6 ms·

I doubt they have capable programmers working for them. A few years ago the Chaos Computer Club discovered the 'predecessor' version of this State-Trojan ("Bund

by brakmic 11y ago

I doubt they have capable programmers working for them. A few years ago the Chaos Computer Club discovered the 'predecessor' version of this State-Trojan ("Bundestrojaner"). This version was a perfect example what happens when you _want_ to have such a software but your programmers _suck_ at even most basic things (like establishing a working traffic-encryption). Here's the video (in German): https://youtu.be/zAV-hTpperU https://youtu.be/zAV-hTpperU We shouldn't fear their 'capabilities' but rather their lack of knowledge that'll ultimately lead to 'open systems' which can later be exploited by other criminals. In fact, our State (I'm from Germany) supports criminal activities by using a crappy software that'll crack the basic security measures of Windows. I doubt they have any professional Linux programmers working for them. Working for the State also means earning only a fraction of what you can earn in the free market. I do not fear the State but criminals who'll sooner or later exploit holes created by our "security agencies".

SXX 11y ago
> I doubt they have any professional Linux programmers working for them. Working for the State also means earning only a fraction of what you can earn in the free market. Fortunately for them there is enough of commercial companies already that sell high-quality spyware to any government that able to pay for it.
- brakmic 11y ago
  Those companies also lack professional programmers. Actually, such companies sell for extremely expensive software programmed by students or consultants. The CCC disassembled the trojan and found out that they've used simple string manipulations to split Win32-APIs. For example OpenFile was split into "Open" and "File" etc.
  - raverbashing 11y ago
    In today's world we can assume that the number of programmers with deep knowledge of systems is only going to dwindle I shudder to think of code written by interns But why would they split 'Open' and 'File'?
    - kuschku 11y ago
      Obfuscation.
      - catwell 11y ago
        It is also a usual trick to avoid detection by "heuristic" antivirus software (even in legit software).
- germanier 11y ago
  The software was reportedly developed in-house with only a backup purchased from FinFisher.
DamnYuppie 11y ago
There are many companies willing to produce this type of software. As such the ability of the developers employed by the German government isn't an impediment to them doing something like this.
mrottenkolber 11y ago
I guess you are not involved in politics? There is a lot of evidence that we should be very afraid of the state if you look at Verfassungsschutz activities. They are monitoring a lot of people who oppose policy backed by the state and there is a precedent in which “opposition members” were banned from state official jobs (teachers, ...) just a few years ago. Opposition member can mean for example being involved in anti nuclear-power protests. Edit: People are also targeted for being critical of the Verfassungsschutz, so me writing this as well as you replying positively is a likely reason to be monitored, take care!
- ptaipale 11y ago
  And not just a few years ago, this is an ongoing issue. For instance, a government minister in Hessen tries to ensure that this politician from AfD (in opposition to the ruling CDU/SDP coalition) should not be able to work as a teacher. http://www.focus.de/politik/videos/er-hatte-sport-und-geschichte-unterrichtet-nach-hetzreden-hessen-will-afd-mann-hoecke-nicht-mehr-in-den-schuldienst-lassen_id_5216193.html http://www.focus.de/politik/videos/er-hatte-sport-und-geschi...
  - Xylakant 11y ago
    You're conveniently letting out the part about the racist remarks which are the actual cause. I'm all in favor of not letting racists teach children.
    - ptaipale 11y ago
      Well, very likely the same can be said about anti-nuclear protesters: they're not excluded for "political reasons", but for criminal actions which are "actual cause". Or so someone says. (Though in the case of this teacher, it looks like no crime could be cooked up). With AfD I've heard of trying to use just the political alignment as a reason (couldn't find the link just now).
      - Xylakant 11y ago
coldtea 11y ago
>We shouldn't fear their 'capabilities' but rather their lack of knowledge that'll ultimately lead to 'open systems' which can later be exploited by other criminals. We should fear their intent. Their capabilities are beside the point -- they could hire the very best tomorrow if they found they need to.
- rayiner 11y ago
  Not only that, they could take over the already-built infrastructure of tech companies tomorrow if they wanted to.
- unclebucknasty 11y ago
  Spot on. We should also fear the attempt to make such activity legal. Capabilities will evolve on all sides. The mindset that cedes the right of the state to engage in this activity and instead falls back to a position of mounting a technological defense against them is a losing one. It essentially says to the state, "it's fair game to come get whatever you can". Given enough time and intent, the unlimited resources of the state will ultimately prevail. More importantly, this is not the posture that private citizens should tolerate with their governments. This is first and foremost a legal matter. Technological capabilities are secondary.
