Security Market Segment LS
Tuesday, 11 October 2011 00:42

Chaos Computer Club 'outs' German Government's spyware


Claiming the usual "it arrived in an anonymous brown paper bag," the Chaos Computer Club has announced the reverse engineering of what is claimed to be the German authorities' intercept malware, Quellen-TKÜ.

Assuming the CCC claims are true, German law enforcement will need a very large towel to wipe all the egg off its face. 

According to various analyses, the seemingly government-owned Trojan (as Sophos refers to it):

  • Can eavesdrop on several communication applications - including Skype, MSN Messenger and Yahoo Messenger.
  • Can log keystrokes in Firefox, Opera, Internet Explorer and SeaMonkey.
  • Can take JPEG screenshots of what appears on users' screens and record Skype audio calls.
  • Attempts to communicate with a remote website.

In fact others have observed that there are two remote IP addresses with which it is configured to communicate - both on rented servers in the USA.

Of some considerable interest is that (as the CCC reports) a German Constitutional Court ruling, on February 27 2008 forbade the use of malware to manipulate German citizen's PCs.  Furthermore, the ruling restricted such activities to software configured specifically for the surveillance target's computer; such software was not permitted to be extensible and must conform to any reasonable description of "wiretapping internet telephony."

Despite the prohibition on extensibility, the reverse engineering of the Trojan clearly showed that not only was it fully extensible, but that it was poorly written with a 'broken' implementation of AES and with its command messages (and responses) transmitted entirely in the clear.

Moreover, the Trojan included the ability to download updates from the Internet, to execute code remotely and to give remote control of the target computer to the Trojan's owner.

See the next page for more...

In the CCC's release, they state, "This refutes the claim that an effective separation of just wiretapping internet telephony and a full-blown Trojan is possible in practice - or even desired. Our analysis revealed once again that law enforcement agencies will overstep their authority if not watched carefully. In this case functions clearly intended for breaking the law were implemented in this malware: they were meant for uploading and executing arbitrary code on the targeted system."

For some time now, there have been sporadic reports (in German, Google translate gives a rather poor translation) of the German Police being in possession of information which could only have been derived from the target person's computer - this information included conversations that did not take place on PSTN lines and screen shots of the PC at a time when there were certainly no Police Officers present.

The Faz article continues (edited for clarity), "Some of those affected by the spyware apparently wanted to know more about what was happening on their computers and [understand] exactly what [...] was monitored. Thus [...] during the last [few] weeks several hard drives in the famous brown envelopes anonymously at the Chaos Computer Club.

"A forensic examination of the media by a group of CCC-hackers found on some of the hard drives [the] official computer [...] software. The Trojan variants are each very similar and exhibit only minor differences [between all the samples]. The files, which once spied on the victims, had been deleted [rather] amateurish[ly] and could be easily reconstructed with standard computer forensics tools.

There is speculation that these disks had been confiscated by the authorities and returned to the owners with the Trojan deleted.  But clearly not very well.  This speculation has yet to be confirmed.

There are many issues raised by this, not the least of which is the lack (thus far) of any confirmation that this really is the German Government's latest spying tool.

However, with the general consensus that the origin is resolved, consider the following.

With the general consensus that the origin is resolved, consider the following:

  • If the material 'extracted' from the victims' PCs passes through a US-based server then there are two interesting 'benefits.'  Firstly, the German Government has a degree of plausible deniability, in that there is no direct path from the victim to any law enforcement computer.  Secondly, and much more interestingly, this gives US authorities easy access to all of the material.  Who's to say that some or all of the targets are not of interest to the Germans, but to the US instead?  There are plenty of three-letter-agencies who like to maintain the appearance of disinterest.
  • The command-and-control channel is entirely unencrypted.  To demonstrate just how easy it was to take control, the CCC hackers were able to build a replacement command server to gain better insight into the workings of the Trojan.  If the CCC people can do it, so can the bad guys.  What if a target computer suddenly found itself filled with kiddie-porn?  What chance would the owner have of being found innocent?
  • Because the use of the Trojan is clearly illegal, nothing collected by it can be admissible in court.  Which leaves everyone speculating as to the intended long-term purpose (refer to the 1st point above for a possible answer).

At the time of writing, CCC noted that the Trojan was undetected by current AV software, but it would be reasonable to assume that most, if not all, major vendors now detect the package.  In addition, both Sophos and F-Secure emphatically assert that they would never bow to any kind of governmental pressure to "not notice" malware such as this.

The full CCC report (20-page PDF, in German) is available here.  The Trojan binaries are available here.


As part of our Lead Machine Methodology we will help you get more leads, more customers and more business. Let us help you develop your digital marketing campaign

Digital Marketing is ideal in these tough times and it can replace face to face marketing with person to person marketing via the phone conference calls and webinars

Significant opportunity pipelines can be developed and continually topped up with the help of Digital Marketing so that deals can be made and deals can be closed

- Newsletter adverts in dynamic GIF slideshow formats

- News site adverts from small to large sizes also as dynamic GIF slideshow formats

- Guest Editorial - get your message out there and put your CEO in the spotlight

- Promotional News and Content - displayed on the homepage and all pages

- Leverage our proven event promotion methodology - The Lead Machine gets you leads

Contact Andrew our digital campaign designer on 0412 390 000 or via email



Security requirements such as confidentiality, integrity and authentication have become mandatory in most industries.

Data encryption methods previously used only by military and intelligence services have become common practice in all data transfer networks across all platforms, in all industries where information is sensitive and vital (financial and government institutions, critical infrastructure, data centres, and service providers).

Get the full details on Layer-1 encryption solutions straight from PacketLight’s optical networks experts.

This white paper titled, “When 1% of the Light Equals 100% of the Information” is a must read for anyone within the fiber optics, cybersecurity or related industry sectors.

To access click Download here.


David Heath

David Heath has had a long and varied career in the IT industry having worked as a Pre-sales Network Engineer (remember Novell NetWare?), General Manager of IT&T for the TV Shopping Network, as a Technical manager in the Biometrics industry, and as a Technical Trainer and Instructional Designer in the industrial control sector. In all aspects, security has been a driving focus. Throughout his career, David has sought to inform and educate people and has done that through his writings and in more formal educational environments.



Recent Comments