Free Republic
Browse · Search
News/Activism
Topics · Post Article

Skip to comments.

A visit from the FBI
SecurityFocus ^ | 1/21/2004 | Scott Granneman

Posted on 1/30/2004, 3:33:13 AM by justlurking

Well, it finally happened. Right before Christmas, I had a little visit from the FBI. That's right: an agent from the Federal Bureau of Investigation came to see me. He had some things he wanted to talk about. He stayed a couple of hours, and then went on his way. Hopefully he got what he wanted. I know I did.

Let me explain. I teach technology classes at Washington University in St. Louis, a fact that I mentioned in a column from 22 October 2003 titled, "Joe Average User Is In Trouble". In that column, I talked about the fact that most ordinary computer users have no idea about what security means. They don't practice secure computing because they don't understand what that means. After that column came out, I received a lot of email. One of those emails was from Dave Thomas, former chief of computer intrusion investigations at FBI headquarters, and current Assistant Special Agent in Charge of the St. Louis Division of the FBI.

Dave had this to say: "I have spent a considerable amount in the computer underground and have seen many ways in which clever individuals trick unsuspecting users. I don't think most people have a clue just how bad things are." He then offered to come speak to my students about his experiences.


I did what I think most people would do: I emailed Dave back immediately and we set up a date for his visit to my class.

The easiest way to illegally acquire money now is through the use of online tools like Trojans, or through phishing: set up a fake Web site for PayPal or eBay or Amazon...


It's not every day that I have an FBI agent who's also a computer security expert come speak to my class, so I invited other students and friends to come hear him speak. On the night of Dave's talk, we had a nice cross-section of students, friends, and associates in the desks of my room, several of them "computer people," most not.

Dave arrived and set his laptop up, an IBM ThinkPad A31. He didn't connect to the Internet - too dangerous, and against regulations, if I recall - but instead ran his presentation software using movies and videos where others would have actually gone online to demonstrate their points. While he was getting everything ready, I took a look at the first FBI agent I could remember meeting in person.


Dave is from Tennessee, and you can tell. He's got a southern twang to his voice that disarms his listeners. He talks slowly, slightly drawling his vowels, and it sort of takes you in, making you think he's not really paying attention, and then you realize that he knows exactly what he's doing, and that he's miles ahead of you. He wears a tie, but his suit is ready to wear and just a bit wrinkled. His dark hair is longer than you'd think, hanging below his collar, further accentuating the country-boy image, but remember, this country boy knows his stuff. All in all, he gives off the air of someone who's busy as heck, too busy to worry about appearances, and someone who's seen a lot of things in his time.

A-cracking we will go

Dave focused most of his talk on the threats that ordinary computer users face: what those threats are, who's behind them, and why they exist. He spent quite a bit of time talking about the intersection of Trojans and viruses. He started by showing us how easy it is to create a virus, using one of several virus creation wizards that can be easily found on the Net (of course, real men and women write their own).

More and more, however, the viruses circulating on the Internet are quite purposeful in design. The goal is to install a Trojan on the unsuspecting user's machine that will then allow the bad guy to control the machine from afar, turning it into a Zombie machine under the control of another. All too often, this tactic is successful. Hundreds of thousands if not millions of machines are "owned" by someone other that the user sitting in front of the keyboard and monitor.

These Trojans are often the ones that security pros have been watching for years: SubSeven, Back Orifice, and NetBus. A lot of the time, script kiddies are the ones behind these Trojans,

and they do the usual stuff once they have control of a user's PC: grab passwords, use groups of machines to organized DDOS attacks (often against other script kiddies), and jump from machine to machine to machine in order to hide their tracks.

What surprised me, however, were how often Trojans are used to mess with the heads of the poor unsuspecting suckers who own the zombie machines. A favorite trick is to surreptitiously turn on the Webcam of an owned computer in order to watch the dupe at work, or watch what he's typing on screen. This part isn't surprising. But Dave had countless screenshots, captured from impounded machines or acquired online from hacker hangouts, where the script kiddie, after watching for a while, just can't help himself any longer, and starts to insult or mock or screw with the duped owner.



In one, a hacker sent a WinPopup message to a fellow: "Hey, put your shirt back on! And why are you using a computer when there's a girl on your bed!" Sure enough, the camera had captured a guy using his computer, sans shirt, and in the background you could clearly see a young woman stretched out on a bed.