ldehaan 11y ago
you should be afraid of This state, when the Germans decide to be complete idiots, they don't hold back. someone needs to show up at their parliament or whatever they government with, in a nazi uniform, salute the bench, and start yapping about computer security in your best hitter voice.
AJ007 11y ago
Consider the debacle Stuxnet caused when there were presumably some very capable developers working on it. Some potential outcomes of malware, poorly written or not: it spreads to other machines, it exposes information publicly which harms many third parties, it is co opted and repurposed by other criminals.
rudolf0 11y ago
Am I the only one who has no issue with these kinds of things? As long as they're treated like a regular wiretap, and only used on a crime suspect with a lawful warrant, what's the actual problem with this?
- yoo1I 11y ago
  Because by taking complete control of a suspects computer, with a software that's essentially a version of backorifice, you're mudding up all the evidence you might have found. A wiretap is completely passive. Sure one might fake that data as well, but in it's nature it's different from taking control of the whole computer, I would say.
  - rudolf0 11y ago
    Perhaps. But no-knock search warrants are also legal. The police can break into your house and put cameras or microphones in it with a warrant. Even though the process of breaking-in does affect the evidence a little, or even opens the possibility of a cop planting drugs or something, it's generally still accepted in court. This is basically the same thing as using malware for surveillance. I'd argue the malware is even less invasive.
    - terminalcommand 11y ago
      Digital evidence is IMO a different matter than physical evidence. The threshold for implanting fake digital evidence is very low. You need fewer people, you can cover your traces easily... To break-in and install cameras you need to find a suitable time where the suspect is away for a long time. And you can't always break-in to the house and change things, you won't be permitted. The monitoring of the use of these trojans is the most important problem. With a trojan horse you have access to the computer 24/7 and you can do whatever you want. Of course you could argue that police could also plant fake physical evidence, but that's a lot harder to do and you need more people. (more witnesses) There is a thin line seperating a state of law from a police state.
      - 11y ago
samstave 11y ago
I'd say the thing to fear then is the fact that these "sucky" programmers have the power of state mandate. They should be feared in that incompetence is backed by absolute power. They could do some scary stuff then... or at least they can fuck things up to such an effect that should be worrisome.
drzaiusapelord 11y ago
I don't buy the whole "real programmers would never make spyware." Who do you think made Stuxnet?
choosername 11y ago
This is so delusional and easily refuted. It doesn't matter that it isn't perfect as long as it works. Let's assume, this one example of finfisher's (IIRC) tools was used on a lesser infraction, I don' remember specifics. Why burn a good traffic encryption that the CCC would go to analyze? The use oftools that will cost more if a simpler, even faulty tool will still beat the target, is also debateable. And why are there capable programmers at the NSA, but none could be in the BSI or BND. We even know they use tools from the NSA, so where's the difference?
thirdsun 11y ago
It may sound exaggerated but when I think about it, every interaction with german government sponsored software I had, has been rather terrible. Admittedly, it weren't that many occassions, but in comparison enterprise software generally felt like progressive and forward thinking as hell. I think you have a very valid point here. Still, their intentions are worrying.
giancarlostoro 11y ago
Maybe they currently don't have capable programmers but I've definitely known programmers from Germany very capable of doing such. Whether they can hire / find them or not is another thing entirely. Indeed the issue with creating a massive backdoor into everyone's system is how insecure a backdoor can and will always be, if the wrong person exploits it you now have an entire country as a botnet?
incompatible 11y ago
I thought even Windows was more secure by default these days. Is there reason to think the German government can actually install trojans remotely, especially if you decline any offer to click on interesting emails?
- terminalcommand 11y ago
  Learning from Prism in US, I think it's highly possible. Remember the state also has control over ISPs and internet access. They can inject binary into files you download. It is very unlikely that you operate in an air-gapped computer. I've been learning some reverse engineering lately and the possibilities for injecting malicious code seem endless. If such a practice happens, people will have to live in paranoia.
- deleted 11y ago
  [deleted]
harry8 11y ago
"I do not fear the State..." That's a nice sentiment and while I hope you're correct it's not really good enough in any country. This state is Germany and it has two of the poster children for state terror in the last 100 years. The Stasi and well, there are times when Godwin's really doesn't apply. National Socialists happened and we can't pretend they didn't. Neither of these two examples did the state start out the way it became.

