FBI spyware used to nab hackers, extortionists

June 15, 2009

The FBI has used a secret form of spyware in a series of investigations designed to nab extortionists, database-deleting hackers, child molesters, and hitmen, according to documents obtained by CNET News.

One suspect used Microsoft's Hotmail to send bomb and anthrax threats to an undercover government investigator; another demanded a payment of $10,000 a month to stop cutting cables; a third was an alleged European hitman who was soliciting for business from a Hushmail.com account.

CNET News obtained the documents -- totaling hundreds of pages, although nearly all of them were heavily redacted -- this week through a Freedom of Information Act request to the FBI.

The FBI spyware, called CIPAV, came to light in July 2007 through court documents that showed how the bureau used it to nab a teenager who was e-mailing bomb threats to a high school near Olympia, Wash. (CIPAV stands for Computer and Internet Protocol Address Verifier.)

A June 2007 memo says that the FBI's Deployment Operations Personnel were instructed to "deploy a CIPAV to geophysically locate the subject issuing bomb threats to the Timberline High School, Lacy, Washington. The CIPAV will be deployed via a Uniform Resource Locator (URL) address posted to the subject's private chat room on MySpace.com."

An affidavit written by FBI Special Agent Norman Sanders at the time said that CIPAV is able to send "network-level messages" containing the target computer's IP address, Ethernet MAC address, environment variables, the last-visited Web site, and other registry-type information including the name of the registered owner of the computer and the operating system's serial number.

The FOIA documents indicate that the FBI turns to CIPAV when a suspect is communicating with police or a crime victim through e-mail and is using an anonymizing service to conceal his computer's Internet protocol address. If an anonymizing service had not been used, then a subpoena to the e-mail provider would normally be sufficient.

CIPAV lets the FBI trick a suspect's computer into identifying itself to police, much as an exploding dye packet might identify a bank robber.

One document from March 2007 indicates that the FBI originally used a simple technique known as a "Web bug." Written by the Justice Department's Computer Crime and Intellectual Property Section, it says "some investigators have begun to use an investigative technique referred to as an 'Internet Protocol Address Verifier' (IPAV), a/k/a a 'Web bug.'"

Then the bureau appears to have shifted to actual software, once known as Magic Lantern (possibly a Trojan Horse) and then CIPAV.

One example of CIPAV's use came in a March 2006 request to the FBI's Cryptologic and Electronic Analysis Unit. It said a victim's Hotmail account is controlled by a suspect who "is extorting the victim because the account had personal info in it. Subject wants victim to set up an e-gold.com account and transfer $10,000 there and then email the userid/pwd to the subject."

Another was an August 2005 request saying a hacker deleted a company's database and "is extorting the victim company for payment to restore it."

If CIPAV could be detected before being installed by antivirus software, a criminal suspect may be able to avoid having his Internet address divulged to the police. A 2007 CNET News survey of the major antispyware vendors found that that not one company acknowledged cooperating unofficially with government agencies.

 

eBay buying out Gmarket, as Yahoo exits

June 15, 2009

eBay announced an agreement Wednesday to acquire Gmarket for a price of up to $1.2 billion, and Yahoo has agreed to sell its 10 percent stake in the South Korean e-commerce site in a move that would raise about $120 million.

Gmarket's board unanimously approved eBay's tender offer, in which the online auction and commerce site will pay a cash price of 31,767 Korean won, or $24, per share for all common shares and all American Depository Shares. eBay said it's assured of owning at least 67 percent of the company, and if it acquires all shares in the tender offer, the total price will reach about $1.2 billion.

eBay said it will combine Gmarket with its own Korean operations, the Internet Auction Co. it acquired in 2001, , though it will still use separate Web sites. "This deal creates strong operational synergies between the two market leaders, offers more opportunities for sellers and enhances our ability to serve complementary consumer segments," said John Donahoe, eBay's president and chief executive officer, in a statement.

eBay, once an e-commerce darling but now under more financial pressure, is making dramatic moves. The company plans a 2010 initial public offering to spin off Skype, its Internet telephony group.

The Gmarket offer, pending final approval by Korean antitrust authorities, would give eBay a significant new source of revenue. While its existing IAC business produced revenue of $161 million on $2.2 billion in gross merchandise sales, Gmarket produced $221 million on $3.2 billion in sales, eBay said. The company's offer is a 20 percent premium over Gmarket's closing price of $19.96.

With the recession hurting advertising revenue and Google supplying relentless competition, Yahoo is under pressure of its own. The company could announce more layoffs as it reports financial results next Tuesday, and raising $120 million could also help appease shareholders dissatisfied with Yahoo's financial condition.

 

Google tech tweak reveals plan for faster search

June 15, 2009
It was the kind of detail that only experts in Web traffic analysis could love, but a technical change Google is making turns out to reveal something a lot more people care about: faster search results.

Specifically, Google is trying out a new way to present search results that uses the JavaScript programming language and the related Ajax interface technology, not just regular HTML, to display the information, Google spokesman Eitan Bencuya said.

The reason: with the Ajax-enhanced search results, JavaScript is used to load the actual search results beneath the unchanging boilerplate above, a tactic that means only the search results need to be loaded on subsequent searches.

"These guys are working hard to make things milliseconds faster. They're always experimenting," Bencuya said.

A few thousandths of a second--trivial, right? Wrong. Google found that shaving a smidgen off the time it takes to show results means that people search more often, and more searches means more opportunities to show search ads.

To provide fast results, Google already uses 700 to 1,000 servers to field each query, so a little speed-up on the browser side of the process can be a relatively cheap way to get an edge.

OK, then, how did this all come to light? On the Google Analytics blog Tuesday, team member Brett Crosby announced a change Google plans to make to the "referrer" code that it passes on to a Web site when somebody clicks a link in the search result.

Those who use their own Web analytics software to observe how their search ads are performing--such as tracking when a Google search sent visitors to their Web site, and what they were searching for when they did--will need to update their software to accommodate the change.

It's an arcane tweak, to be sure, but Alex Chitu of the unofficial Google Operating System blog put the pieces together on Wednesday, guessing that the change had to do with how Google presented its search engine results page.

Specifically, he dug up a March video post by Google's Matt Cutts explaining why a Google experiment in presenting search results had shut off referrer traffic in February.

Bencuya confirmed on Wednesday that the referrer change was indeed motivated by the need to fix the experiment's unintended side effect.

"We made this change so we can continue experimenting with different kinds of test results and not break links in the future," Bencuya said.

He wouldn't comment on plans to bring the Ajax change to a broader set of users.

 



Best Communitation Website
Which communication website is best?

Myspace
Facebook
Twitter
Furry-paws
Youtube


Make a free website with Yola