In another, a man was working a crossword puzzle online when the hacker helpfully suggested a word for 14 Down (I think it was "careless"), again using WinPopup. In a third, a screenshot captured the utterly shocked expression on a man's face - mouth agape, eyes open wide in amazement - when his computer began insulting him using, you guessed it, WinPopup.

This is bad enough and it's also cruelly funny, but the scary part came in when Dave started talking about the other group behind the explosion of viruses and Trojans: Eastern European hackers, backed by organized crime, such as the Russian mafia. In other words, the professionals.

These people are after one thing: money. The easiest way to illegally acquire money now is through the use of online tools like Trojans, or through phishing: set up a fake Web site for PayPal or eBay or Amazon, and then convince the naíve to enter their usernames, passwords, and credit card information. Viruses and spam also intersect in this nasty spiderweb. Viruses help spread Trojans, and Trojans are used to turn unsuspecting users' computers into spam factories, or hosts for phishing expeditions, and thus furthering the spread of all the elements in this process: viruses, Trojans, spam, and phishing. It's a vicious cycle, and unfortunately, it appears to be getting worse. The FBI is working as hard as it can, but the nations of Eastern Europe are somewhat powerless to solve the problem at this time.

One way to trace just how bad the situation has gotten: track the price for a million credit card numbers. Just a few years ago, Dave saw prices of $100 or more for a million stolen credit card numbers. Now? Pennies. Stealing credit cards is so easy, and so rampant, that prices have dropped precipitously, in a grotesque parody of capitalist supply and demand.


Along with this comes intrusions into banks and other financial institutions. Dave wouldn't name names, but he said several organizations that we would all know have been infiltrated electronically by Eastern Europeans, who then grab customer data. A few days later, the unsuspecting president of the bank gets an email demanding $50,000, or else the media will be told of the break-in. Of course, the break-in is news to the bank. As proof of their exploit, a spreadsheet is attached to the email, with a few hundred rows of client data: bank account numbers, home addreses, balances.

Unfortunately, many banks decide to keep it all a secret from their customers, so they reluctantly decide to go ahead and pay the extortion. $50,000 goes to the criminals, and the bank breathes a sigh of relief.

Three days later, ten emails arrive, from ten different criminal organizations, each demanding $25,000. Ooops. Far from buying protection, the bank revealed itself as a easy mark, amenable to blackmail. And it will only get worse. Time to call in the FBI, as it should have done from the beginning.

American companies have tried to respond to the massive fraud being perpetrated online. One common preventive, adopted by most companies that sell products online, has been to refuse shipments outside of North America, or allow international shipping, except for Eastern Europe. Criminals have figured out a way around this, however. They hire folks to act as middlemen for them. Basically, these people get paid to sit at home, sign for packages from Dell, Amazon, and other companies, and then turn around and reship the packages to Russia, Belorussia, and Ukraine. You know those signs you see on telephone poles that read "Make money! Work at home!"? A lot of that "work" is actually laundering products for the Russian mob. Of course, anyone caught acting as a middleman denies knowledge of their employer: "I had no idea why I was shipping 25 Dell computers a day to Minsk! I just assumed they liked computers!"

Proof once again that social engineering, coupled with greed, is the easiest way to subvert any security.


Some surprises

Dave had some surprises up his sleeve as well. You'll remember that I said he was using a ThinkPad (running Windows!). I asked him about that, and he told us that many of the computer security folks back at FBI HQ use Macs running OS X, since those machines can do just about anything: run software for Mac, Unix, or Windows, using either a GUI or the command line. And they're secure out of the box. In the field, however, they don't have as much money to spend, so they have to stretch their dollars by buying WinTel-based hardware. Are you listening, Apple? The FBI wants to buy your stuff. Talk to them!

Dave also had a great quotation for us: "If you're a bad guy and you want to frustrate law enforcement, use a Mac." Basically, police and government agencies know what to do with seized Windows machines. They can recover whatever information they want, with tools that they've used countless times. The same holds true, but to a lesser degree, for Unix-based machines. But Macs evidently stymie most law enforcement personnel. They just don't know how to recover data on them. So what do they do? By and large, law enforcement personnel in American end up sending impounded Macs needing data recovery to the acknowledged North American Mac experts: the Royal Canadian Mounted Police. Evidently the Mounties have built up a knowledge and technique for Mac forensics that is second to none.

