FBI used spyware to catch cable-cutting extortionist

[flourbug]

FBI used spyware to catch cable-cutting extortionist

CIPAV spyware helped nab unemployed engineer angry over outsourcing



Gregg Keizer

April 18, 2009 (Computerworld) The FBI used spyware to catch a Massachusetts man who tried to extort money from Verizon Communications Inc. and Comcast Corp. by cutting 18 cables carrying voice and data in 2005, documents obtained under the Freedom of Information Act by Wired.com revealed yesterday.

Although the man's name was redacted in the documents provided to the Web site, their description of the case matches that of Danny M. Kelly, an unemployed engineer who at the time lived in Chelmsford, Mass. According to federal court records, Kelly was accused of cutting a total of 18 above-ground communications cables between November 2004 and February 2005 as part of a plot to extort money from Verizon and Comcast.

"Kelly sent a series of anonymous letters to Comcast and Verizon, in which he took responsibility for the cable cuts and threatened to continue and increase this activity if the companies did not establish multiple bank accounts for him and make monthly deposits into these accounts," the original complaint read.

According to the complaint, Kelly demanded $10,000 monthly from each company, and he told the firms to post the bank account information on a private Web page that he demanded they create.

"Both Comcast and Verizon did create the requested private Web pages in an effort to communicate with the extortionist and to gather information that might identify him," the complaint said. "When Kelly accessed the Web pages, he did so via an anonymizing Web site through which he sought to hide the Internet Protocol address of the computer he was using and therefore hide his identity."

The documents obtained by Wired.com said that the FBI obtained a warrant to use a program called Computer and Internet Protocol Address Verifier (CIPAV) to identify Kelly's computer as the one that accessed the extortion Web sites.

Details about CIPAV first surfaced in July 2007 in court records related to a case involving a rash of bomb threats e-mailed to a high school in Lacey, Wash. In a filing to the court, an FBI Special Agent said that after getting a warrant, the agency planted CIPAV on a 15-year-old's computer via a link posted to his MySpace page.

According to the agent in the affidavit, CIPAV would "cause any computer -- wherever located -- to send network-level messages containing the activating computer's IP address and/or MAC address, other environmental variables, and certain registry-type information to a computer controlled by the FBI."

However, the warrant application did not spell out whether the CIPAV captured keystrokes or injected other code into the compromised system, as do commonplace Trojan horse downloaders. "The exact nature of [the CIPAV's] commands, processes, capabilities and their configuration is classified as a law-enforcement-sensitive investigative technique," said the 2007 document.

In Kelly's case, the FBI was granted a warrant to use CIPAV on Feb. 10, 2005, said Wired.com. Later that year, Kelly pleaded guilty to extortion, was sentenced to five years probation and ordered to pay Verizon $378,000 for the damage he did.

According to the complaint filed against Kelly, he believed that "companies like Comcast and Verizon were indirectly responsible for his unemployment and dire financial situation because they worked with companies that favored foreign engineers over their counterparts and because they had indirectly stolen his intellectual property."

As part of his sentence in late 2005, Kelly was also ordered to enter a mental health program.

The court documents related to Kelly's case did not detail how the FBI managed to get CIPAV on his computer, but security researchers commenting on the Washington school bomb threat case speculated that the agency may have used an exploit -- one already in circulation or one of its own -- to plant the spyware.

http://www.computerworld.com/action/...pageNumber =1

[A.T. Hagan]

"When Kelly accessed the Web pages, he did so via an anonymizing Web site through which he sought to hide the Internet Protocol address of the computer he was using and therefore hide his identity."

Didn't work so well, did it.

.....Alan.

[flourbug]

More on CIPAV, from the Wired webiste:

Documents: FBI Spyware Has Been Snaring Extortionists, Hackers for Years
By Kevin Poulsen EmailApril 16, 2009

Cipav A sophisticated FBI-produced spyware program has played a crucial behind-the-scenes role in federal investigations into extortion plots, terrorist threats and hacker attacks in cases stretching back at least seven years, newly declassified documents show.

As first reported by Wired.com, the software, called a "computer and internet protocol address verifier," or CIPAV, is designed to infiltrate a target's computer and gather a wide range of information, which it secretly sends to an FBI server in eastern Virginia. The FBI's use of the spyware surfaced in 2007 when the bureau used it to track e-mailed bomb threats against a Washington state high school to a 15-year-old student.

But the documents released Thursday under the Freedom of Information Act show the FBI has quietly obtained court authorization to deploy the CIPAV in a wide variety of cases, ranging from major hacker investigations, to someone posing as an FBI agent online. Shortly after its launch, the program became so popular with federal law enforcement that Justice Department lawyers in Washington warned that overuse of the novel technique could result in its electronic evidence being thrown out of court in some cases.

"While the technique is of indisputable value in certain kinds of cases, we are seeing indications that it is being used needlessly by some agencies, unnecessarily raising difficult legal questions (and a risk of suppression) without any countervailing benefit," reads a formerly-classified March 7, 2002 memo from the Justice Department's Computer Crime and Intellectual Property Section.

The documents, which are heavily redacted, do not detail the CIPAV's capabilities, but an FBI affidavit in the 2007 case indicate it gathers and reports a computer's IP address; MAC address; open ports; a list of running programs; the operating system type, version and serial number; preferred internet browser and version; the computer's registered owner and registered company name; the current logged-in user name and the last-visited URL.

After sending the information to the FBI, the CIPAV settles into a silent "pen register" mode, in which it lurks on the target computer and monitors its internet use, logging the IP address of every server to which the machine connects.

The documents shed some light on how the FBI sneaks the CIPAV onto a target's machine, hinting that the bureau may be using one or more web browser vulnerabilities. In several of the cases outlined, the FBI hosted the CIPAV on a website, and tricked the target into clicking on a link. That's what happened in the Washington case, according to a formerly-secret planning document for the 2007 operation. "The CIPAV will be deployed via a Uniform Resource Locator (URL) address posted to the subject's private chat room on MySpace.com."

In a separate February 2007, Cincinnati-based investigation of hackers who'd successfully targeted an unnamed bank, the documents indicate the FBI's efforts may have been detected. An FBI agent became alarmed when the hacker he was chasing didn't get infected with the spyware after visiting the CIPAV-loaded website. Instead, the hacker "proceeded to visit the site 29 more times," according to a summary of the incident. "In these instances, the CIPAV did not deliver its payload because of system incompatibility."

The agent phoned the FBI's Special Technologies Operations Unit for "urgent" help, expressing "the valid concern that the Unsub hackers would be 'spooked.'" But two days later the hacker, or a different one, visited the site again and "the system was able to deliver a CIPAV and the CIPAV returned data."

The software's primary utility appears to be in tracking down suspects that use proxy servers or anonymizing websites to cover their tracks. That's illustrated in several cases in the documents, including the 2004 hunt for a saboteur who cut off telephone, cable TV and internet service for thousands of Boston residents. The man's name is redacted from the documents, but the description of the case matches that of Danny Kelly, an unemployed Massachusetts engineer.

According to court records, Kelly deliberately cut a total of 18 communications cables belong to Comcast, AT&T, Verizon and others over a three month period. In anonymous extortion letters to Comcast and Verizon, Kelly threatened to increase the sabotage if the companies didn't begin paying him $10,000-a-month in protection money. He instructed the companies to deposit the cash in a new bank account and post the account information to a web page he could access anonymously.

When the FBI tried to track him down from his visits to the web page, they found he was routing through a German-based anonymizer. The FBI obtained a warrant to use the CIPAV on Feb. 10, 2005, and was apparently successful. Kelly went on to plead guilty to extortion, and was sentenced to five years probation.

The CIPAV also played a previously-unreported role in an investigation of a prolific computer hacker who made headlines after penetrating thousands of computers at Cisco, various U.S. national laboratories, and NASA's Jet Propulsion Laboratory in 2005. The FBI agent leading the case sought approval to plant a CIPAV through an undercover operative posing as a Defense Department contractor "with a computer network connected to JPL's computer network," according to one document. The FBI linked the intrusions to known 16-year-old hacker in Sweden.

And in 2005, FBI agents on the Innocent Images task force hit a wall when trying to track a sexual predator who'd begun threatening the life of a teenage girl he'd met for sex. The man's IP addresses were "from all over the world" -- a sign of web proxy use. The bureau sought and won court approval to use the CIPAV on Aug. 9, 2005.

Other cases are less weighty. In another 2005 case, someone was unwisely using the name of the chief of the FBI's Buffalo, New York office to harass people online. The FBI got a warrant to use the spyware to track down the fake agent.

Additional cases include:

* In March 2006, the FBI investigated a hacker who took over a Hotmail user's account and acquired personal information. The hacker tried to extort the owner out of $10,000, demanding the victim create and fund an E-Gold account and e-mail the password to the hacker. The FBI obtained a search warrant allowing them to send the intruder a CIPAV instead, to uncover his or her location.

* In October 2005, an undercover agent working a case described as "WMD (bomb & anthrax)" communicated with the suspect via Hotmail, and sought approval from Washington to use a CIPAV to locate the subject's computer.

* In December 2005, FBI agents sought to use the spyware to track down another extortionist who sent an e-mail to a casino threatening violence.

* In June 2005, an intruder deleted a database at an unnamed company and demanded payment to restore it. The FBI prepared a search warrant affidavit and was ready to ask a judge for authorization to deliver the CIPAV through the hacker's Yahoo e-mail account. They were briefly thwarted when the intruder stopped communicating with the victim, but after a month of silence the hacker reestablished contact and, presumably, got the FBI's spyware for his trouble.

The documents appear to settle one of the questions the FBI declined to answer in 2007: whether the bureau obtains search warrants before using the CIPAV, or if it sometimes relies on weaker "pen register" orders that don't require a showing of probable cause that a crime has been committed. In all the criminal cases described in the documents, the FBI sought search warrants.

The records also indicate that the FBI obtained court orders from the Foreign Intelligence Surveillance Court, which covers foreign espionage and terrorism investigations, but the details are redacted.

The FBI released 152 heavily-redacted pages in response to Threat Level's FOIA request, and withheld another 623.

http://blog.wired.com/27bstroke6/200...yware-pro.html