'Babar' Malware Attributed To France 65
sarahnaomi writes: The NSA, GCHQ, and their allies in the Five Eyes are not the only government agencies using malware for surveillance. French intelligence is almost certainly hacking its targets too — and now security researchers believe they have proof. On Wednesday, the researchers will reveal new details about a powerful piece of malware known as "Babar," which is capable of eavesdropping on online conversations held via Skype, MSN and Yahoo messenger, as well as logging keystrokes and monitoring which websites an infected user has visited. The researchers are publishing two separate but complementary reports that analyze samples of the malware, and all but confirm that France's spying agency the General Directorate for External Security (DGSE) was responsible for its creation.
A nice piece of... (Score:5, Funny)
The first ever malware to work only 35 hours a week...
Re:A nice piece of... (Score:5, Funny)
Is anyone going to talk about the elephant in the room?
Re: (Score:1)
I forget, which elephant is that?
Re: (Score:2)
Somehow malware named Babar doesn't geel so threatening.
NSA: Note to self - call our next drop Curious George
Re: (Score:2)
Presumably they named it thus because it never forgets.
Re: (Score:2)
Would that elephant be that while those agencies were all so busy working on those hacks, they were doing nothing at all to protect us from them. In fact it would have gone against their own personal, individual benefit and future career prospects to protect us from those security failings ie they were actively working against the interests of the own state and citizens in order to attack other states and their citizens. The stupidity continues as does the failure of various justice departments to prosecut
Re: (Score:3)
You mean sophisticated malware in the hands of a known terrorist organisation [wikipedia.org]?
Two of the DGSE killers were caught and imprisoned in New Zealand, but the French government threatened crippling EU trade sanctions if they were not released.
Re: (Score:2, Informative)
Why do people seem to view short work weeks as a bad thing ?
I understand that dedicating a long time to work is sometimes necessary, but being proud of it ? That's stupid. It's like admitting one's own inefficiency.
BTW, France doesn't have the shortest work week. In fact, 35 hours is typical for an European country.
Re: (Score:2, Informative)
It did create jobs, multiple studies show it. So yes, real economy works that way.
Re:A nice piece of... (Score:4, Informative)
Re:A nice piece of... (Score:4, Insightful)
Re:A nice piece of... (Score:5, Funny)
The malware also doesn't work at all during August, and will randomly go on strike.
It also immediately surrenders to the first AV program to find it.
Re: (Score:2)
Re: (Score:2)
They present a lot of information that will lead to that conclusion, but do not themselves state that the conclusion is fact.
Re: (Score:2)
And there is no fucking oversight.
Aue contraire - the Israelis would disagree with you on this particular matter.
Re: (Score:2)
"All but confirm" means "everything up to, but not actually, confirming".
So the "all but" includes "strongly suggests", "gives reason to believe", and similar suggestive (but non-confirming) phrases.
In other words: "We can't confirm (prove) the assertion, but we strongly believe in the assertion."
"Everything short of" is a similar phrase.
Re: (Score:2)
In a sealed room with only one way in or out, you have a corpse, you have a person standing over the corpse covered in blood and holding the murder weapon. A camera outside shows that both entered the room together and no one else has been in to or out of the room.
However, you did not see them drive the knife in to the person causing death. You have all but confirmed this is the killer.
Could have been worse (Score:5, Funny)
It could have been the Asterix malware. That shit doesn't just spy on you, it beats the crap out of of you - and then has a nice feast to celebrate!
Re: (Score:3, Insightful)
Meaningful Oversight (Score:4, Interesting)
This proves that all the whining about the NSA has little to do with actual worries (as if anyone in the government actually cares about their porn viewing habits), and more to do with overwrought anti-Americanism.
No, it doesn't.
We are more concerned about the NSA doing it because it has a bigger budget and because, for a lot of slashdotters, it's our government that's doing it. It's still a subject for humor, but nevertheless a real social policy concern. I've met a lot of great guys who work in law enforcement whom I would generally trust not to abuse the powers created by massive surveillance, but the problem arises when too much trust is given and there isn't enough oversight of how it is used. As it is, the public is not given any believable claim to even the existence of meaningful oversight.
