Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Microsoft COFEE Leaked

Soulskill posted more than 4 years ago | from the not-so-hot-cofee-incident dept.

Software 171

54mc writes "Crunchgear reports that Microsoft's long-searched-for forensics tool, COFEE, has been leaked. The tool started on a small, private tracker, but has since worked its way to The Pirate Bay. Not all those who have gotten hold of it are enthused, and reviews have ranged from 'disappointing' to 'useless.' From the article: 'You have absolutely no use for the program. It's not something like Photoshop or Final Cut Pro, an expensive application that you download for the hell of it on the off-chance you need to put Dave Meltzer's face on Brett Hart's body as part of a message board thread. No, COFEE is 100 percent useless to you.'"

cancel ×

171 comments

Sorry! There are no comments related to the filter you selected.

oh (1)

amnezick (1253408) | more than 4 years ago | (#30021312)

more like spilled. Pretty useless if you always turn off your computer when you leave home ... or hear "xxPD, open the door".

But (0)

Anonymous Coward | more than 4 years ago | (#30021322)

I still don't understand what it does.

Re:But (4, Informative)

hansraj (458504) | more than 4 years ago | (#30021524)

Wikipedia is your friend [wikipedia.org] .

Re:But (-1, Troll)

ToasterMonkey (467067) | more than 4 years ago | (#30022252)

Really... why should we have to look up something stated in the summary as "100% useless to us"? Thanks fuck head!

Here

"Microsoft has developed a small plug-in device that investigators can use to quickly extract forensic data from computers that may have been used in crimes.

The COFEE, which stands for Computer Online Forensic Evidence Extractor, is a USB "thumb drive" that was quietly distributed to a handful of law-enforcement agencies last June. Microsoft General Counsel Brad Smith described its use to the 350 law-enforcement experts attending a company conference Monday.

The device contains 150 commands that can dramatically cut the time it takes to gather digital evidence, which is becoming more important in real-world crime, as well as cybercrime. It can decrypt passwords and analyze a computer's Internet activity, as well as data stored in the computer."

That was real painful, now the readers can skip the whole damned thread they only opened to find out WTF COFFEE is, it really is useless to them, and move on. OUTSTANDING.

Re:But (1)

supernova_hq (1014429) | more than 4 years ago | (#30022446)

I just read the entire wikipedia article, and I've done all of that, and more, with backtrack [remote-exploit.org] for FREE.

Re:But (0)

Anonymous Coward | more than 4 years ago | (#30023304)

Cleanup most of Vista's built in spyware (index.dat) files and then find any left over using the following--must be run from Vista's Command Prompt only mode (boot using F8).

[begin file cleanup.bat]
cd "C:\Users\\AppData"
cd Local
rmdir "Temp" /s /q
rmdir "Microsoft Internet Explorer" /s /q
cd ..
cd Roaming
rmdir "Microsoft Internet Explorer" /s /q
cd "C:\Windows\system32\config\systemprofile\AppData"
cd Local
rmdir "Microsoft Internet Explorer" /s /q
cd ..
cd Roaming
rmdir Temp /s /q
rmdir "Microsoft Internet Explorer" /s /q
cd "C:\Windows\ServiceProfiles\LocalService\AppData"
cd Local
rmdir Temp /s /q
rmdir "Microsoft Internet Explorer" /s /q
cd ..
cd Roaming
rmdir Temp /s /q
rmdir "Microsoft Internet Explorer" /s /q
cd "C:\Users\\AppData\Microsoft\Windows"
rmdir "Temporary Internet Files" /s /q
rmdir History /s /q
cd\
dir /s index.dat
[end file cleanup.bat]

(For any left over index.dat files that it finds, you'll have to use "attrib -r -a -s -h", without quotes, on each separate file before they can be deleted. The "attrib -r -a -s -h" removes any read-only, archive, system, and hidden attributes that the file may have.)

This is valid even for perfectly legitimate browsing because, really, the operating system has no business caching and storing browser history once the browser has been closed. (Vista's Delete History and Cookies still leaves the contents of the index.dat files 100% intact.)

Disclaimer: not responsible for any data loss, but it has not caused any data loss when used on my system.

Re:But (5, Insightful)

hansraj (458504) | more than 4 years ago | (#30023398)

Really... why should we have to look up something stated in the summary as "100% useless to us"? Thanks fuck head!

Because:
1) You are wondering what is the damn thing in the first place (like OP did), and
2) You want to make your own opinion.

No one is forcing you to read through the wikipedia entry. I hope, for the sake of people around you, that you don't flip out as easily in real life.

Re:But (4, Insightful)

edumacator (910819) | more than 4 years ago | (#30023834)

Responsible Mods needed...

Come on...this guy responds to someone, who calls him a fuck head for providing a link to information connected to the post, in a calm and measured way, and somehow he gets modded flamebait?

If that doesn't get fixed, I've lost the last little bit of trust I have in the /. mod system.

Re:But (1)

ThatsNotPudding (1045640) | more than 4 years ago | (#30022670)

A case cited by Microsoft in April 2008 credits COFEE as being crucial in a New Zealand investigation into the trafficking of child pornography, producing evidence that led to an arrest[2].

Ah, yes; the stalking horse to justify the destruction of the individuals' right to privacy. And of course, this evidence could never been planted by self-same investigators via their self-same COFEE USB key. Perish the thought.

Re:But (2, Interesting)

LO0G (606364) | more than 4 years ago | (#30023008)

As far as I know, COFEE is only used when you have a search warrant. If you have a search warrant, then by definition there is no right to privacy - by granting the search warrant, the court has said that investigators are allowed to look at your stuff.

In the past, people have tried the "I was framed by the police" gambit before with very limited success - typically courts assume that the people investigating crimes aren't out to plant evidence. I'm not sure that this is a wise decision on the part of the courts but it is what it is.

Re:But (0)

Anonymous Coward | more than 4 years ago | (#30023658)

I'm not a lawyer, but I drink like one, but just because a LE officer has a search warrant doesn't mean the subject has no right to privacy. That's why search warrants have to be so specific.

Re:But (1)

LO0G (606364) | more than 4 years ago | (#30023992)

You're right, I should have been more specific. If a LE officer has a search warrant for the contents of your computer, then he has the right to access the contents of your computer, your right to privacy doesn't apply.

While I don't have any use for the program (4, Insightful)

smallfries (601545) | more than 4 years ago | (#30021324)

It's a bit short-sighted to say that nobody does. I'm sure there are lots of people out there with material on their machines that they wouldn't want a law enforcement officer to find. This tool would be perfect for their needs.

Re:While I don't have any use for the program (1)

nurb432 (527695) | more than 4 years ago | (#30021386)

It sounds so basic that you really don't need to see the application to prevent it from hurting you.

Re:While I don't have any use for the program (0)

Anonymous Coward | more than 4 years ago | (#30024064)

<conspiracy>But what if it's not that basic? WHAT IF IT'S NOT?!? You might end up floating face down in a BLOODY swimming pool that people have PEED in!</conspiracy>

Re:While I don't have any use for the program (4, Insightful)

pla (258480) | more than 4 years ago | (#30021806)

It's a bit short-sighted to say that nobody does. I'm sure there are lots of people out there with material on their machines that they wouldn't want a law enforcement officer to find. This tool would be perfect for their needs.

As a fan of maximizing my privacy, I would find such a tool useful just for auditing the effectiveness of my standard cleanup procedures.

You don't need to break the law to have an interest in others not seeing what you do with your computer. Whether making sure you haven't left personal financial information unencrypted on your machine, or have accidentally clicked "yes" to have your browser remember your passwords, or simply your taste in porn stars... All legal, yet things you probably would rather not leave lying around for anyone other than yourself.

Now, aside from that, don't forget that police exist to help prosecute cases, not to protect us or find the guilty party or any fluffy BS like that. Once they have you in their sights, the less they can dig up, the better. "Good news - Your alibi checked out, you didn't kill that girl. Bad news - Your computer proves that you played poker online once last year, enjoy your 2+ year federal sentence".

And hey, who better to know where Windows leaks information than Microsoft itself? Not that I would trust them as my sole source of privacy maintenance, but as I said, for auditing "best practices", such a tool would appear fairly useful.

Re:While I don't have any use for the program (2, Insightful)

Baron_Yam (643147) | more than 4 years ago | (#30021846)

Most warrants are specific... not that I'd want to defend myself on that basis, but I'm sure a good lawyer could help you if you were investigated for child porn and the only thing they find is some evidence of Internet gambling.

On the other hand, I'd stop the Internet gambling right away, because you know they'd be looking for a way to justify getting you for that having 'lost' the child porn case.

Re:While I don't have any use for the program (4, Informative)

Lloyd_Bryant (73136) | more than 4 years ago | (#30022334)

Most warrants are specific... not that I'd want to defend myself on that basis, but I'm sure a good lawyer could help you if you were investigated for child porn and the only thing they find is some evidence of Internet gambling.

On the other hand, I'd stop the Internet gambling right away, because you know they'd be looking for a way to justify getting you for that having 'lost' the child porn case.

The *warrant* is specific, but if, in the service of the warrant, the officer finds something else, that evidence *can* be seized, and I believe it would be admissible in a court of law (IANAL!).

The police cannot search for something that is not on the warrant, however. So if the warrant specifies a "bicycle", the police would have no business looking in your sock drawer (unless said sock drawer was large enough to hold the bicycle, of course). But if the warrant specifies drugs (which could reasonably be hidden in a sock drawer), and when searching the sock drawer find a pistol, they can seize the pistol, even though it's not on the warrant.

Given the nature of a computer search, I'd expect anything on the hard drive to be fair game...

Re:While I don't have any use for the program (3, Informative)

cawpin (875453) | more than 4 years ago | (#30024136)

But if the warrant specifies drugs (which could reasonably be hidden in a sock drawer), and when searching the sock drawer find a pistol, they can seize the pistol, even though it's not on the warrant.

No they can't. They can only seize it if it is illegal, by itself, for the owner to possess. Now, if they find drugs as well they can probably do so under the right circumstances.

