueCrypt encryption on an HD in a computer that is NOT powered up. I find that ludicrous. No spin, no access.

[NickStone]

The FinFisher spy software claims that it can access TrueCrypt'd HDs on Windows systems that are powered down! (But I don't see how. IF the HD isn't spinning it can't be read.)

I think I can top that claim.

Back in the early 90's when I was interested in how computer viruses worked and infected computers and virus scanners I received a newsletter from an anti virus company and in it had a story about a very malicious virus that claimed it could even infect computers just by having an infected disk in the office.

Now that was a claim and half!

[GreyGeek]

I think I can top that claim.

Back in the early 90's when I was interested in how computer viruses worked and infected computers and virus scanners I received a newsletter from an anti virus company and in it had a story about a very malicious virus that claimed it could even infect computers just by having an infected disk in the office.

Now that was a claim and half!

The sad part of that tale is that there are people using computers, some of whom claim to be experts, who would totally believe that claim.

[woodsmoke]

Hi GG
Possibly "powered down" is misspeak for not the windblows "not really being powered down" so that it can have "immediate on." Don't know just a thought.

woodsmoke

[GreyGeek]

The phrase "powered down" was in the FinSpy advertizing blurb, so my take is that they mean that NO electricity is making it to the power supply.

[GreyGeek]

FinSpy does not at all claim the computer is shut down.
Maybe they imply Truecrypt leaves a fingerprint in RAM, swap or a spill file after a disk has spun down.
Truecrypt is suggesting after shut down nothing is left but shutting down the Truecrypt application is not the same as the OS shutting down the HD.

http://www.f-secure.com/weblog/archives/00002601.html



The phrase "switched off target system" is an exact quote from the ad brochure. YOU have to surmize other meaning according to your experience. The ad didn't say "sleeping" or "hibernating" system. It said "switched off". Unless English has changed recently that means no power to the "target system", i.e., the computer being hacked. Is the ad's claim correctly worded? From my 40 years of experience with computers the HD has to be powered to be read and one can do that by either turning the system on or removing the HD and connecting it to another computer that is on.

Obviously the ad is lying if it is claiming that it can crack TrueCrypt security on an HD that has no power to its electronics and is not spinning. That's the point I made.

[tek_heretik]

@Grey...that's hilarious, BUSTED! lol

[SteveRiley]

Obviously the ad is lying if it is claiming that it can crack TrueCrypt security on an HD that has no power to its electronics and is not spinning. That's the point I made.

Here's how it could work. This is conjecture; I do not own one of these and of course cannot confirm the following is actual behavior.

1. The FinFly USB is bootable and also contains the file autorun.inf. On machines configured with higher USB boot priority, FinFly boots on power-on. If the machine is already powered up and the default Windows auto-run settings haven't been changed, the computer executes the program pointed to by autorun.inf upon USB insertion.

2. If the machine boots with the USB inserted, FinFly tampers with the TrueCrypt boot loader. If the machine is already running, then FinFly reads TrueCrypt passwords from memory.

The Stoned bootkit, presented at Black Hat 2009, breaks TrueCrypt. The TrueCrypt documentation itself warns users that the product cannot protect against physical access attacks. Joanna Rutkowska writes a step-by-step.

Someone has to be physically present to insert the USB drive.

[GreyGeek]

That conjecture works ONLY with power. The machine is either already running and RAM is accessable, as is the HD, or it is booted up to a USB stick, which still powers the HD regardless.

It would take some mighty powerful voodoo to extract information from an HD that isn't spinning and its interface electronics aren't getting juice.

[NickStone]

Maybe thats what is at the heart of their software... Black magic!

[GreyGeek]

Lol!

[SteveRiley]

That conjecture works ONLY with power. The machine is either already running and RAM is accessable, as is the HD, or it is booted up to a USB stick, which still powers the HD regardless.

I think whoever wrote that presentation wasn't being very precise. What I described is known as the "evil maid" attack, and does require that someone (a) not notice the USB stick and (b) power up the machine.