|
|
According to various analyses, the seemingly government-owned Trojan (as Sophos refers to it):
- Can eavesdrop on several communication applications - including Skype, MSN Messenger and Yahoo Messenger.
- Can log keystrokes in Firefox, Opera, Internet Explorer and SeaMonkey.
- Can take JPEG screenshots of what appears on users' screens and record Skype audio calls.
- Attempts to communicate with a remote website.
In fact others have observed that there are two remote IP addresses with which it is configured to communicate - both on rented servers in the USA.
Of some considerable interest is that (as the CCC reports) a German Constitutional Court ruling, on February 27 2008 forbade the use of malware to manipulate German citizen's PCs. Furthermore, the ruling restricted such activities to software configured specifically for the surveillance target's computer; such software was not permitted to be extensible and must conform to any reasonable description of "wiretapping internet telephony."
Despite the prohibition on extensibility, the reverse engineering of the Trojan clearly showed that not only was it fully extensible, but that it was poorly written with a 'broken' implementation of AES and with its command messages (and responses) transmitted entirely in the clear.
Moreover, the Trojan included the ability to download updates from the Internet, to execute code remotely and to give remote control of the target computer to the Trojan's owner.
See the next page for more...