Owning a firearm, in and of itself, is not illegal for most people. This, of course, excludes certain persons such as felons, the mentally unstable and most legal, yes legal, aliens.

Re:While I don't have any use for the program (2, Informative)

nairb774 (728193) | more than 4 years ago | (#30024310)

IANAL, but I think the concept you are looking for is "in plain sight". Programs like this make a lot more things on you computer become visible in a standard search - enough so that the question of whether it qualifies for "in plain sight" has been discussed here and a court case reported on in a slashdot article.

Re:While I don't have any use for the program (4, Interesting)

Deagol (323173) | more than 4 years ago | (#30022570)

They'll get you, one way of the other.

I'm too lazy to find links, but there was a case a while back of some minor who was accused of accessing child porn from one of Yahoo's services. By all accounts I've read, the defense correctly used the high probability of malware infection to introduce doubt that he actually downloaded the CP himself. Facing a harsh, drawn-out legal battle (as most defendants in these cases do), the family took a plea. The boy plead to a count of (something like) corruption of a minor. His "crime"? He apparently gave (or displayed -- can't recall) some adult magazine to one of his fellow under-aged buddies.

That's right, folks, some kid ended up with a criminal record and a listing on his local sex offender list for looking at nude pin-ups with a friend, something countless curious teen boys have done since nude centerfolds have been around.

Won't somebody think of the children?!?

Re:While I don't have any use for the program (4, Informative)

dkleinsc (563838) | more than 4 years ago | (#30023504)

Well, that sort of thing comes from the idea that if we don't tell kids about sex then they won't have it. You know, unlike their parents, grandparents, great-grandparents, and great-great-grandparents.

Re:While I don't have any use for the program (3, Informative)

quickOnTheUptake (1450889) | more than 4 years ago | (#30022626)

Most warrants are specific

Yes but IIRC, in the US, they can use any evidence, even of a crime other than what the warrant was initially for, if they found it while carrying out a legitimate search, while acting within the scope of the warrant.
This happens with Terry stops all the time: The officer has a right to perform a limited search of a suspect (a pat down) to ensure he isn't armed, but in so doing finds a nickle bag, which he can keep as evidence, even though that wasn't what he was allowed to look for.
I believe this goes back to the plain view doctrine [wikipedia.org] .
Car analogy: If they have a warrant to search your car for coke, and while searching, notice a bloody body in the trunk and a machete with your fingerprints and the victim's blood on it in the glove box, they can certainly charge you with murder, even though that's what the warrant was for.
IANAL

Re:While I don't have any use for the program (1)

quickOnTheUptake (1450889) | more than 4 years ago | (#30022798)

. . . that's not what the warrant was for.
FTFM

Re:While I don't have any use for the program (1)

RobertLTux (260313) | more than 4 years ago | (#30024234)

plus if they find Y (or evidence of Y) during a search for X they can in fact ring up a judge to ammend the warrant to include Y or W or Z or ...
this can also be used to expand the search area if evidence supports same (they have a warrant for your house but not grounds and they see something in the house that points to your shed in the garden having evidence they can get the warrant expanded to include the grounds (which they should have had anyway)

Re:While I don't have any use for the program (1)

DarkOx (621550) | more than 4 years ago | (#30024418)

Um warrants are specific but you certainly can be prosecuted based on evidence discovered pursuant to an otherwise legal search on an unrelated matter. So hypothetically lets say the police suspect you of dealing in child porn (sense you used that example) and get a warrant to search your computer of electronic mails relating to that activity.

If They then open your mail program and the first 10 message subjects displayed are all "hey man its your bookie where is my money for the CAVs game yesterday" they would have probably cause to suspect you of another crime open those mails and investigate. You then could certainly be brought up on gambling charges as well. Now if the warrant mentioned nothing about searching the fridge and the police decided to open it up and found the coke(caine) you keep in there you might have an argument; a court might find it was unreasonable to search the fridge for additional evidence of child porn while executing a warrant to search a computer and remove any shoe boxes of photos from the clothests.

IANAL but its never to your interest to be searched by the police; evidence is only tainted if its discovered during an illegal search. If you let them in and say "sure take a look around" and they find anything you can be on the hook.

Re:While I don't have any use for the program (1)

blueg3 (192743) | more than 4 years ago | (#30022734)

COFEE is a live-response tool. It's by no means sufficient to audit the effectiveness of your cleanup procedures.

Re:While I don't have any use for the program (5, Insightful)

Anonymous Coward | more than 4 years ago | (#30021974)

I agree. Using the software may not prove useful, but studying the software to see how it works might be. It is said the software can decrypt passwords and access otherwise inaccessible files. If true, that would be a major security hole that black hats could exploit, so the public has the right to know what exactly COFEE does, how it works, and how to defend their systems from it and similar software.

Re:While I don't have any use for the program (0)

Anonymous Coward | more than 4 years ago | (#30023186)

TrueCrypt would be perfect for their needs.

on a live computer system? (4, Insightful)

nurb432 (527695) | more than 4 years ago | (#30021374)

So, don't run windows, encrypt your drive with hidden partitions and turn the thing off when the cops arrive.

