<html>
<head>
<meta name="generator" content="Windows Mail 17.5.9600.20911">
<style><!--
.EmailQuote {
margin-left:1pt;
padding-left:4pt;
border-left:#800000 2px solid;
}
--></style><style data-externalstyle="true"><!--
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph {
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
}
p.MsoNormal, li.MsoNormal, div.MsoNormal {
margin:0in;
margin-bottom:.0001pt;
}
p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst,
p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle,
p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast {
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
line-height:115%;
}
--></style></head>
<body dir="ltr">
<div data-externalstyle="false" dir="ltr" style="font-family: 'Calibri', 'Segoe UI', 'Meiryo', 'Microsoft YaHei UI', 'Microsoft JhengHei UI', 'Malgun Gothic', 'sans-serif';font-size:12pt;">
<div>Hi everyone;</div><div>In 2001, the first public court case dealing with Key loggers was published. The case is SCARFO v. US. In that case, the FBI was tracking an alleged mafia member. He was using PGP to encrypt messages between him and an accomplice.</div><div><br></div><div>The FBI could not decrypt the message so they developed 2 malware applications or maybe 3 (not surer about this as I have not read the case for sometime). The FBI had worked out that SCARFO was using PGP so they surreptitiously loaded the first malware which basically searched for the PGP private key ring and sent the entire ring by FTP to the FBI address. The malware then deleted all traces of the transaction from SCARFO’s machine and then deleted itself.</div><div><br></div><div>Once the FBI had the PGP private Key ring they needed the pass phrase to activate the PGP and thus be able to decrypt all future correspondence. They did this by loading a second piece of malware which was a key-logger. The key-logger lay in wait until PGP was activated and then recorded (I think is was the next 100 characters) typed in. The key logger then packaged this information up and sent it by FTP again to FBI.</div><div><br></div><div>All of this information is detailed in the Affidavit of an FBI agent which can be located on the EFF site.</div><div><br></div><div>Now I am not sure about this but the FBI either had a third malware application or the second malware had extra functionality but every time SCARFO sent an encrypted message to his accomplice the message was also sent to the FBI.</div><div><br></div><div>So my question is, “is it possible for some malware to steal an entire BIT COIN wallet and copy a passphrase and then the perpetrator can spend someone else’s bitcoins”.</div><div><br></div><div>Just a thought.</div><div><br></div><div>I obviously could be naive or just do not understand how BITCOIN wallets operate.</div><div><br></div><div>Any assistance in this would be greatly appreciated. All of the SCARFO docs can be located at EFF.org.</div><div><br></div><div>Kind regards</div><div><br></div><div>Adrian<br></div><div data-signatureblock="true"><div>Dr. Adrian McCullagh <br>Ph.D. LL.B.(Hons) B. App. Sc. (Computing)<br>ODMOB Lawyers <br>Mobile 0401 646 486<br>Skype. Admac57<br>E: ajmccullagh57@gmail.com<br>E: amccullagh@live.com <br>The contents of this email are confidential between the sender and the intended recipient. If you are not the intended recipient then no rights are granted to you because of this error and as such you are requested to promptly inform the sender of the error and to promptly destroy all copies of the email in your power, possession or control. The sender reserves all rights concerning this email and its contents including any privilege, copyright and confidentiality associated with this email. Even though an email signature block has been appended to this email, and notwithstanding the Electronic Transactions Act (Qld) or the Electronic Transactions Act (Cth), the signature block does not exhibit the senders intention to be bound by an offer previously sent by the intended recipient, unless the email in its body specifically indicated that the sender hereby accepts such an offer previously sent by the intended recipient.</div><div><br></div></div><div style="padding-top: 5px; border-top-color: rgb(229, 229, 229); border-top-width: 1px; border-top-style: solid;"><div><font face=" 'Calibri', 'Segoe UI', 'Meiryo', 'Microsoft YaHei UI', 'Microsoft JhengHei UI', 'Malgun Gothic', 'sans-serif'" style='line-height: 15pt; letter-spacing: 0.02em; font-family: "Calibri", "Segoe UI", "Meiryo", "Microsoft YaHei UI", "Microsoft JhengHei UI", "Malgun Gothic", "sans-serif"; font-size: 12pt;'><b>From:</b> <a href="mailto:johnl@iecc.com" target="_parent">John Levine</a><br><b>Sent:</b> Friday, 18 December 2015 5:28 AM<br><b>To:</b> <a href="mailto:cryptography@metzdowd.com" target="_parent">Cryptography Mailing List</a><br><b>Cc:</b> <a href="mailto:bear@sonic.net" target="_parent">Ray Dillinger</a></font></div></div><div><br></div><div dir="">
<div class="PlainText"><br>
_______________________________________________<br>
The cryptography mailing list<br>
cryptography@metzdowd.com<br>
<a href="http://www.metzdowd.com/mailman/listinfo/cryptography" target="_parent">http://www.metzdowd.com/mailman/listinfo/cryptography</a></div>
</div>
</div>
</body>
</html>