Slashdot Log In
Court Slams Door On Sale of Spyware
Posted by
kdawson
on Wed Nov 19, 2008 12:55 AM
from the mother-may-i-install dept.
from the mother-may-i-install dept.
coondoggie writes "The Federal Trade Commission yesterday had a US District Court issue a temporary restraining order halting the sale of RemoteSpy keylogger spyware. According to the FTC's complaint, RemoteSpy spyware was sold to clients who would then secretly monitor unsuspecting consumers' computers. The defendants provided RemoteSpy clients with detailed instructions explaining how to disguise the spyware as an innocuous file, such as a photo, attached to an email."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Re: (Score:2)
FMI please RTFA
Re:but why? (Score:5, Insightful)
Parent
Re:but why? (Score:4, Interesting)
Parent
Re: (Score:1)
They could simply classify it as a war weapon and limit it to govt agencies...
Re: (Score:2)
Oh come on, it's just spyware, not encryption.
Re: (Score:1)
Re: (Score:2)
It seems to imply that a citizen can commit a crime and a bureaucrat cannot.
Sort of like when police officers fly down the road at 40mph+ higher than the speed limit, change lanes without signalling, run stop signs, cut people off, tailgate people on the highway, and generally drive like the biggest bunch of suicidal assholes the road has ever seen but will pull over the rest of us for stepping even slightly out of line without a second thought?
Sorry, I just spend a lot of time on highways, so it just reall
Re: (Score:3, Interesting)
You mean like the catch-all German "hacker program" law, that has had the entire security industry up in arms? The one where you could in theory get arrested for possessing a copy of NMap?
www.schneier.com/blog/archives/2007/08/new_german_hack.html
Valid REason for HAving KeyLogger (Score:2, Informative)
Re: (Score:1)
from time to time I run a keylogger on my own systems. It's been pretty useful for going back and figuring out exactly what I was doing last week, it provides a quick way to find some comment I made or a website I was at before, etc.
It helps that I spend a lot of time at a command line as well, but I have even left notes to myself by typing anywhere that will accept text, and then clearing the text out.
It's also nice to be able to know exactly when someone else was on my system and what exactly they were do
Re: (Score:2)
This sounds like a great strategy to make sure you get paid. Don't ask for money upfront, only ask for money after the keylogger is installed.
Re: (Score:1)
I think their problem is that they should have sold it under the guise of a computer security assessment tool or something, and not outright say it's for spying on people. It's like those countless micro-camera that are sold to "monitor babies", when in reality everybody knows they're bought by peeping toms who plant them in ladies bathrooms
Re: (Score:1)
I honestly don't think you could pass of something this simple as a pen-test tool. You could probably pass it off as a pure remote administration utility. But this would require you to add lots of extraneous functionality that would seriously confuse the intended market, and you couldn't market it to them directly either (I guess this could work anyway if you could incite some really strange grassroots campaign.) On the upside, if the virus engines wouldn't recognize it, you wouldn't have to include signatu
Re: (Score:1, Offtopic)
Lady: "Why is there a big pink bear in this dressroom?"
Bear: "Shut up and take off your clothes already."
BO (Score:2)
Bane of ICQ 98b users everywhere!
Re:BO (Score:5, Informative)
Parent
Time Frame (Score:2)
As much as the FTC deserves an "A" for effort, however, the timeline of the case is an excellent example of how poorly equipped the government is when it comes to addressing this type of problem. The brief states that RemoteSpy has been available since "at least August 2005.
It hardly seems worth the effort if this time frame is typical. You'd hope any spyware scanner worth using would have picked it up 20x faster.
Re: (Score:1)
To have had a greater effect, the court should have ordered that their hands be held in the door when it was being slammed.
Re: (Score:2)
You'd hope any spyware scanner worth using would have picked it up 20x faster.
Not all anti-virus and malware scanners will include commercial products in their database.