Re:on a live computer system? (1)

Slim Backwater (550617) | more than 4 years ago | (#30022020)

Yes, and install a Big Red Switch [wikipedia.org] .

Re:on a live computer system? (3, Interesting)

Anonymous Coward | more than 4 years ago | (#30023410)

One of the things that happened during the "Hacker Crackdown" in 1990 was that Law Enforcement were trained to quickly separate people and their computers. Then take pictures of the set-up before touching anything. IDK if that is still the case or if they do it for say any old warrent they are serving.

Not having seen the app, but (5, Insightful)

Anonymous Coward | more than 4 years ago | (#30021384)

From the description on the link site, which I think was quoting MS about what does an untrained beat cop do when they find digital evidence? Step back, don't touch it, and call in the law-enforcement folks who are trained and won't destroy the evidence. It's hard enough to get a jury to understand evidence pulled off of a computer - these folks see viruses or similar on their own machines that "just magically appears" so surely the defense's argument that the kiddie porn just magically appeared on his client's machine is completely possible. Having the defense say, "Mr. Officer, you admit to having no background in computer forensics, and you admit to not knowing what the program does. You admit to clicking on the talking paperclip when it said, "I see you are trying to bust a felon. Would you like me to help you?" but have no idea what then happened? Your honor, I move that the case be dismissed because the so-called evidence has obviously not followed the proper evidentiary chain." I'm posting anon because I've gone through the proper training at places like FLETC [fletc.gov] and it's something they drill into us, time and time again. If you're not sure you're qualified to handle investigating the content on the computer, don't touch it. Get someone who is qualified.

Re:Not having seen the app, but (5, Insightful)

ledow (319597) | more than 4 years ago | (#30021740)

I would think even mere insertion of a USB device into a computer could lead to all sorts of problems - what if that USB key had a virus that transferred itself to the PC and then deleted itself from the USB device? The fact that this is a bog-standard set of files means that someone has to put these programs onto a writable USB drive (it's possible it's write-once but I would be dubious of that actually being the case) and then plug it into a computer - exactly the action that companies block by default because of the potential for rogue programs to be introduced and destroy/modify data.

Want to put someone in jail? Put something illegal on that USB drive, plug it into their computer with an autorun script that copies itself over and then deletes itself (and the script) from the USB drive. Then claim that it was a *different* drive you put in and submit a "clean" drive as evidence if they demand to see it.

Not to mention that actually doing *anything* on the original PC is damn stupid anyway but relying on a USB stick to run it? That's got to be asking for trouble. Oh, and disable USB and you've just stopped that attack.

I was always told that *anything* capable of writing to the drive or modifying the data you're trying to access was a no-no... that's why they image the drives through special "read-only" adaptors (apparently harder with SATA nowadays) and then analyse the image. Saving transient information onto a writable USB stick by execution of a program from that stick? Sounds like a recipe for disaster. That's gotta touch your swap or do something to memory in order to execute and proving that happened cleanly and provided a complete accurate copy of the contents of RAM/disk/swap before you plugged it in is probably impossible.

Not having seen the app, but (0)

Anonymous Coward | more than 4 years ago | (#30021966)

I would think even mere insertion of a USB device into a computer could lead to all sorts of problems.

I was always told that *anything* capable of writing to the drive or modifying the data you're trying to access was a no-no... that's why they image the drives through special "read-only" adaptors (apparently harder with SATA nowadays) and then analyse the image.

You are 100% correct. Anytime you access the filesystem or memory of a running computer system there is the potential to inadvertently alter the contents thereof. Such actions are not forensically sound.

Re:Not having seen the app, but (1, Informative)

Anonymous Coward | more than 4 years ago | (#30022740)

In an academic environment yes, but unfortunately the courts are happy to accept that "all efforts were made to ensure the tools used on the live system were free from tampering and their effects on the live system are documented to not damage the integrity of the system's normal operation" thus the evidence gathered using such tools on a live system is usually accepted.

Re:Not having seen the app, but (0)

Anonymous Coward | more than 4 years ago | (#30022070)

maybe they are using bootable live-usb? it could be setup so that no writing is done

Re:Not having seen the app, but (1)

ledow (319597) | more than 4 years ago | (#30022506)

The idea of the utility-pack is to be run when the OS is still working (e.g. to capture passwords that are still in memory etc.). Bootable devices are another thing entirely. Such "off-line" analysis is much easier to do by just copying the drive in a special device that has no write logic to the source drive at all. You wouldn't risk an entire investigation just because you used a bootable CD to access the hard drive first, you'd access the copy.

Re:Not having seen the app, but (1, Insightful)

Anonymous Coward | more than 4 years ago | (#30023054)

Once again, slashdotters seem to think that because something involves a computer it's a new concept, rather than one that has been around since the beginning of civilization.

How is that ANY different than any other case where someone given the task of investigating a crime decides to set up a frame instead? It's not. Planting files on someone's hard drive is exactly like planting fingerprints. Or before fingerprints, planting a gun. Or before guns, planting a weapon with blood on it.

Please stop thinking that this is some new problem that you're solving, or that society is going to shut down because this is an unsolvable problem (which it is to an extent, and always has been since humans first stood upright).

