Does the FBI have just one stock CIPAV model? The affidavit does seem to hint that the spyware comes in more flavors than just vanilla. It said, "Because the FBI cannot predict whether any particular formation of a CIPAV [emphasis ours] to be used will cause a person(s) controlling the activating computer to activate a CIPAV, I request that this Court authorize the FBI to continue using additional CIPAV's in conjunction with the target MySpace account (for up to 10 days after this warrant is authorized), until a CIPAV has been activated by the activating computer."
How did the CIPAV get onto the targeted computer? Hard to say specifically, but we can deduce some things from the affidavit and MySpace, which the CIPAV took aim at. Some user action was clearly required to infect the PC with the CIPAV. In the warrant application, the FBI used the term activate several times and alluded to a spyware plant failure if the target did not trigger the CIPAV through the targeted MySpace account.
MySpace accounts can't receive traditional e-mail, so one hacker standard - attach the CIPAV to a message and hope the recipient is stupid enough to launch it - wasn't available. Instead, the most likely tactic would have been to send a URL to the suspect account using MySpace's own instant messaging and/or Web mail system. If the suspect clicked on the link - it would have had to be enticing, so use your imagination here - and visited the FBI-owned malicious site, an exploit for a zero-day vulnerability (or unpatched one on the suspect's PC) would have let the government download CIPAV to the target hard drive.
But which vulnerability? We don't know. Conceivably, it could have been the FBI's own super-duper flaw, but Occam's razor says it was probably one of the many effective, yet run-of-the-mill, bugs in the wild. Roger Thompson, chief technology officer at Exploit Prevention Labs, took a guess. "If I had to bet, I'd bet on ANI," Thompson said in an IM interview.
Good bet. The animated cursor flaw harks back only to late March, and although Microsoft Corp. patched it in an out-of-cycle update on April 2, it's effective enough to still be used by the notorious multistrike hacker exploit kit Mpack as recently as last month, long after CIPAV was deployed.
I remember something about the FBI having something called "Magic Lantern." Any connection? Unlikely, other than as descendant. Magic Lantern was the code name given to FBI-made surveillance software in a November 2001 story broken by MSNBC.com, which outlined a keylogger-type Trojan horse to be delivered as an e-mail attachment.
But that was nearly seven years ago. To give you an idea, that news preceded major security events such as the Slammer and MyDoom worms (2003 and 2004, respectively) and the rise of phishing attacks. Government bureaucracy may move slowly, but seven-year-old security or exploit technology is nearly worthless.
Did the CIPAV work? Apparently. Before the CIPAV's appearance, bomb threats had been received by the school and school administrators on June 4, 5, 6 and 7. Until at least June 8, local police and the FBI had been stymied in their attempts to identify the sender using more traditional methods, such as requesting user information from Google Inc. and MySpace.com and contacting Italian police with a request to locate the computer routing through an Internet service provider's server there.
Once the CIPAV made an entrance, however, the case moved quickly. The warrant application was filed June 12, a Tuesday. At 2 a.m. Thursday, June 14, Lacey, Wash., police arrested an unnamed teenager in his home. The suspect, who had already been identified in news reports as a Timberline High School student, had bail set at US$100,000 in a hearing the following Monday, June 18. On July 15, after he pleaded guilty in juvenile court to charges of identity theft and making bomb threats, the teen was sentenced to 90 days' detention.
With the exception of the affidavit filed by Sanders, however, authorities remained mum throughout as to the specific part that the CIPAV played. We don't know, for instance, when the spyware was activated, whether it was activated after just one version of the CIPAV had been delivered, or what information it collected actually led the police to the boy's home.
Previous page: The FBI owns up to spyware
Related content:
Justice report finds secretive FBI data mining widespread
FBI in the dark about its own lost laptops
Collaboration key to protecting government data
FTC cracks down on alleged spyware site
icon.