by brakmic 11y ago

SXX 11y ago

> I doubt they have any professional Linux programmers working for them. Working for the State also means earning only a fraction of what you can earn in the free market. Fortunately for them there is enough of commercial companies already that sell high-quality spyware to any government that able to pay for it.

brakmic 11y ago
Those companies also lack professional programmers. Actually, such companies sell for extremely expensive software programmed by students or consultants. The CCC disassembled the trojan and found out that they've used simple string manipulations to split Win32-APIs. For example OpenFile was split into "Open" and "File" etc.
- raverbashing 11y ago
  In today's world we can assume that the number of programmers with deep knowledge of systems is only going to dwindle I shudder to think of code written by interns But why would they split 'Open' and 'File'?
  - kuschku 11y ago
    Obfuscation.
    - catwell 11y ago
      It is also a usual trick to avoid detection by "heuristic" antivirus software (even in legit software).
germanier 11y ago
The software was reportedly developed in-house with only a backup purchased from FinFisher.

DamnYuppie 11y ago

There are many companies willing to produce this type of software. As such the ability of the developers employed by the German government isn't an impediment to them doing something like this.

mrottenkolber 11y ago

I guess you are not involved in politics? There is a lot of evidence that we should be very afraid of the state if you look at Verfassungsschutz activities. They are monitoring a lot of people who oppose policy backed by the state and there is a precedent in which “opposition members” were banned from state official jobs (teachers, ...) just a few years ago. Opposition member can mean for example being involved in anti nuclear-power protests. Edit: People are also targeted for being critical of the Verfassungsschutz, so me writing this as well as you replying positively is a likely reason to be monitored, take care!

ptaipale 11y ago
And not just a few years ago, this is an ongoing issue. For instance, a government minister in Hessen tries to ensure that this politician from AfD (in opposition to the ruling CDU/SDP coalition) should not be able to work as a teacher. http://www.focus.de/politik/videos/er-hatte-sport-und-geschichte-unterrichtet-nach-hetzreden-hessen-will-afd-mann-hoecke-nicht-mehr-in-den-schuldienst-lassen_id_5216193.html http://www.focus.de/politik/videos/er-hatte-sport-und-geschi...
- Xylakant 11y ago
  You're conveniently letting out the part about the racist remarks which are the actual cause. I'm all in favor of not letting racists teach children.
  - ptaipale 11y ago
    Well, very likely the same can be said about anti-nuclear protesters: they're not excluded for "political reasons", but for criminal actions which are "actual cause". Or so someone says. (Though in the case of this teacher, it looks like no crime could be cooked up). With AfD I've heard of trying to use just the political alignment as a reason (couldn't find the link just now).
    - Xylakant 11y ago

coldtea 11y ago

>We shouldn't fear their 'capabilities' but rather their lack of knowledge that'll ultimately lead to 'open systems' which can later be exploited by other criminals. We should fear their intent. Their capabilities are beside the point -- they could hire the very best tomorrow if they found they need to.

rayiner 11y ago
Not only that, they could take over the already-built infrastructure of tech companies tomorrow if they wanted to.
unclebucknasty 11y ago
Spot on. We should also fear the attempt to make such activity legal. Capabilities will evolve on all sides. The mindset that cedes the right of the state to engage in this activity and instead falls back to a position of mounting a technological defense against them is a losing one. It essentially says to the state, "it's fair game to come get whatever you can". Given enough time and intent, the unlimited resources of the state will ultimately prevail. More importantly, this is not the posture that private citizens should tolerate with their governments. This is first and foremost a legal matter. Technological capabilities are secondary.

ldehaan 11y ago

you should be afraid of This state, when the Germans decide to be complete idiots, they don't hold back. someone needs to show up at their parliament or whatever they government with, in a nazi uniform, salute the bench, and start yapping about computer security in your best hitter voice.

