Sovereign’s code ★ 9.10.11

Chaos Computer Club published an analysis and the binaries of the German lawful interception malware intended to intercept computer-based phone calls.

They discovered some unlawful feature bloat, potentially turning the legal eavesdropping malware into an extra-legal full-blown surveillance tool:

The government malware can, unchecked by a judge, load extensions by remote control, to use the trojan for other functions, including but not limited to eavesdropping. (…) [I]t is possible to watch screenshots of the web browser on the infected PC – including private notices, emails or texts in web based cloud services.

As so often with malware out there, communication between the malware and the command layer is poorly designed and leaves opportunities for third parties to take over the malware.

The analysis also revealed serious security holes that the trojan is tearing into infected systems. The screenshots and audio files it sends out are encrypted in an incompetent way, the commands from the control software to the trojan are even completely unencrypted. Neither the commands to the trojan nor its replies are authenticated or have their integrity protected.

CCC’s 20-pages analysis concludes (translated, orig. German):

“We are highly delighted that no apt expert could be won over for this morally questionable operation…”

Merkel might want to ask Putin next time.

—

FAZ, “Der deutsche Staatstrojaner wurde geknackt”

CCC, “Analyse einer Regierungs-Malware”

Frank Rieger, FAZ, “Anatomie eines digitalen Ungeziefers“