Re: (Score:1)
You'd hope any spyware scanner worth using would have picked it up 20x faster.
Not all anti-virus and malware scanners will include commercial products in their database.
Unless of course the commercial product in question is a Windows system file...
This is good. (Score:4, Insightful)
But it's stuff like this we're really after: http://en.wikipedia.org/wiki/MPack_(software) [wikipedia.org]. People who code professional-grade malware generally do so to profit off of it. It's well known that in the existing ecosystem of digital crime the malicious hackers themselves rarely act as attackers in large-scale id/credit card theft; instead they sell it to people who do. Quoting this extremely enlightening interview: http://www.securityfocus.com/news/11476 [securityfocus.com]
"The project is not so profitable compared to other activities on the Internet. It's just a business. While it makes income, we will work on it, and while we are interested in it, it will live. Of course, some of our customers make huge profits. So in some ways, MPack could be looked at as a brand-name establishment project."
This particular piece of spyware is amateur stuff, aimed at paranoid spouses/bosses, but if we can hit the business of selling spyware (probably requiring the cooperation of the international banking system, as well as the governments of china and russia) it would totally cripple large-scale internet crime as we know it. It's a pipe dream, of course. But one can always dream.
Good intentions and all that... (Score:2)
I don't want to rob you of your dreams (or take away your pipe
Re: (Score:1)
I totally meant to type "malware", but my head is muddled from a sleepless night. Spyware is of course only a part of the problem.
Re: (Score:3, Informative)
Re: (Score:1, Funny)
So Vista is malware? ...sorry, too easy...
Re: (Score:1)
The thing with spyware is that it's included in legitimate apps, typically, and the user has to click through an EULA. Also, all software sold with the intended purpouse of large-scale crime have to be explicitly designed for the fraud in question (code for capturing credit card numbers and passwords from browser sessions/committing various forms of DDOS attacks for example.) The purpose of the software is obvious from it's construction (which conveniently also sets it apart from how commercial pen testing
use, not possession (Score:1)
It's the use to which it's put.
Consider by analogy a crowbar. It could be used to force open someone's window or someone's head, both illegal; but it could also be used to pry off the hubcap of one's own car, an operation legal in most jurisdictions.
Let's see, legal ethical use of spyware... Hmm, that's a tough one for a civil libertarian. Logging your underage kid's IRC sessions in case you later need to find out where she's run off to meet her 40 year old "friend"?
Re: (Score:2)
What is the magic algorithm that determines of a freedom fighter is a terrorist?
Anyway, if you are really interesting in learning people are trying to come up with useful definitions that allow us to make the internet safer: http://www.antispywarecoalition.org/documents/definitions.htm [antispywarecoalition.org]
Labeling software correctly, ie: letting consumers make their own decisions, means we don't need the legal system to get involved except where stuff is fraudulently mislabeled.
You want to write malware, fin
Re: (Score:3, Interesting)
Useless Trash (Score:1)
Other legal purposes (Score:1, Insightful)
Almost all software has legal use to some extent.
I am a small company owner. I have 5 employees and provide them with computers. I have told them that their computer use is monitored and bought this software to ensure I could perform that task. It does.
My computers are for my company to make money, not their personal use. No personal email. No day-trading. No on-line banking and definitely no gaming. Do that stuff on your own computer and own time. I've had to discipline employees for personal use before
Re: (Score:2)
Well, your rules don't /matter/, but I see your point.
Re: (Score:2)
Come on, community! (Score:2)
Time for OSS to step up to the plate and make a GPL equivalent!
About time. (Score:1)
And please, don't compare this to gun rights. Guns as self
This leads to an interesting question (Score:2)
What about law enforcement? (Score:2)
Does this mean that companies which develop keylogging software for law enforcement use are breaking the law? No? Didn't think so.
It shouldn't be illegal to write this kind of software, but it should be illegal to install it without either the owner's consent or a proper warrant.