• Total Posts: 28031
  • Total Topics: 8051
  • Online Today: 750
  • Online Ever: 51419
  • (01. January 2010., 09:27:49)

Author Topic: German government created Bundestrojaner aka Federal Trojan, R2D2, 0zapftis  (Read 2860 times)

0 Members and 1 Guest are viewing this topic.


  • SCF Administrator
  • *****
  • Posts: 7151
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • - Samker's Computer Forum

German hackers have captured and analysed a cyber-sleuth Trojan which they claim may have been used by police to tap Skype calls and IM chats of criminal or terrorist suspects.

German wiretap laws do in fact permit the use of a "Bundestrojaner" ("Federal Trojan"), which has been used by police to record VoIP conversations for a few years.

But the so-called R2D2 (AKA 0zapftis) Trojan – which has not been confirmed as a creation of the German government – has far more capabilities than this, including the ability to download updates from the internet, log keystrokes, eavesdrop on IM chats and take screenshots. The backdoor function exceeds what's permissible under German law.

Sophos has said:

"We have no way of knowing if the Trojan was written by the German state – and so far, the German authorities aren't confirming any involvement.

The comments in the Trojan's binary code could just as easily be planted by someone mischievously wanting the Trojan to be misidentified as the infamous Bundestrojaner."

The R2D2 Trojan was captured by the Chaos Computer Club (CCC) and made public over the weekend, sparking a huge row in privacy-sensitive Germany.

A CCC spokes-hacker said:

"This refutes the claim that an effective separation of just wiretapping internet telephony and a full-blown Trojan is possible in practice – or even desired. Our analysis revealed once again that law enforcement agencies will overstep their authority if not watched carefully."

Hackers from the group reverse-engineered samples of the malware code before analysing the functions built into the software. It concludes that any machine infected by the Trojan might be easily seized by third-party hackers.

The screenshots and audio files it sends out are encrypted in an incompetent way, the commands from the control software to the Trojan are completely unencrypted. Neither the commands to the Trojan nor its replies are authenticated or have their integrity protected. Not only can unauthorised third parties assume control of the infected system, but even attackers of mediocre skill level can connect to the authorities, claim to be a specific instance of the Trojan, and upload fake data.

A English-language statement by CCC on its find can be found here:
The German chancellor's press secretary denied that the R2D2 trojan has been used by the BKA, the German Federal criminal police. This denial has failed to stem speculation.

One popular theory is the Trojan might have been created by Digitask for the Bavarian government. Such speculation in interesting, though not based on any evidence outside of papers released by WikiLeaks suggesting Digitask had at least offered to create this sort of software:

Security firms say it is impossible to know who created the code from the evidence available.

Net security firm F-Secure writes:

"We have no reason to suspect CCC's findings, but we can't confirm that this Trojan was written by the German government... As far as we see, the only party that could confirm that would be the German government itself."

Anti-virus firms including F-Secure and Sophos have already added detection against the malware, along with commentary on the row (here: and here: , respectively). Other security outfits can be expected to follow suit; they are obliged to add detection for any blob of malware they come across regardless of who created it. Turning a blind eye to state-sponsored malware, especially in the post-Stuxnet era, would be commercial suicide.


The R2D2 name comes from a string of ASCII, "C3PO-r2d2-POE", found in the mystery Trojan. Likewise, the 0zapftis name also appears, a phrase meaning "the barrel is open" that's used by the Munich mayor in opening Oktoberfest every year.

Security firms agree with CCC that the Trojan is lame. F-Secure's Mikko Hypponen tweeted amusingly:

"It's not well written:
Which, I guess, makes it *more* likely it's developed by a Government..."


Download complete release from CCC (german)

Samker's Computer Forum -


  • SCF Administrator
  • *****
  • Posts: 7151
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • - Samker's Computer Forum
Here's some additional details about the "Bundestrojaner":


  • SCF Member
  • **
  • Posts: 61
  • KARMA: 6
  • Gender: Male
Bundestrojaner aka Federal Trojan (Artemis!87195B5F6272)
« Reply #2 on: 12. October 2011., 07:51:49 »
McAfee 8.7i patch 5  detected this Trojan as Artemis!87195B5F6272.
Control software for the Trojans Command and Control server(in Columbus, Ohio, USA) of this Trojan still running..
 According to  It uses TCP/IP 443 port but not as HTTPS How it possible can any one explain

I wl try to install it on vmware.. thank u for the information


  • SCF Administrator
  • *****
  • Posts: 7151
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • - Samker's Computer Forum

"German officials admit using spyware on citizens, as Big Brother scandal grows":

What to say...?? :-\


With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters)

Enter your email address to receive daily email with ' - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising