FBI to distribute its own Trojan

The American Federal Bureau of Investigation has a new trick up its sleeve when it comes to combating crime – a Trojan by the name of Magic Lantern.

The American Federal Bureau of Investigation has a new trick up its sleeve when it comes to combating crime – a Trojan by the name of Magic Lantern.

Distributed via email (and assumedly on a case-by-case basis), Magic Lantern is designed to detect instances of the encryption program 'Pretty Good Privacy' (PGP) and automatically start key logging in order to capture the encryption password. This password is then sent back to the FBI. The FBI can also gain the access needed to insert Magic Lantern through the exploitation of common software and OS vulnerabilities, according to this article on MSNBC.

Apparently spawned due to the ineffectiveness of the Carnivore (now DCS1000) snooping system when pitted against encrypted data, Magic Lantern is aimed at those criminals who use PGP to help hide their illegal activities.

Regardless of the intended use, the concept has several flaws.

Firstly, history shows that a single piece of virus code is usually only capable of infecting a single platform. Thus, the FBI would have to develop a version for each type OS. Unix versions would be nearly impossible to implement properly, due to the fact that only root user has the priviledges required to make a software logger work effectively.

Secondly, the FBI fails to realise that the type of people (not criminals – people. Ignoring the lack of evidence showing that criminals use PGP, there is no way to deduce the contents of an encrypted message without decrypting it. Thus, all encrypted messages would have to be decrypted and analysed) who use PGP encryption are generally smart enough in their computer habits to avoid being infected by an email.

Thirdly, most people who use PGP on a day-to-day basis would have the skill and knowledge required to notice that an unknown program is attempting to gain Internet access. Heck, Zone Alarm could probably catch something like this. And then there's the whole 'is it legal' argument, not to mention AV firms negating Magic Lantern's usefulness with a single virus DAT update.