Microsoft's COFEE Computer Forensic Tools Leaked

from the that-can't-be-good dept

Last year, we wrote about Microsoft’s COFEE tools, which are a set of computer forensic and auditing tools that Microsoft puts on a USB key and gives to law enforcement to use in trying to extract info from a computer. There was some fear that it was a “back door,” but people insisted it was no such thing, but just a collection of basic tools. Still, the fact that the system was promoted as being useful for decrypting passwords and analyzing a computer’s data and internet activity seemed troubling. We noted that if Microsoft was giving it out to law enforcement, it seemed likely that others would have access to it as well.

Well, late last week, reports started showing up noting that COFEE itself had been leaked to various file sharing sites. Apparently, the program had been quite sought after at private tracker — though, after it was leaked there, the admins actually removed the torrent.

Still, you have to imagine that the software is very much out there. So, the question still remains, is this a big deal or not? When we did our original post, many people insisted that there was no big deal in Microsoft COFEE and it was just basic everyday auditing software. Yet, when even is removing the torrent, claiming they “didn’t like” what they saw when they examined the software, in terms of “the potential impact on the site and security of our users and staff,” it does raise certain questions that are similar to those we originally raised.

So, once again, let’s get some feedback from the folks reading here. Is this really a big deal? Or is it just your ordinary tools?

Filed Under: , , ,
Companies: microsoft

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Microsoft's COFEE Computer Forensic Tools Leaked”

Subscribe: RSS Leave a comment
Eric C (profile) says:

Re: Re:

SteelWolf:I think the big deal has less to do with the software itself than with how high-profile it is. My guess is that a site like what would rather not give legal guns additional reason to hunt them down for “leaking secret law enforcement software.”

That was my understanding of it. Steven has posted what they put up on the main page, and though their wording is a bit cryptic, it seems to me that they got rid of it simply because it was so high-profile, and a site like What can exist only as long as it is at least somewhat under the radar. The last thing you want is to have a tool that isn’t that interesting, but will still draw lots of negative attention to your site/private tracker.

Thought Cancer says:


As an Information Security Assessor, I can tell you that I’ve played with COFFEE and the functionality it provides is equivalent or inferior to the tools that the “bad guys” use to compromise systems. That is, there’s nothing that COFFEE can show you that other freely available tools cannot. That said, COFFEE is still a useful tool for basic digital forensics.

Free Capitalist (profile) says:

Better in the Open

It is very curious that the admins pulled this torrent. I wonder if there was pressure from some entity, and if so, who? Could this have been DMCA action from MS?

In my opinion it is better that hacker tools (used for “legitimate reasons”, or otherwise) are kept in the open, available for public review. For law enforcement, there should be no confidential method of obtaining evidence… otherwise how can they claim they even have a chain of evidence?

But to be more salacious, MS has a history of releasing their operating systems with undocumented functions. It would be in the public’s best interest to know just how secure they are when they license an operating system.

But more to the point of security, it is far easier to detect and defend against known threats than against the unknown.

Either way, whether the code is public or not is kind of a moot point. Real hackers can reverse engineer anything, especially operating systems.

There was a big “pantiesinabunchcident” about SATAN back in 95 or so, and I think the world is much better off for having had the tool during that period of Internet proliferation.

Dr Prawn says:

A little research goes a long way

Before the e-media gets all up in arms about this, maybe they should look into the leak itself. Several hints show that it may possibly be a fake.

– All of the included “tools” are preinstalled on a Windows OS since Win2K.

– The few files not included in OS’s are not digitally signed by Microsoft.

– Would MS really release something this major, even only in small circulations with a broken installer?

– Why would MS use opensource ajax javascript when they have already coded similar scripts for use in their live suite of products?

– Would MS really include a “Gang Bustaz” mode in their products, let alone something of this stature?

– None of the accompanying documentation, such as how to use the tools manual contain MS wordmarks, copyright or logos.

– The loader application does nothing more than run scripts that utilise OS’s built in functions and logs them to a .xml, any user can copy files from sys32 to a usb drive and run a batch script to achieve the same effects.

Unsigned files:

Inconsistent design (read: designed by a 7 year old with vbasic)

Steven (profile) says:


Looks like I was a bit off, but here is what they posted:

Nothing is impossible. Nothing is out of reach. That’s the lesson we take away from today, boys and girls (and men and women). Not long after we switched to Gazelle, and instituted the request bounty system, a request popped up for Microsoft COFEE – a forensic tool supplied by Microsoft to law enforcement offices around the world. You can Google it for more details, but the gist is that the tool was developed and distributed solely to law enforcement agencies. Sounds tempting, right?

And it was. So much so that user after user voted for the request, adding to the ever-increasing bounty. Everyone seemed to have a good laugh with it, figuring that no one would ever get their hands on it and actually upload it. That was the staff consensus, at least. Several imitators were uploaded and removed, users were warned, and the bounty remained.

Then, today, a user actually did it. They got a copy of COFEE and uploaded it here. The resourcefulness of our users never ceases to amaze us. Suddenly, we were forced to take a real look at the program, its source, and the potential impact on the site and security of our users and staff. And when we did, we didn’t like what came of it. So, a decision was made. The torrent was removed (and it is not to be uploaded here again.)

Just to be clear: we were not threatened by Microsoft or any law enforcement agency. We haven’t been contacted, nor has our host. This was a decision made by the staff based on our own conversations and feelings about the security impact of having the software here. We know some of you, perhaps the majority of you, won’t agree with it. To those that feel that way, we can only offer an apology and the explanation that we removed it for your security, and ours.

