German Bavarian gov't caught buying malware to intercept Skype calls

Documents on Wikileaks show that the German Bavarian government had planned to release trojans -- malware -- designed to allow them to intercept Skype calls. The leaked documents include wrangling over the pricing and payment for the malicious software. The docs were leaked by the German Pirate Party.

The offer dating September 4th 2007, replies an inquiry by Bavarian officials on the possibility of Skype interception, introduces a basic description of the cryptographic workings of Skype, and concludes that new systems are needed to spy on Skype calls.

It continues to introduce the so-called Skype Capture Unit. In a nutshell: a malware installed on purpose on a target machine, intercepting Skype Voice and Chat. Another feature introduced is a recording proxy, that is not part of the offer, yet would allow for anonymous proxying of recorded information to a target recording station. Access to the recording station is possible via a multimedia streaming client, supposedly offering real-time interception.

Another part of the offer is an interception method for SSL based communication, working on the same principle of establishing a man-in-the-middle attack on the key material on the client machine. According to the offer this method is working for Internet Explorer and Firefox webbrowsers. Digitask also recommends using over-seas proxy servers to cover the tracks of all activities going on.

Link (via /.)

• [dragonfrog]

  I should have added to the above – only because the guy on the train had explained that this was common practice for Bavarian cops, did I not immediately assume we were being robbed.

  I would have tried either to run away, or to fight back. Given that these were armed cops in a state that obviously lacks respect for civil rights against police interference, either of those courses of action probably would have been unfortunate…

• [Takuan]

  any Germans care to comment?

• [Moon]

  September 4, 2007! Only a week before 9/11/07! They had to do it! What’s the Bavarian equivalent of Rudy Giuliani?

  :D

• [elNico]

  Things like this are the reason my city is plastered with stencils of Schäuble’s face and captions like “I’ll get you all!” or “Stasi 2.0″.

  LOL! In a strange way this makes me a bit homesick…

  Since some stupid kids had a knife fight on Hamburg’s famous red-light boulevard (the Reeperbahn) it’s now forbidden to carry weapons there.

  So what?

• [eingram]

  So someone is spying on the Bavarian Gov’t. and complaining that the Gov’t is spying?
  have I got that right?

• [benediktus]

  @dragonfrog and cory: thanks for pointing out the distinction between germany and bavaria.i’m very sorry to hear from DRAGONFROG’s unpleasant experiences with bavarian cops.

  bavaria is only one state (so called “free state”) of the 16 german states. and it’s the most conserative one. every federal state has it’s own little gov, but there is always the federal gov above that, legislating for all 16 states (with delegates from all states). but every federal state may determine how to implement some of the bills decided in berlin. nevertheless there is no law in any german ferderal state allowing spying on their citizens by malware.

  like said by ZIMMERPFLANZE above there are many plans from mr.schaeuble (minister for the interior) to spy on germans by releasing trojans etc.. that was big news here in germany. fortunately many organisations like the CCC, GI or FIFF made the public aware of the problem (data privacy) and so mr. schaeuble had to put that plan back in his (top) drawer. but it’s not over yet: noone knows what happens behind the scenes, as we can see from that bavarian issue.

• [danarmak]

  From a legal or civil rights POV, the wiretapping itself is arguably no worse than bugging a POTS line or even a suspect’s home. But to accomplish it they’re installing a backdoor that anyone on the net might be able to use (since the malware’s remote control is certain to have security issues).

  It makes me worry about the state of security on the Internet. The #1 problem to date has been Windows boxes that are misconfigured, unpatched, and generally trivial to take over remotely. But how much worse will the situation get when our governments decide they have an interest and a fat budget dedicated to deliberately hurting the security situation because they need vulnerabilities to be able to install their spyware?

• [elNico]

  @#10 Takuan

  any Germans care to comment?

  Sure…I wish Bavaria would be at the edge of the continent, break off and become some middle-of-major-ocean island. Most Bavarians would like that, too, I think.

  I live in Australia now, but I think I felt more alien those few times I went to Bavaria. It’s good for tourist postcards, though.

  In regards to the Trojan…it’s the brainchild of interior minister Schäuble and it is a federal issue – however, it’s been so heavily contested that it’s been put on hold and will need a decision by the German “constitutional court” (not sure whether that is the right translation).

  In this case Bavaria has again decided that the rest of Germany can get lost and decided to try to implement it themselves and don’t bother with all that constitutional baggage.

  Sounds familiar? If GWB would be German, he’d be in the CSU, which only exists in Bavaria.

  Oh, and all that Lederhosen and chicken dance stuff you might have in your school books…blame Bavaria ;)
  Sure…I wish Bavaria would be at the edge of the continent, break off and become some middle-of-major-ocean island. Most Bavarians would like that, too, I think.

  I live in Australia now, but I think I felt more alien those few times I went to Bavaria. It’s good for tourist postcards, though.

  In regards to the trojan…it’s the brainchild of interior minister Schäuble and it is a federal issue – however, it’s been so heavily contested that it’s been put on hold and will need a decision by the German “constitutional court” (not sure whether that is the right translation).

