Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In the case of the recent find by CCC, how exactly would the malware used by German police for internet wiretapping work? In default mode, it takes screenshots of active windows, it logs data and forwards the data for remote pickup. It is also capable of spying on Skype, and messenger conversations, and executing code on the infected machine. Would this be an example of a rootkit? How would it be installed? How would you detect such malware if AntiVirus don't pick it up.

share|improve this question
Some would classify this malware as a RAT (remote access tool). Seems to be some debate surrounding what to actually call it. – Citizen Mar 12 '15 at 8:45
up vote 6 down vote accepted

From the article, here's my understanding:

The core of this malware is a dll that registers itself to start up on boot, and a kernel module that allows the dll to access kernel-level function that it would not otherwise have access to. Once running, the program listens for incoming commands; depending on the command, it can do a number of things - take a screenshot, record a screencast, etc.; most of these do not require root permissions.

Spying on skype and e-mail happens through user-level API calls - it's as simple as grabbing screenshots and recording audio from the sound card's mix bus. The resulting data is sent back, with AES encryption applied (but in a way that makes the entire encryption process useless - they use a symmetric key, which is hard-coded into the executable, and has been published by the CCC; anyone possessing this key can now easily spoof responses, with no way of checking whether they're genuine.) Another delicate detail is that since the malware mainly spies on local things - it can take a screenshot of an e-mail you're currently writing, and post it back home, regardless of whether you actually send the e-mail or delete it.

There is also a command to download and execute arbitrary code, with full administrator permissions, and this part requires root-level access (otherwise the user would be presented with the usual UAC prompt, exposing the malware).

So yes, the malware contains some kind of root kit, but most of its functionality can be achieved without it.

EDIT: Note the second update by CCC, now 2 years old, for mentioning the discovery of a new software version. It was published three weeks after the first update already linked to from a comment below.

share|improve this answer
Thank you very much for your reply, it seems simple enough of a concept. To stop it would be as simple as analyzing programs starting at boot and disabling any in question? That paired with a strong network packet analysis? – m4ck Oct 15 '11 at 11:47
The IP of the server this thing talks to is also hard-coded, and incoming packets always start with the same sequence (mentioned in the article), so the required network packet analysis isn't going to be that strong. That, or run an OS that is not 32-bit Windows (no versions of this malware have yet been reported that run on OS X, Linux, Unix, or 64-bit Windows). – tdammers Oct 15 '11 at 14:03 – m4ck Oct 15 '11 at 19:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.