This is not an indication of any policy or rule changes going forward. This is a one-time decision, for a unique situation. This is not something we will do with other torrents or requests. At this point, the software can probably be found elsewhere, for anyone who wants it. We hope you all understand, and will continue searching out those rare items which attract huge request bounties. Feel free to discuss this here, but this decision is final. Thank you, all.

/The What.CD Staff

Chad says:


From what I have read in various articles, people who have used it have used such terms as “useless”, “disappointing” or “unusable” to describe the program.

It’s not as though people have ripped of a program like Photoshop or Finalcut… I think the use of the tool is far beyond the knowledge of the people who are obtaining it.

13 year old script kiddies everywhere will jump at the chance to get this software thinking it will give them access to some secret dimension of a computer system only to be disappointed.

mjpinvestor says:

much hype

When you keep something very secret like COFEE was, it will become a big deal when it is leaked, regardless of what it actually is. Like many comments, the tool is lacking when compared to forensic frameworks that are freely available. If they had published some of this info, no one would care about the leak and it would be a typical torrent. The intention of the tool was for non-techs to be able to run it.

Yohann says:

Heh heh.

More hell for Windows users everywhere.

If you’re a proud Linux user, get yourself Conky and put the script below in the conkyrc file. It will show you the five top incoming connections to your computer so you can see who’s knocking at your door.

${tcp_portmon 1 32767 rhost 0} ${alignr} ${tcp_portmon 1 32767 lservice 0}
${tcp_portmon 1 32767 rhost 1} ${alignr} ${tcp_portmon 1 32767 lservice 1}
${tcp_portmon 1 32767 rhost 2} ${alignr} ${tcp_portmon 1 32767 lservice 2}
${tcp_portmon 1 32767 rhost 3} ${alignr} ${tcp_portmon 1 32767 lservice 3}
${tcp_portmon 1 32767 rhost 4} ${alignr} ${tcp_portmon 1 32767 lservice 4}

You can do the same for outgoing, too.
${tcp_portmon 32768 61000 rhost 0} ${alignr} ${tcp_portmon 32768 61000 rservice 0}
${tcp_portmon 32768 61000 rhost 1} ${alignr} ${tcp_portmon 32768 61000 rservice 1}
${tcp_portmon 32768 61000 rhost 2} ${alignr} ${tcp_portmon 32768 61000 rservice 2}
${tcp_portmon 32768 61000 rhost 3} ${alignr} ${tcp_portmon 32768 61000 rservice 3}
${tcp_portmon 32768 61000 rhost 4} ${alignr} ${tcp_portmon 32768 61000 rservice 4}

Hope this helps.

MikeP (profile) says:

hot potato

From what i understood, the deal was that this was a plug in USB device that your non tech savvy cop could use to pull things off a suspects computer before things could get deleted or destroyed.
I’m guessing the admins pulled it because they took one look and realized “oh crap, in this climate they’re going to decide we’re bloody terrorists, kick down the doors, melt the servers into scrap, and shoot us all while attempting to escape.”
Then it became a “let’s flush this down the toilet before every LEO imaginable sends in a predator drone on this location0”
How useful it is isn’t at all the question, how useful it’s PERCIEVED to be by the relevant authorities on the other hand is.
The whole idea of a super secret program is moronic in this day and age, granted…but to the beancounter who came up with it, it is sacred and must be defended to the death…yours preferably.

I mean they’ve raided data centers and cost people millions for substantially less then this, just a couple of months ago in fact…can’t find the link to the story right offhand, but i’m pretty sure i found it here first so most of you likely remember it

Vic says:

Just a collection of underperforming utilities/tools?

But then again, there could be two or more flavors of COFEE… And lets say the unusual, never before seen one has been uploaded to…

“Safety of our user”? whoa! that’s rich!

I doubt though, that it’s going to be a “one-time decision for a unique situation” to remove the torrent. If they did it once – they’ll do it again to something else.

Eric C (profile) says:

Re: Just a collection of underperforming utilities/tools?

While I wouldn’t say that the safety of their users trumps their own safety, the fact is that if they decide to go after What, everyone involved loses. When Oink was shut down, most of their equipment was seized, including information on usernames, e-mail addresses, and of course, since it’s a BT tracker, IP addresses. That’s a hell of a lot of information for the authorities to have on you, and I would think many users of What would appreciate that sort of diligence toward keeping them away from that situation.

Also, AFAIK, What has been around for a little over two years, and this is the first time that they have done something like this. I’m sure if they were put into a similar situation they’d do it again, and it may be a little bit disingenuous to downplay that, but considering how tight their requirements are for uploads, I doubt they’ll NEED to do this very often.

Jesse (profile) says:

Not so impressive

I’ve played around with the leaked COFEE a bit, and, well, it’s not much to get excited about. It just automatically runs a large set of windows informational utilities (all of which are publicly available) and then generates a pretty report with the results from all of them.

That said, COFEE is extensible – you can easily add tasks that it should perform (and record the results of) on each machine, so a computer forensicist could easily add utilities to dump passwords or copy over certain files, and indeed, the manual’s recommendation that 2GB of storage be available on the device it will log to suggests that they intend for COFEE to record more than the leaked version does (it only records about 600kb of info). Other things, like the presence of a reporting category called “Passwords”, strongly suggest that MS intended (and perhaps implemented) functionality that is not included in the leaked version.

That said, the included validation documents from the National White Collar Crime Center only discuss the utilities included in the leak. Of course, those documents could have been modified, or there could be additional validation documents covering additional utilities not included in the torrent.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...