That means bad actors within the system can use it to spy on people they know, on their own ex-wives, for example. And while they might get severely disciplined if they're caught, the public hasn't been told how likely it is that they're caught.
It also means the system can be used to blackmail VIPs, power-brokers, reporters, and legislators. While most of the people involved would not use it for that, it only takes one or two people to be willing to do that and a lack of *perfect* oversight and reporting for a system like this to utterly threaten and destroy any notion of representative government.
Imagine you have a database of every Congressman's phone calls, or even every third or fourth phone call that happens to be to someone within a three-hop warrant of a terrorist.
Re: (Score:2)
Re: (Score:2)
They surrendered in WW2 and still can't live it down, but aside from that the meme isn't accurate. Their special forces are usually considered some of the best in the world, and the french resistance certainly managed to make the Nazi occupiers lives difficult.
The English still remember kicking French arse at Agincourt, of course. Even if it was six hundred years ago. We didn't just win - we won by such a margin as to give them humiliation that will last a thousand years.
Re:Isn't slashdot's reaction interesting... (Score:5, Insightful)
As an American, I have the right, duty and obligation to complain about the NSA's illegal bullshit because they're (ostensibly) claiming to represent me as a citizen, while acting against my interests as a citizen. France, on the other hand, is a sovereign foreign nation, in which I have no standing to complain.
The spying is bad no matter who's doing it, but it's the French citizens' job to fix France's spying, not mine, just as it's American citizens' job to fix the USA's spying, not theirs.
Re: (Score:2)
This proves that all the whining about the NSA has little to do with actual worries (as if anyone in the government actually cares about their porn viewing habits), and more to do with overwrought anti-Americanism.
Quite the opposite. It proves that the anti-French sentiment is so strong in the US and UK that it drowns any rational discussion.
Lord forbid.... (Score:1)
Lord forbid a security researcher share list of user name and passwords, or a journalist post a link to a database dump, or a college student download a large number of academic journal articles through MIT's computer network.... These evil computer hackers need to be put away forever to protect the children, moral people everywhere, and our pristine government that can do no wrong. The death penalty probably won't be too good for them!
However, should the government want to hack us, destroy our privacy, i
Re: (Score:2)
These evil computer hackers need to be put away forever to protect the children
I believe they are also responsible for global warming.
Isn't the name alone proof enough? (Score:3)
I mean, who else is going to craft malware named after french speaking elephant [wikipedia.org].
Re: (Score:3)
I mean, who else is going to craft malware named after french speaking elephant.
Ivory Coast (Côte d'Ivoire) seems to have more tie-ins...
Re: (Score:2)
I mean, who else is going to craft malware named after french speaking elephant [wikipedia.org].
Next malware, derived from a japanese one wil be called Albator [wikipedia.org].
International protest month (Score:2)
Everyone get online and start talking about terrorism to flood the snoopers.
Re: (Score:1)
Protest?
Great idea, then the NSA can justify a bigger black budget in a country that has been floating on credit since it went bankrupt in 1971 as a direct result of what the mob did in the late 50's/early 60's beyond turning national security into a fucking joke. It is completely understandable as to why they did what they did to Snowden, and not in a good way. The more people they push towards the edge, the more that will start playing it like they have nothing left to lose. Think Bosnia.
In other news... (Score:3, Funny)
The 'Bieber' malware has been attributed to Canada, which is capable of infecting all news websites with inane celebrity gossip.
Beyond flimsy (Score:3)
2) MSIE misspelled as MSI which anybody could have done
That is quiiiite flimsy. I hope they have more.
Guess they aren't after hackers (Score:2)
I figure they are going after most users which will exclude hackers since they all use Linux or some form of to do their work.
This malware invades Windows desktop machines (Score:2)
MSN Messenger (Score:1)
Titi username (Score:2)
The report says "Titi is a French diminutive for Thiery, or a colloquial term for a small person".
Well first it's Thierry with two 'r's, but I've never seen titi being used as a diminutive for it, though that's because nobody would stand to it being used in public. Then there's the titi parisien [wikipedia.org] but I've never seen titi referring to a small person.
But all this misses the point. Just like an uninspired English-speaking programmer will call his variable 'foo' and then 'bar' if he needs a second one, a Fre