As quite expected Microsoft's automated computer forensic utility COFEE (Computer Online Forensic Evidence Extractor) meant for law-enforcement agencies got leaked on internet and is now readily available on torrent portals and file-sharing websites.
The utility is designed EXCLUSIVELY for crime-investigators allowing quick and fully-automated extraction of forensic data from computers suspected of containing criminal activity evidence letting investigators search through data on-site, the utility is provided for free by Microsoft to law-enforcement agencies world-over in a USB device which executes more then 150 commands to collect forensic data offering features such as the ability to decrypt passwords, search the computer's Internet activity, and analyze the data stored on it even including the data stored in volatile memory.
Leaking of such utility in wrong-hands can be a privacy nightmare but once out on the internet it can't be contained, torrent's of COFEE are already up at popular file-sharing portal ThePirateBay and it seems malware authors are once again ready to grab another opportunity to get into your PC's with fake uploads of COFEE.
Comments
First post
woot
Nice find m8
Not a lot to see, mostly basic *nix stuff, but the world must know what our police are armed with.
Sucks
This thing breaks the license agreement about the privacy of the customer when he instals microsoft's OS... ;)
Microsoft writes malware
Lol, The "malware authors" in this case is microshit.
"in the wrong hands?"
Having this in the wrong hands is not a nightmare at all. This package is designed like many other free forensic packages out there, a basic framework that launches a set of command line utilities that are either builtin to the OS or downloaded in the sysinternals suite. This is much hype because it was protected and kept secret, but the reality is, COFEE is meant for non-technical law enforcement to collect data on location. If you are technical, you are better off with another package like IRCR, Helix, etc.
http://praetorianprefect.com/archives/2009/11/more-cofee-please-on-second-thought/
None Technical
Ya it seems to good for a nontechnical persons.....
Not much to it
Basically sysinternals, MSFT utilities, and other things that are already available to forensics investigators.
Add new comment