On Tue, 21 May 2013 14:17:02 +1000 "James A. Donald" <[email protected]> wrote:
> Police install malware by black bagging, and by the same methods as > botnets. Both methods are noticeable. I do not think the following scenario is terribly far-fetched: Suppose the police want to target a grad student in a CS department at a major university. The police enter the server room, insert some malware into the student's research group's git repository, and waits for the student to merge the changes. The next time the student runs whatever code she is working on, the malware will be installed; the malware then installs a keystroke logger, enables the microphone, etc. The malware can be even more secretive, only activating on a specific computer (the target's) or perhaps the police could modify the software on the server to only send the malware to the target. Now, let's change this somewhat. Instead of sneaking into a server room (or presenting the school with a court order), the police compromise another grad student's computer, and simply commit their malware to the group's repository (do you think researchers actually read commit logs, when they have a deadline in a few days?). Now suppose instead of the police, it is a foreign government trying to get secret research data. Maybe instead of targeting one research group, they just target, say, anyone who keeps Matlab source code in a git repository. Now suppose that instead of researchers, it is a political activist group, and instead of a git repository, it is a shared PDF (let's just assume that Acrobat has an exploitable vulnerability). Maybe the malware will spread by inserting itself into *every* PDF that the user sends out. Police and other state-sponsored malware typically target specific people or groups of people, and usually for surveillance and espionage purposes. That is very different from your typical spammer or criminal botnet. -- Ben -- Benjamin R Kreuter UVA Computer Science [email protected] KK4FJZ -- "If large numbers of people are interested in freedom of speech, there will be freedom of speech, even if the law forbids it; if public opinion is sluggish, inconvenient minorities will be persecuted, even if laws exist to protect them." - George Orwell
signature.asc
Description: PGP signature
_______________________________________________ cryptography mailing list [email protected] http://lists.randombit.net/mailman/listinfo/cryptography