  In this case Bavaria has again decided that the rest of Germany can get lost and decided to try to implement it themselves and don’t bother with all that constitutional baggage.

  Sounds familiar? If GWB would be German, he’d be in the CSU, which only exists in Bavaria.

  Oh, and all that Lederhosen and chicken dance stuff you might have in your school books…blame Bavaria ;)

• [elNico]

  ouch…sorry for copy/paste mayhem.

  Anyway, I should add that the CSU is Bavaria’s very right of center political party.

• [Takuan]

  Oh, thank you for that information.

  I am not sure who the Bavarian government wishes to spy on (everyone?). I just don’t see the point when anyone serious will use one time pads and be done with it.

• [benediktus]

  actually it’s not the german gov, but the bavarian (see german article on heise.de:http://www.heise.de/newsticker/meldung/102485)

• [noen]

  So is there an American Pirate Party? Probably soon will be I suppose.

• [raisedbywolves]

  damn bavarians, this is completely typical for them.

• [mikelotus]

  Of course Bavaria was the heart and soul of the Nazi party and probably the strongest supporters of the Freikorps also. Can we say conservative Catholic too?

• [raisedbywolves]

  Takuan et al: It often comes as a surprise for Americans when we hear about all of the surveillance going on in Germany. Since moving here (to Hamburg) I’ve been shocked to hear about lots of things Minister of the Interior Schäuble wants to do. That includes the federal trojan program Zimmerpflanze, Benediktus and Elnico mentioned. Things like this are the reason my city is plastered with stencils of Schäuble’s face and captions like “I’ll get you all!” or “Stasi 2.0″. It’s just the German incarnation of the all too popular belief that if you have nothing to hide, it shouldn’t bother you to be spied on.

  And yes, Bavaria is a very, very right-of-center type place. You’d think looking at the Alps all day might put people in a better mood than that. But unfortunately they’re not the only ones. Since some stupid kids had a knife fight on Hamburg’s famous red-light boulevard (the Reeperbahn) it’s now forbidden to carry weapons there. “Weapons” including your trusty Leatherman, *and* my x-acto I tote around in my model-building supplies.

  And don’t even get me started on the raids that happened before the G8 summit last spring. Including storming peoples’ workplaces, which of course got them fired. And taking dirty clothing for smell samples. A famous, and famously insane Stasi tactic, incidentally…

  So yeah, as much of a paradise Europe is in some ways, it sure isn’t perfect.

• [zimmerpflanze]

  The german gov. isn’t in any need to be caught at this. There is a highly official campaign for the introduction of a so-called “Federal Trojan” being pushed forwards by our minister of internal affairs.

• [Eris Siva]

  #3 – Actually, there has been for a while:
  http://www.pirate-party.us/

  Cory covered them a while ago:
  http://www.boingboing.net/2006/06/07/us-branch-of-piratae-.html

• [RMS]

  If the idea of this interception is that they would install
  it in the computer of an identified suspect, under court order,
  that seems as legitimate as any other legal wiretap.

  But Skype is a bad thing all around, because it is proprietary
  (non-free, non-libre, non-freedom-respecting) software. (See
  http://www.gnu.org/philosophy/free-sw.html for the definition of free
  software.) In fact, you don’t know that Skype’s developers haven’t
  put in a back door to intercept your calls. All you know is that, if
  there is one, the Bavarian police don’t know about it. Maybe only the
  NSA knows about it.

  Ethically speaking, putting a Skype number in your email
  is the same sort of thing as saying “Use Windows”.

  -Richard Stallman

• [Johan Larson]

  So can we call them fascists now, or is that a prohibited ethnic slur?

• [dragonfrog]

  It’s an important distinction that this is the Bavarian state government, not the German federal government. Certain civil rights are considerably more limited / less respected in Bavaria than in the rest of Germany.

  When I was there some years ago, I was exposed to the Bavarian police’s powers of arbitrary search and seizure:

  While I waited for a train, about three men approached the man waiting next to me on the platform, showed police IDs, and demanded to search his possessions. They went through his backpack, all his pockets, and his backpack. He didn’t seem anything like as upset as I would have been at this.

  On the train he explained to me that this was normal procedure – the police can stop and search anyone, without a warrant or any reasonable grounds to suspect him of anything. He didn’t like it of course, but he felt there wasn’t much he could do – it was allowed.

  Not long after that, I walked from the campground I was staying at to the nearby gas station to get some snacks. On the way back, an unmarked car pulled up, and three guys in (frankly seedy-looking) street clothes got out and demanded to search our stuff (I was with two fellow campers). They didn’t even show their police IDs until I asked to see them. They searched all our bags, our pockets, and went through our wallets. All the while it was “stand along the fence. Keep your hands in plain sight”.

  I asked these cops how it was legal for them to search us, and they again explained that they needed no more grounds than that we were young, were staying at a campground, and were coming back from a gas station, where we could potentially have met a drug dealer – in other words, they felt like stopping us, and there was no law to stop them. They also said that this would not be possible in any other German state.