Re:Not having seen the app, but (0)

Anonymous Coward | more than 4 years ago | (#30023550)

Ah. Sweet memories of beautiful downtown Clynco. Does the Mean Green Machine still train there?

I like TEA (0, Offtopic)

BadAnalogyGuy (945258) | more than 4 years ago | (#30021402)

I like my tea green.

But I'd probably give MS Support a call just to talk to this lady [microsoft.com] . I'd love to add some cream to her mug.

Re:I like TEA (2, Funny)

thetoadwarrior (1268702) | more than 4 years ago | (#30021564)

I thought the same thing and pursued her only to find out the her is a he. I became the 2nd person to throw chairs at MS.

Re:I like TEA (1)

CarpetShark (865376) | more than 4 years ago | (#30021696)

That lady is most likely a model who was photographed by someone else, who in turn sold a photo license to microsoft.

Stock photography sucks (1, Informative)

Anonymous Coward | more than 4 years ago | (#30022040)

Bingo. First thing I thought was "generic stock photograph". That one's not too bad, but some of them are really obvious, like the ones of three people standing round a computer in a modern-looking airy office, smiling their white teeth and looking "businesslike". Really obvious stock photo that makes anyone that uses it look cheesy.

Re:I like TEA (1)

CarpetShark (865376) | more than 4 years ago | (#30023720)

I don't know about talking to her or putting cream in her mug, but if you look through the comments below, you can get a pic at 12k resolution for ~£700. Once you've seen her skin magnified that much, you'll likely be cured of any interest you once had ;)

"Microsoft COFFEE Spilled" (5, Funny)

beatsme (1472991) | more than 4 years ago | (#30021438)

Come on, the setup is so obvious!

DECAF (3, Funny)

Anonymous Coward | more than 4 years ago | (#30021576)

"Won’t be long before DECAF is released, which will block attempts to use COFEE on your machine, I’m sure."

-- Mister Toast, Nov 08, 2009, 13:58 [torrentfreak.com]

Re:DECAF (1)

beatsme (1472991) | more than 4 years ago | (#30021804)

Why was this downmodded? The metagods frown upon your sense of humor, Mr. Coward.

Re:DECAF (0)

Anonymous Coward | more than 4 years ago | (#30021850)

We humans are fallable.

Thanks for standing up for me. :)

Re:DECAF (0)

Anonymous Coward | more than 4 years ago | (#30022370)

If the investigator is stupid you might figure out a way to block execution of any exe file named runner.exe (the name of the main executable in the forensics tool, this might actually be possible with some Anti-viruses, then you could password protect the settings of your AV). Or you might be able to set up a script/batchfile that deletes everyting on a USB device that has that particular executable too and then shuts down the machine or maybe formats the computer when this file is detected.

Just a few ideas from the top of my head.

Re:DECAF (0)

Anonymous Coward | more than 4 years ago | (#30022784)

Thought of a few more ideas, you could also make encrypted volumes unmount (TrueCrypt, PGPDisk), securely wipe browser history, wipe certain directories, if you have more than one computer you might send some trigger over the network to make all your computers do the same thing and then shutdown. Man, I'd like to see the look on the investigators face when the fireworks go off. Just for good measure you might end the whole thing with a popup displaying some creative statement.. or do everything in the background to make everything look clean as a whistle.

Second thought, triggering this simply upon detection of "runner.exe" might be overkill (name is too generic), might also want to check if the name of the device is COFEE and check for the bin directory that contains the commands that runner.exe executes.

Re:DECAF (0)

Anonymous Coward | more than 4 years ago | (#30024496)

Bah...MS will be emailing out new procedures and telling them all to change the file names by Monday morning.

Re:"Microsoft COFFEE Spilled" (1)

noidentity (188756) | more than 4 years ago | (#30023322)

Microsoft coffee may seem nice in the morning, but you'll always crash later in the day.

As someone in the Security Field... (0)

Anonymous Coward | more than 4 years ago | (#30021476)

I can tell you that Microsoft COFEE isn't remotely useful for anyone doing bona fide forensics work either.

Re:As someone in the Security Field... (1)

Manip (656104) | more than 4 years ago | (#30021646)

What does someone in the "security field" know about a digital forensics tool?

Very few people are actually in the security field and most who claim to be have posted a bug on a mailing list and setup a site talking about how to "hack" with Visual Basic.

Re:As someone in the Security Field... (1)

Dr. Evil (3501) | more than 4 years ago | (#30021838)

There's nothing wrong with that. Some guys come out of the IT trenches and some come out of the management world. Most of these security guys are presenting themselves to middle and upper level management. They only need to know how to make charts and graphs, for which VB is really very good.

They of course also need to know how to get policies signed, walk into strange meeting rooms, identify and get key people into meetings to understand those policies, implement and audit them regularly. If they have time to pick up a little bit of VB hacking on the side, I'm happy that they can better understand the nuts and bolts. VB is fun in small doses.

I downloaded it. This little thing might be interesting :-)

Re:As someone in the Security Field... (4, Informative)

Anonymous Coward | more than 4 years ago | (#30021942)

I've been doing computer forensics for twenty five years. I am the original poster and I happen to konw exactly what I'm talking about, having been prompted to give detailed feedback about Microsoft's COFEE "suite".

