|
|
- If the material 'extracted' from the victims' PCs passes through a US-based server then there are two interesting 'benefits.' Firstly, the German Government has a degree of plausible deniability, in that there is no direct path from the victim to any law enforcement computer. Secondly, and much more interestingly, this gives US authorities easy access to all of the material. Who's to say that some or all of the targets are not of interest to the Germans, but to the US instead? There are plenty of three-letter-agencies who like to maintain the appearance of disinterest.
- The command-and-control channel is entirely unencrypted. To demonstrate just how easy it was to take control, the CCC hackers were able to build a replacement command server to gain better insight into the workings of the Trojan. If the CCC people can do it, so can the bad guys. What if a target computer suddenly found itself filled with kiddie-porn? What chance would the owner have of being found innocent?
- Because the use of the Trojan is clearly illegal, nothing collected by it can be admissible in court. Which leaves everyone speculating as to the intended long-term purpose (refer to the 1st point above for a possible answer).
At the time of writing, CCC noted that the Trojan was undetected by current AV software, but it would be reasonable to assume that most, if not all, major vendors now detect the package. In addition, both Sophos and F-Secure emphatically assert that they would never bow to any kind of governmental pressure to "not notice" malware such as this.
The full CCC report (20-page PDF, in German) is available here. The Trojan binaries are available here.
