Criminal hackers getting hacked by the FBI

• Tweet

April 17th, 2009 - Posted by Robert Siciliano

Robert Siciliano is a NextAdvisor.com Expert Guest Blogger

Every so often, a controversial issue creeps into this blog. I don't usually take a political side, especially when it has to do with citizens' rights. But when bad guys are trying to win the cyberwar, it's important to understand what's being done to protect us.

The US National Security Agency is probably the most sophisticated group of security hackers in the world. Many will argue this point. The fact is, without NSA, US STRATCOM, which directs the operation and defense of the military's Global Information Grid, and US CERT, attacks on our critical infrastructures would be successful. We'd be living in the dark, telephones wouldn't work, food wouldn't be delivered to your supermarket and your toilet wouldn't flush. These are not the same bumbling government employees you see on C-SPAN.

The Obama administration is in the process of completing an internal cyber-security review,  announcing plans for cyber-security initiatives and determining who's going to lead the charge.

The New York Times reports that the NSA wants the job and of course, this is raising hackles amongst privacy advocates and civil libertarians who fear that the spy agency already has too much power. I'm all for checks and balances. However, in order to detect threats against our nation and other global computer infrastructures from criminal hackers and terrorists, those in charge of cyber-security must have full and unlimited access to networks. There is certainly a legitimate concern here that any government agency with too much power can overstep citizens' rights. However, coming from a security perspective, there are some very bad guys out there who would like nothing more for you to be dead.

Here's a glowing example of how this power is used for good. Wired.com's Kevin Poulsen reports on an FBI-developed super spyware program called "computer and Internet protocol address verifier," or CIPAV, which has been used to investigate extortion plots, terrorist threats and hacker attacks in cases stretching back to before the dotcom bust. This is James Bond, Hollywood blockbuster technology that makes for a gripping storyline. The CIPAV's capabilities indicate that it gathers and reports a computer's IP address, MAC address, open ports, a list of running program, the operating system type, version and serial number, preferred Internet browser and version, the computer's registered owner and registered company name, the current logged-in user name and the last-visited URL. That's the equivalent of a crime scene investigator having fresh samples of blood for the victim and perpetrator, and 360 degree crystal clear video of the crime committed.

The FBI sneaks the CIPAV onto a target's machine like any criminal hacker would, using known web browser vulnerabilities. They use the same type of hacker psychology phishers use, tricking their target into clicking a link, downloading and installing the spyware. They function like any illegal hacker would, except legally. In one case, they hacked a mark's MySpace page and posted a link in the subject's private chat room, getting him to click it. In another case, the FBI was trying to track a sexual predator that had been threatening the life of a teenage girl who he'd met for sex. The man's IP addresses were anonymous from all over the world, which made it impossible to track him down. Getting the target to install the CIPAV made it possible to find this animal. Numerous other cases are cited in the Wired.com article, including an undercover agent working a case described as a "weapon of mass destruction" (bomb & anthrax) threat, who communicated with a suspect via Hotmail, and sought approval from Washington to use a CIPAV to locate the subject's computer.

So while Big Brother may yield some scary power, criminals and terrorists are a tad scarier. I've always viewed the term "Big Brother" as someone who watches over and protects you. Just my take.

As always, invest in identity theft protection and Internet security solutions to keep the bad guys and the spyware out.

Robert Siciliano, identity theft speaker, discusses spyware.

Robert Siciliano is CEO of IDTheftSecurity.com , an identity theft expert, professional speaker, security analyst, published author and television news correspondent. Siciliano works with Fortune 1000 companies and startups as an advisor on product launches, branding, messaging, representation, SEO and media. Siciliano's thoughts and advice on all these matters appear often in both the televised and print news media including CNN, MSNBC, CNBC, FOX, Forbes and USA Today. He has 25 years of security training as a member of the American Society of Industrial Security. He is the author of 2 books, including The Safety Minute: Living on High Alert; How to take control of your personal security and prevent fraud. He's also partnered with Uni-Ball to help raise awareness about the growing threat of identity theft and to provide tips on how you can protect yourself.