The lowdown:

It doesn't do anything that any number of freely available, open source tools don't do (most of which, or at least most of the lineage of which can be found in Knoppix-STD (www.knoppix-std.org), and it happens to do them poorly.

Re:As someone in the Security Field... (4, Interesting)

Dr. Evil (3501) | more than 4 years ago | (#30022128)

Why has the STD distro not been updated in over 5 years?

Have you tried http://www.remote-exploit.org/backtrack.html [remote-exploit.org] ? It's geared towards pen testing and ethical hacking... but it's VERY good, and modern.

Re:As someone in the Security Field... (0)

Anonymous Coward | more than 4 years ago | (#30022844)

Except half of the software is not setup correctly seeing as it's been setup by people who added it as an after thought, this is evident when it comes to logging options.

Re:As someone in the Security Field... (4, Insightful)

Angostura (703910) | more than 4 years ago | (#30022182)

If only you'd bothered to write that in the summary, rather than the clever-clever "You don't need this" shenanigans. Half these initially posts could have been avoided.

Re:As someone in the Security Field... (2, Funny)

jcr (53032) | more than 4 years ago | (#30022780)

So what you're saying is that it's a true Microsoft product, amirite?

-jcr

Useless? (1)

dandart (1274360) | more than 4 years ago | (#30021502)

It doesn't even make you hyper, either!

Hmm, must be decaf,

Re:Useless? (0)

jep77 (1357465) | more than 4 years ago | (#30021578)

Of course it doesn't... it's missing the necessary double F.

Boring story so far.

Useful (1)

Ilgaz (86384) | more than 4 years ago | (#30021770)

If you are redhat racing with ms , you can use his tool to prove that their platform can't be trusted. All you need is running it.

The Solution? HURD! (4, Funny)

Bananatree3 (872975) | more than 4 years ago | (#30021554)

Its a tool written by Microsoft, for Microsoft products. Do you have nefarious stuff you'd rather not have leaked? Warez or other secret stuff you'd rather keep hidden? The solution? Don't run Windows, run HURD! As added bonus, there's no viruses, no nasties that'll install on your system. No COFEE or other LEO programs to infect your privacy.

HURD...The only sensible solution. [wikipedia.org]

Re:The Solution? HURD! (-1, Troll)

Anonymous Coward | more than 4 years ago | (#30022044)

Faggot.

Re:The Solution? HURD! (1)

Dogtanian (588974) | more than 4 years ago | (#30022082)

Do you have nefarious stuff you'd rather not have leaked? Warez or other secret stuff you'd rather keep hidden? The solution? Don't run Windows, run HURD! As added bonus, there's no viruses, no nasties that'll install on your system.

Are you fucking serious?! The HURD has been in development for almost 20 years, still isn't properly finished, and I've never heard of any software for it, aside (I assume) from the GNU stuff that forms the basis of any Linux distro anyway.

The HURD has likely missed the boat anyway, Linux drove it away years ago.

Re:The Solution? HURD! (1)

heeen (1245200) | more than 4 years ago | (#30022298)

Woooosh!

Re:The Solution? HURD! (0)

Anonymous Coward | more than 4 years ago | (#30024100)

Wooooosch

Re:The Solution? HURD! (2, Insightful)

supersat (639745) | more than 4 years ago | (#30022662)

There's no viruses or nasties for it because NOTHING RUNS ON IT. ;)

Re:The Solution? HURD! (0)

Anonymous Coward | more than 4 years ago | (#30022718)

Maybe the most hilariously brain-damaged troll I've ever seen. Approval!

Re:The Solution? Removable Drive Bay (2, Interesting)

Plekto (1018050) | more than 4 years ago | (#30023048)

Anyone who is truly concerned with security knows that you take your drive with you and/or lock it up at night. Thankfully SSDs are lightweight and easy to stick in a pocket. I'm amazed at how many businesses don't have any physical protection plan in place, because that's how most data ends up getting into the wrong hands.

http://www.startech.com/item/SAT2510U2REM-InfoSafe-35-Bay-Removable-25-SATA-Drive-Enclosure.aspx [startech.com]
Under $40 for this model.

Re:The Solution? HURD! (1)

SLi (132609) | more than 4 years ago | (#30024256)

Maybe. Except things like Firewire (and some USB controllers) allow a device to read all the memory, so they are practically operating system agnostic. They can just grab a live memory image of your Hurd running, which will contain the hard drive crypto key (the only really interesting piece of information I can think of, if your HDD is not encrypted, you don't have much privacy anyway).

Creation of Adam... thought it was the same story (3, Funny)

jep77 (1357465) | more than 4 years ago | (#30021622)

At first I thought these two stories were related.
http://gizmodo.com/5399583/famous-paintings-reproduced-in-coffee [gizmodo.com]
I was about to download the MS tool so I could create my own spectacular tasting, eye-opening, knock-off classic art.

