German government created Bundestrojaner aka Federal Trojan, R2D2, 0zapftis

German hackers have captured and analysed a cyber-sleuth Trojan which they claim may have been used by police to tap Skype calls and IM chats of criminal or terrorist suspects.

German wiretap laws do in fact permit the use of a "Bundestrojaner" ("Federal Trojan"), which has been used by police to record VoIP conversations for a few years.

But the so-called R2D2 (AKA 0zapftis) Trojan – which has not been confirmed as a creation of the German government – has far more capabilities than this, including the ability to download updates from the internet, log keystrokes, eavesdrop on IM chats and take screenshots. The backdoor function exceeds what's permissible under German law.

Sophos has said:

"We have no way of knowing if the Trojan was written by the German state – and so far, the German authorities aren't confirming any involvement.

The comments in the Trojan's binary code could just as easily be planted by someone mischievously wanting the Trojan to be misidentified as the infamous Bundestrojaner."

The R2D2 Trojan was captured by the Chaos Computer Club (CCC) and made public over the weekend, sparking a huge row in privacy-sensitive Germany.

A CCC spokes-hacker said:

"This refutes the claim that an effective separation of just wiretapping internet telephony and a full-blown Trojan is possible in practice – or even desired. Our analysis revealed once again that law enforcement agencies will overstep their authority if not watched carefully."

Hackers from the group reverse-engineered samples of the malware code before analysing the functions built into the software. It concludes that any machine infected by the Trojan might be easily seized by third-party hackers.

The screenshots and audio files it sends out are encrypted in an incompetent way, the commands from the control software to the Trojan are completely unencrypted. Neither the commands to the Trojan nor its replies are authenticated or have their integrity protected. Not only can unauthorised third parties assume control of the infected system, but even attackers of mediocre skill level can connect to the authorities, claim to be a specific instance of the Trojan, and upload fake data.

A English-language statement by CCC on its find can be found here: http://www.ccc.de/en/updates/2011/staatstrojaner
The German chancellor's press secretary denied that the R2D2 trojan has been used by the BKA, the German Federal criminal police. This denial has failed to stem speculation.

One popular theory is the Trojan might have been created by Digitask for the Bavarian government. Such speculation in interesting, though not based on any evidence outside of papers released by WikiLeaks suggesting Digitask had at least offered to create this sort of software: http://wikileaks.org/wiki/Skype_and_SSL_Interception_letters_-_Bavaria_-_Digitask

Security firms say it is impossible to know who created the code from the evidence available.

Net security firm F-Secure writes:

"We have no reason to suspect CCC's findings, but we can't confirm that this Trojan was written by the German government... As far as we see, the only party that could confirm that would be the German government itself."

Anti-virus firms including F-Secure and Sophos have already added detection against the malware, along with commentary on the row (here: http://www.f-secure.com/weblog/archives/00002249.html and here: http://nakedsecurity.sophos.com/2011/10/09/government-backdoor-trojan-chaos , respectively). Other security outfits can be expected to follow suit; they are obliged to add detection for any blob of malware they come across regardless of who created it. Turning a blind eye to state-sponsored malware, especially in the post-Stuxnet era, would be commercial suicide.

Bootnote

The R2D2 name comes from a string of ASCII, "C3PO-r2d2-POE", found in the mystery Trojan. Likewise, the 0zapftis name also appears, a phrase meaning "the barrel is open" that's used by the Munich mayor in opening Oktoberfest every year.

Security firms agree with CCC that the Trojan is lame. F-Secure's Mikko Hypponen tweeted amusingly:

"It's not well written: http://twitter.com/mikko/status/122794637420277760
Which, I guess, makes it *more* likely it's developed by a Government..."

-----

Download complete release from CCC (german): http://www.ccc.de/system/uploads/76/original/staatstrojaner-report23.pdf