AJ007 11y ago

Consider the debacle Stuxnet caused when there were presumably some very capable developers working on it. Some potential outcomes of malware, poorly written or not: it spreads to other machines, it exposes information publicly which harms many third parties, it is co opted and repurposed by other criminals.

rudolf0 11y ago

Am I the only one who has no issue with these kinds of things? As long as they're treated like a regular wiretap, and only used on a crime suspect with a lawful warrant, what's the actual problem with this?

yoo1I 11y ago
Because by taking complete control of a suspects computer, with a software that's essentially a version of backorifice, you're mudding up all the evidence you might have found. A wiretap is completely passive. Sure one might fake that data as well, but in it's nature it's different from taking control of the whole computer, I would say.
- rudolf0 11y ago
  Perhaps. But no-knock search warrants are also legal. The police can break into your house and put cameras or microphones in it with a warrant. Even though the process of breaking-in does affect the evidence a little, or even opens the possibility of a cop planting drugs or something, it's generally still accepted in court. This is basically the same thing as using malware for surveillance. I'd argue the malware is even less invasive.
  - terminalcommand 11y ago
    Digital evidence is IMO a different matter than physical evidence. The threshold for implanting fake digital evidence is very low. You need fewer people, you can cover your traces easily... To break-in and install cameras you need to find a suitable time where the suspect is away for a long time. And you can't always break-in to the house and change things, you won't be permitted. The monitoring of the use of these trojans is the most important problem. With a trojan horse you have access to the computer 24/7 and you can do whatever you want. Of course you could argue that police could also plant fake physical evidence, but that's a lot harder to do and you need more people. (more witnesses) There is a thin line seperating a state of law from a police state.
    - 11y ago

samstave 11y ago

I'd say the thing to fear then is the fact that these "sucky" programmers have the power of state mandate. They should be feared in that incompetence is backed by absolute power. They could do some scary stuff then... or at least they can fuck things up to such an effect that should be worrisome.

drzaiusapelord 11y ago

I don't buy the whole "real programmers would never make spyware." Who do you think made Stuxnet?

choosername 11y ago

This is so delusional and easily refuted. It doesn't matter that it isn't perfect as long as it works. Let's assume, this one example of finfisher's (IIRC) tools was used on a lesser infraction, I don' remember specifics. Why burn a good traffic encryption that the CCC would go to analyze? The use oftools that will cost more if a simpler, even faulty tool will still beat the target, is also debateable. And why are there capable programmers at the NSA, but none could be in the BSI or BND. We even know they use tools from the NSA, so where's the difference?

thirdsun 11y ago

It may sound exaggerated but when I think about it, every interaction with german government sponsored software I had, has been rather terrible. Admittedly, it weren't that many occassions, but in comparison enterprise software generally felt like progressive and forward thinking as hell. I think you have a very valid point here. Still, their intentions are worrying.

giancarlostoro 11y ago

Maybe they currently don't have capable programmers but I've definitely known programmers from Germany very capable of doing such. Whether they can hire / find them or not is another thing entirely. Indeed the issue with creating a massive backdoor into everyone's system is how insecure a backdoor can and will always be, if the wrong person exploits it you now have an entire country as a botnet?

incompatible 11y ago

I thought even Windows was more secure by default these days. Is there reason to think the German government can actually install trojans remotely, especially if you decline any offer to click on interesting emails?

terminalcommand 11y ago
Learning from Prism in US, I think it's highly possible. Remember the state also has control over ISPs and internet access. They can inject binary into files you download. It is very unlikely that you operate in an air-gapped computer. I've been learning some reverse engineering lately and the possibilities for injecting malicious code seem endless. If such a practice happens, people will have to live in paranoia.
deleted 11y ago
[deleted]

harry8 11y ago

"I do not fear the State..." That's a nice sentiment and while I hope you're correct it's not really good enough in any country. This state is Germany and it has two of the poster children for state terror in the last 100 years. The Stasi and well, there are times when Godwin's really doesn't apply. National Socialists happened and we can't pretend they didn't. Neither of these two examples did the state start out the way it became.