« Your Chatty, Treasonous iPhone & Notes from Interop | Main | Ripping Passwords With Your Friend John »
April 30, 2008
Mass Disappointment as Microsoft Fails to Let Big Brother in Through the USB Port
The Seattle Times reports on the sort of thing your favorite paranoiac is sure to go completely ape over:
“Microsoft has developed a small plug-in device that investigators can use to quickly extract forensic data from computers that may have been used in crimes.
“The COFEE, which stands for Computer Online Forensic Evidence Extractor, is a USB “thumb drive” that was quietly distributed to a handful of law-enforcement agencies last June. Microsoft General Counsel Brad Smith described its use to the 350 law-enforcement experts attending a company conference Monday.
“The device contains 150 commands that can dramatically cut the time it takes to gather digital evidence, which is becoming more important in real-world crime, as well as cybercrime. It can decrypt passwords and analyze a computer’s Internet activity, as well as data stored in the computer.
“It also eliminates the need to seize a computer itself, which typically involves disconnecting from a network, turning off the power and potentially losing data. Instead, the investigator can scan for evidence on site.
Well, crud … I was all set to go into total hysterics about a Top Secret Federa Windows Backdoor Program when Threat Level went and busted my bubble:
“In reality, COFEE doesn’t need a backdoor to operate. And it’s not a USB memory stick, although agents use a memory stick to run the tool on targeted machines.
“COFEE, according to forensic folk who have used it, is simply a suite of 150 bundled off-the-shelf forensic tools that run from a script. None of the tools are new or were created by Microsoft. Microsoft simply combined existing programs into a portable tool that can be used in the field before agents bring a computer back to their forensic lab.
“Microsoft wouldn’t disclose which tools are in the suite other than that they’re all publicly available, but a forensic expert told me that when he tested the product last year it included standard forensic products like Windows Forensic Toolchest (WFT) and RootkitRevealer.”
It’s maybe a little entertaining that Microsoft won’t tell people what’s in the suite, but then again, if you’re serious enough to care you can probably figure it out for yourself.
Posted by mhall at 4:21 PM | Add Comment
Leave a comment