Bloody DUH (4, Insightful)

Shoten (260439) | more than 4 years ago | (#30021628)

Well, of course it's useless to most of them...but that has nothing to do with whether or not COFEE is any good. Let's face it; how many casual downloaders are going to need a forensics toolkit? They already have access to all of their own files, and already know what they've been doing with their system. And COFEE is not meant to be a "point and shoot" system; it's really meant for professionals that know what they're looking for to some degree. So getting a copy and using it doesn't instantly give you some insight into how computer forensics work.

"COFEE is 100 percent useless to you" (0, Redundant)

thomasdz (178114) | more than 4 years ago | (#30021660)

with that ringing endorsement and the spelling that looks annoying like "coffee", but not quite... I didn't even read TFA
I'm not even sure why I'm even commenting.
This is kinda like the message you occasionally see on Slashdot for idle.slashdot.org "don't go there"

Of course it's useless... (1, Redundant)

lisany (700361) | more than 4 years ago | (#30021834)

I don't run windows.

Ummm.... well.... (5, Insightful)

Le Marteau (206396) | more than 4 years ago | (#30021894)

> No, COFEE is 100 percent useless to you.'"

Yes, and the software that runs voting machines is "useless to us", too.

I think the submitter is missing the point. This (probably) closed-source tool by Microsoft (that bears repeating... by MICROSOFT) is going to be used by law enforcement to help throw people in jail. If for no 'practical' use, now that COFFEE is leaked, people will be able to reverse-engineer it an see exactly what it is doing, and how. That is a good thing.

free alternative (3, Interesting)

telenut (1673970) | more than 4 years ago | (#30021938)

Ok, the tool from Microsoft is 'free' also, but here is something with way more options: http://wiki.hak5.org/wiki/USB_Switchblade [hak5.org]

Yummy! (1)

ttyX (1546893) | more than 4 years ago | (#30022162)

Nothing beats a digital cup of coffee...

I am betting that it includes OSS code (0)

Anonymous Coward | more than 4 years ago | (#30022178)

More likely than not, MS has included code from one of the many OSS tools out there for doing this. I would also guess that it borrows from some virus.

Hmm... I wonder (1)

Sfing_ter (99478) | more than 4 years ago | (#30022614)

I wonder... does cofee have a java component?
Can Cofee check my Kaffeine history?

Yes, but does it run Gnu/Linux on Alpha and others (1, Informative)

Anonymous Coward | more than 4 years ago | (#30022694)

As having known a person who had their house raided by the Calgary Police (many times) and their computers stolen as a result of their former employer making false claims, the tool is as useful as the Calgary Police Computer Tech Team (or whatever they are called today).

I saw the photos of the damage caused by the Calgary Police, cut keyboard cables, broken doors, general damage done to the house, broken commercial (legally bought PS3 games, music, films) CD/DVD/BDs, broken case covers, cut USB cables, are just a few of the damage left in the Calgary Police wake.

The items stolen by the Calgary Police under a possible false warrant, included TVs, old laptops from the mid-90s, USB Media, most items labeled Sony, SUN Sparc systems, Compaq Alphas, PS3, Network Switches. and anything Calgary Police felt proved his innocent's. The official list of items stolen, was never provided to him, as the Calgary Police refused to provide, even to his lawyer.

He was handcuffed, body searched, and threaten by Calgary Police with their hands on their pistols to hand over passwords. He refused, taken physical damage. He feels he would have been shot, if his Lawyer and Minister wasn't contacted.

When the Calgary Police found Gnu/Linux on most systems, they told him 'Only hackers use Linux'.

No charges were laid as a result of the raid. Calgary Police had the items for more than 6 months. When the items were returned, some were no longer working.

Re:Yes, but does it run Gnu/Linux on Alpha and oth (1)

jcr (53032) | more than 4 years ago | (#30022840)

No charges were laid as a result of the raid.

WTF? Why didn't he file charges against them?

-jcr

Re:Yes, but does it run Gnu/Linux on Alpha and oth (-1)

Anonymous Coward | more than 4 years ago | (#30023076)

You Ingrish not good!

You rant on about your acquaintance's property being stolen and destroyed by evil policemen and suggest that it was for no valid reason.

Let me restate what you said in a more intelligible fashion.

Calgary police officers, who had proven sufficient probable cause to acquire a search warrant, served said warrant and confiscated various materials listed on the warrant for further investigation and evidence.

After a six month investigation, the materials were returned to the owner and no charges were filed.

So, they did not steal anything. They followed legal procedures and gave back all of the confiscated materials at the conclusion of the investigation.

There may indeed have been damage to the confiscated property but, since you already destroyed your credibility with slanderous allegations of stealing, I'm less willing to believe that there was as much damage as you stated, let alone the intentional vandalism that you asserted.

While I generally choose to believe that a person is innocent until proven guilty, I'd also like to point out that no, or dropped, charges does not prove innocence.

That this person's home was raided on several occasions is probable cause for suspicion in my mind.

Re:Yes, but does it run Gnu/Linux on Alpha and oth (0)

Anonymous Coward | more than 4 years ago | (#30023578)

In Canada it is 90 days before the Police are forced to return the items, not 6 Months.