(I hope I'm not helping increase the number of sales Apple has to drug trafficers.)

The biggest surprise was how approachable and helpful Dave was to everyone in the room. According to Dave, the FBI has really made reaching out to the local communities it's in more of a priority. Since the September 11th attacks, the FBI has shifted its number one focus to preventing terrorism, but the number two priority remains preventing and capturing crimes based around technology. In order to best achieve both goals, the FBI has been working hard to reach out to American citizens, and Dave's talk to my class was part of that effort.

I'm a civil libertarian at heart, and that brings with it an innate mistrust of governmental authority - power corrupts, after all. But I'm glad people like Dave Thomas are in the FBI. He's a good man, and he has a good understanding not just of technology, but also of the complexities of the moral and ethical issues surrounding technology in our society today. He did a great job enlightening my students, and he really made the FBI sound like a pretty cool environment for people interested in pursuing security as a career. My advice: call your local FBI and see if they won't come visit your class, or Users Group, or club. I guarantee you'll learn something.


TOPICS: Crime/Corruption; Russia; Technical; US: Missouri
KEYWORDS: computersecurity; fbi
Navigation: use the links below to view more comments.
first 1-2021-4041 next last

1 posted on 1/30/2004, 3:33:13 AM by justlurking
[ Post Reply | Private Reply | View Replies]

To: justlurking
"Basically, police and government agencies know what to do with seized Windows machines. They can recover whatever information they want, with tools that they've used countless times. The same holds true, but to a lesser degree, for Unix-based machines.

I wonder what they do with encrypted filesystems?

Of course, usually the bad guys are too dumb to use them...
2 posted on 1/30/2004, 3:40:17 AM by proxy_user
[ Post Reply | Private Reply | To 1 | View Replies]

To: justlurking
bttt
3 posted on 1/30/2004, 3:40:28 AM by gcruse (http://gcruse.typepad.com/)
[ Post Reply | Private Reply | To 1 | View Replies]

To: justlurking
Fascinating! Thanks for posting this!
4 posted on 1/30/2004, 3:44:44 AM by neutrino (Oderint dum metuant: Let them hate us, so long as they fear us.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: proxy_user
Best thing to do, if you've been up to no good, is delete whatever was bad, use one of those thorough deletion utilities, then format, then remove the hard drive and wipe it with a strong magnet, then take a hammer to it and crack it into pieces and bake them in your oven.
5 posted on 1/30/2004, 3:48:39 AM by xrp
[ Post Reply | Private Reply | To 2 | View Replies]

To: justlurking
Thanks for posting this!

The FBI also has a spinoff now on their web site, called the Internet Fraud Complaint Center. If you get ripped off by an online auction, or any other online activity, you can report it there. They will investigate your complaint, and if possible they will send local LEOs to the place which you complain about. It works!
6 posted on 1/30/2004, 3:48:47 AM by 11B3 (Recycle the liberal masses into raw materials.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: justlurking
...and it's guaranteed that a smart, "social-engineering" type FBI agent won't make it out of St. Louis to DC.

his next assignment will be some place like rural Wisconsin.

7 posted on 1/30/2004, 3:50:22 AM by japaneseghost
[ Post Reply | Private Reply | To 1 | View Replies]

To: xrp
Or save all that trouble and just take a welding torch to the hard drive - turn it into a molten puddle.
8 posted on 1/30/2004, 3:51:19 AM by 11B3 (Recycle the liberal masses into raw materials.)
[ Post Reply | Private Reply | To 5 | View Replies]

To: 11B3
But I like breaking things.
9 posted on 1/30/2004, 3:51:55 AM by xrp
[ Post Reply | Private Reply | To 8 | View Replies]

To: 11B3
why do that?...if you toss your HD into a Microwave for 5 seconds whatever data is there is gone. So is your HD.
10 posted on 1/30/2004, 4:09:00 AM by tcuoohjohn (Follow The Money)
[ Post Reply | Private Reply | To 8 | View Replies]

To: justlurking
I read half the article. Neat stuff.

I think one of the real security issues we'll soon face is unsecured home networks via open wireless connections. If you drive around almost any suburban area you'll find several open networks with no inner firewall.
11 posted on 1/30/2004, 4:33:38 AM by Bogey78O (Why are we even having this debate?)
[ Post Reply | Private Reply | To 1 | View Replies]

To: tcuoohjohn
I believe standard military disposal is to smash it then pour acid on it.