Calgary Police has kicked dogs to death, with little investigation. Check CBC Website for more details.

Calgary Police has violate the Canadian Charter of Rights and Freedom. Check Canadian News Websites for more details.

Calgary Police have gone to people's employers and told them lies. Check the CBC and other Canadian News Websites for more details.

It is suspected (by people who live and work in Calgary) Calgary Police are using their badges to get what they want. Check the CBC Website for more details.

RCMP has shot (and tasered) people to death. Check CBC, CTV W5, and other news sources for more details.

For independent video and audio, check freenet.

Re:Yes, but does it run Gnu/Linux on Alpha and oth (1)

GeorgeS (11440) | more than 4 years ago | (#30024586)

Some links would be useful. This is the internet after all :)

Nice but there are more robust tools (1)

acedotcom (998378) | more than 4 years ago | (#30022728)

...i know this is a tool for n00bz, but it is seriously lacking in several areas. First of all it even says in its dox, that it is only supported by a suspects computer supporting windows XP, which is still pretty good and better then nothing. Secondly, if the suspects computer doesnt have autorun enabled you have to go to the USB drive and run the EXE on the suspects computer...meaning that if the computer is BIOS locked, encrypted on boot, or password protected, then the user must log in to execute the EXE. i downloaded it and ran it, but it is ineffective against my W7 machines (password protected, encrypted). understanding that if you dont give cops your password when they request it, they can charge you with obstruction of justice and then just move up to REAL computer forensics

I know its not perfect, and it isn't designed for the "1334", but it just seems useless if you are going up against someone who REALLY paranoid or very secure. it seems like if someone has their computer as open as it needs to be to run COFEE, you wouldn't need the tool in the first place, just someone remotely proficient in computers.

Grammer patrol (0)

Anonymous Coward | more than 4 years ago | (#30022730)

Please think about consulting a dictionary. "Enthused" is not an adjective. It is a verb. It is something you do, not a characteristic state of being. "Enthusiastic" is the word you are looking for.

What's the big deal? (0)

Anonymous Coward | more than 4 years ago | (#30022758)

I don't see why this is a big deal. If this were ever used to produce evidence to be used at trial in an actual criminal case, they would have to share that info with the defense. So I'm not sure what the big secret is.

Cofee leak (1)

VGPowerlord (621254) | more than 4 years ago | (#30022774)

How do we know that Microsoft didn't intentionally leak this?

Maybe they did it so that they can start selling Microsoft CREAM!

9FAIlZORS (-1, Offtopic)

Anonymous Coward | more than 4 years ago | (#30022836)

You join tod4y! raise 0r lower the

What about locking your computer? (1)

Myria (562655) | more than 4 years ago | (#30022970)

Would this utility be useless if you lock your computer when you get up from it? If so, the criminally-minded among us should do that.

If it works even with the computer locked, it implies a Microsoft back door into Windows. I doubt this.

Re:What about locking your computer? (1)

rcolbert (1631881) | more than 4 years ago | (#30023684)

Winkey+L is your friend. BitLocker + a printed sign on the outside of your CPU case 'contents copyright [yourname / date]. Now you've made it a crime to circumvent your encryption of copyrighted materials. All my illegal stuff is on an external USB drive, labeled 'illegal stuff'. It is of course encrypted and every time the SWAT team rolls through my neighborhood I pull the USB cable so that if plugged back in I have to unlock the illegal stuff with a strong password (that I have written down on a sticky note so that I don't forget it.)

Sysinternals (0)

Anonymous Coward | more than 4 years ago | (#30023772)

It's basically a set of scripts that runs various sysinternals utilities and dumps the output to a .txt file when you insert an usb drive. Nothing fancy and I'm willing to bet most system admins have written something similar themselves in the past. It's meant to be used by police officers who are not computer experts, so the experts can review the data later.

MS using Suckers^h^h^h^h Customers (0)

Anonymous Coward | more than 4 years ago | (#30023808)

Is it just me or is there something intrinsically wrong with a company that has a history of, how do I put this delicately so the fanboys don't mod me down, security "challenges" to release a free tool that has its express purpose of cracking the operating system that was purchased seemingly in good faith from said company in the first place?

My head *aspload*

PT Barnum must have had MS customers in mind when he made his famous quote. Guess I'll just keep using Linux.

Re:MS using Suckers^h^h^h^h Customers (0)

Anonymous Coward | more than 4 years ago | (#30024476)

Same rationale that safe makers give locksmiths drill templates for their products so they can easily (easily is a relative term when you have to drill through hardened steel) disable the lock mechanism. With the template, a locksmith would take a while boring through. Without it, add to that time the fact that much more hardplate must be chewed up to be able to retract the safe door locking bolts... and the relockers that almost certainly fired off.

This is a similar case in that Microsoft helps forensics people by giving them some basic tools. Ideally, there should be a complete toolkit that consists of a hardware write blocker apparatus for imaging and cryptographic signature tools for chain of custody.

Horay, MS is on the right track! (1)

failedlogic (627314) | more than 4 years ago | (#30024304)

Couple of days from now there will be a HOT COFEE mod for Windows. So much more comprehensive than whatever was in GTA.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?