I wonder if an emergency self-destruct device would sell well.
12 posted on 1/30/2004, 4:37:59 AM by Bogey78O (Why are we even having this debate?)
[ Post Reply | Private Reply | To 10 | View Replies]

To: Bogey78O
I think one of the real security issues we'll soon face is unsecured home networks via open wireless connections. If you drive around almost any suburban area you'll find several open networks with no inner firewall.

It's already a problem. I set up a wireless network for someone (disabled the SSID broadcast, enabled 128-bit encryption, and authorized specific MAC addresses), and she is having problems with the wireless card latching on to other unsecured networks when the signal from her own access point "fades".

If put my wireless card in my laptop, I can detect two different wireless networks near my home. I don't know if they are unsecured: I'm not going to try to connect.

13 posted on 1/30/2004, 4:38:09 AM by justlurking
[ Post Reply | Private Reply | To 11 | View Replies]

To: justlurking
Yea, that'll happen. It would be easy for a nefarious individual to open up the network and access the hard drive of the networked computers with the right tools (assuming certain windows features are enabled). Or they could just launch internet attacks from the saps IP. They'll be free and clear.
14 posted on 1/30/2004, 4:40:41 AM by Bogey78O (Why are we even having this debate?)
[ Post Reply | Private Reply | To 13 | View Replies]

To: justlurking
If you can detect them and they are unsecured aren't you connected to them?
15 posted on 1/30/2004, 4:44:24 AM by PFKEY
[ Post Reply | Private Reply | To 13 | View Replies]

To: proxy_user
I wonder what they do with encrypted filesystems?

Mostly they just read them. For some different views on security, check out COUNTERPANE on the internet. Alse the news group comp.risks is interesting (especially on electronic voting.)

16 posted on 1/30/2004, 4:46:21 AM by Doctor Stochastic (Vegetabilisch = chaotisch is der Charakter der Modernen. - Friedrich Schlegel)
[ Post Reply | Private Reply | To 2 | View Replies]

To: PFKEY
If you can detect them and they are unsecured aren't you connected to them?

Not with Windows XP. It puts up a "balloon" over the task bar that says "One or more wireless networks are available". If you (double?) click the icon, you get a list of the ones that have been detected.

It detects them by listening for the SSID broadcast from the access point. Most of the recently manufactured access points allow you to turn off the SSID broadcast, making it more difficult to detect it -- you have to configure the SSID (and WEP key, if appropriate) yourself.

17 posted on 1/30/2004, 4:50:02 AM by justlurking
[ Post Reply | Private Reply | To 15 | View Replies]

To: justlurking
Most of the recently manufactured access points allow you to turn off the SSID broadcast, making it more difficult to detect it -- you have to configure the SSID (and WEP key, if appropriate) yourself.

Can the SSID and WEP be turned off at the same time?

18 posted on 1/30/2004, 4:52:36 AM by PFKEY
[ Post Reply | Private Reply | To 17 | View Replies]

To: Bogey78O
I think one of the real security issues we'll soon face is unsecured home networks via open wireless connections. If you drive around almost any suburban area you'll find several open networks with no inner firewall.

It's not just the unsecured home networks, either. We live in the NW suburbs of Atlanta, Georgia.

Yesterday, I went with my son to the dentist. I had his notebook computer so that I could work while waiting for him. In the office complex where our dentist is located, I was able to access five different companies' networks.

4 of the 5 had no security provisions at all. None. Nada. The fifth one said something about having to enable something (I'm no techie!). At any rate, I simply clicked "no" or "cancel" and presto! I was in!

One of the companies was a CPA. The others were home design/decorating, contractors, and an attorney. One was a networking outfit. Go figure!

19 posted on 1/30/2004, 4:55:32 AM by Ulysses ("Most of us go through life thinking we're Superman. Superman goes through life being Clark Kent!")
[ Post Reply | Private Reply | To 11 | View Replies]

To: Bogey78O
ASA uses one...it's a microwave with an auxillary power unit.
20 posted on 1/30/2004, 4:59:48 AM by tcuoohjohn (Follow The Money)
[ Post Reply | Private Reply | To 12 | View Replies]


Navigation: use the links below to view more comments.
first 1-2021-4041 next last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
News/Activism
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson