17 ms·

The Mirai Botnet Architects Are Now Fighting Crime with the FBI

124 points by kposehn 8y ago

ericnyamu 8y ago
Snitches. Nkt!
legohead 8y ago
> Earlier this year, the Mirai defendants worked with FBI agents in Alaska to counter a new evolution of DDoS, known as Memcache what the heck? > The Mirai court documents outline how Dalton, Jha, and White jumped into action in March as the attacks propagated online, working alongside the FBI and the security industry to identify vulnerable servers. As in, scan every IP for port 11211?
- chelmzy 8y ago
  Yep probably. The FBI does not attract top talent these days.
  - tptacek 8y ago
    Is that true? What else can you relate about the FBI's talent pool?
    - __s 8y ago
      https://www.fbi.gov/news/speeches/the-fbis-approach-to-the-cyber-threat https://www.fbi.gov/news/speeches/the-fbis-approach-to-the-c...
      - giancarlostoro 8y ago
        > Then I want share, because I can’t get on the stage without talking a little bit about the problem we call Going Dark, which is encryption. And then I’d like to take your questions. And I’m hoping you’re going to think up a question that has nothing to do with Secretary Clinton’s e-mails. Dear Lord... "going dark" like when people go to their banks website?
    - savethefuture 8y ago
      What about the whole "we cant unlock an iphone, make us a tool to unlock all iphones" or could they and lied about it.
      - deleted 8y ago
        [deleted]
      - TaylorAlexander 8y ago
        It always looked to me like they just wanted the tool, and the whole “can’t unlock” was just an excuse.
      - opportune 8y ago
        So much ignorance about this. The FBI needs its evidence to be admissible. I'm sure the FBI has no trouble accessing phones with warrantless surveillance when they need to for national security, but they need surveillance to be legal when it's used as evidence in a judicial context
        willstrafach 8y ago
        No, this was for a locked iPhone. They were after encrypted data-at-rest. Warantless surveillamce would not apply, as they had a warrant - I believe - seeing as they went after the iCloud data and said it was not helpful (No backup stored there). Additionally, an OIG report seems to suggest they did not attempt their usual avenue for acquiring access tools in order to get in, instead trying to force a legal precedent.
    - ryanlol 8y ago
      Of course it’s true. How could the FBI possibly attract top talent beyond a few altruistic outliers?
      - tptacek 8y ago
        Why would they have any more problem buying talent than anyone else?
        pcwalton 8y ago
        Because of the President constantly attacking and attempting to sabotage the agency, including firing its head for transparently political reasons. If I were in law enforcement, I'd certainly think twice about taking a position there. I'd be asking myself "what if I get drawn into Trump drama? Would that be good for my career?" I don't mean to overstate things—I'm sure the FBI is mostly composed of talented professionals. But I'd be amazed if the recent drama had no effect on their ability to recruit.
      - JamesBarney 8y ago
        They have an incredible brand. Way more people grow up wanting to be FBI agents than 99% of all other professions.
  - trhway 8y ago
    >The FBI does not attract top talent these days. They don't attract it. They arrest it. The benefit is that prospective employee can't refuse the offer.
  - pietroglyph 8y ago
    You don't need to attract top talent when they come to you via court order, I suppose…
- DiabloD3 8y ago
  And scanning every IP for a port is how you trigger automatic abuse reports to whoever owns the IP block, and failure to respond to said abuse reports (and, more importantly, ceasing said abusive behavior) leads to eventually the attacker (the aforementioned government office) having their Internet service ended due to ToS violations. Not only that, I suspect some ISPs now run 11211 honeypots to capture networks that source such attacks, so eventually the FBI would end up in common RBLs due to their abusive behavior. In short, I suspect this entire article is bullshit. It is on Wired, after all.
  - gjs278 8y ago
    you massively overestimate what any ISP is going to do. it's nothing. they're not running honey pots, they don't care.
    - blitmap 8y ago
      I think I agree. It's better to not be proactive, especially since port scanning is a natural way to perform diagnostics. I would wait for others tell me there's a problem, I wouldn't put money toward sniffing out problems as an ISP.
  - meowface 8y ago
    It's rare that abuse reports are handled quickly, and obviously the FBI is using non-attributable ranges for this kind of stuff. The article has a lot of misnomers but the core reporting seems correct. I would be shocked if the FBI (or Cyber Command or whoever) weren't doing port scanning to help secure the Internet by finding vulnerable servers and services. (I'm sure NSA is, too, but obviously with different objectives.)
  - zmapuser 8y ago
    There are many, many institutions preforming global IPv4 scans daily and many tools that allow you to do it[0][1][2]. The trick is to "Be a good citizen", work with a scan friendly host, signal your benevolence, and limit the rate at which you scan. Also smart to black-list DoD networks. If you don't believe me setup a honey pot and open up a popular udp amplification port. Haven't done so myself but I would expect many instances of scanning would be seen everyday. [0]:https://zmap.io/ https://zmap.io/ [1]:https://github.com/robertdavidgraham/masscan https://github.com/robertdavidgraham/masscan [2]:https://memcachedscan.shadowserver.org/ https://memcachedscan.shadowserver.org/
- bcaa7f3a8bbc 8y ago
  > a new evolution of DDoS, known as Memcache I almost literally LMAOed. So, I also have an evolution way of DDoS, known as TCP/IP! It sounds like a "The hacker known as 4 Chan" joke. Honestly, that Wired magazine which has inspired the DotCom bubble, is long gone. Nowadays, it's basically a waste of time to read, except for occasional good articles.
  - nitemice 8y ago
    > Honestly, that Wired magazine which has inspired the DotCom bubble, is long gone. Nowadays, it's basically a waste of time to read, except for occasional good articles. Some of the articles have some pretty nice illustration at least.
  - jiveturkey 8y ago
    I still remember it. I have the first few years of issues stashed away somewhere. With it being so reviled, how does it even survive? last resort airplane reading?
- foota 8y ago
  Scanning every ip is relatively easy, as long as you stick to ipv4. It was done a number of years ago by some grey/black hats. See: http://census2012.sourceforge.net/paper.html http://census2012.sourceforge.net/paper.html And yeah, the explanation of memcache as a type of DDoS is laughable, but it sounds like it was just used for amplification like I think DNS and NTP have been in the past.
rhcom2 8y ago
Something weird to me about the FBI not having good enough technical abilities that the cooperation of these three had such an effect.
- neonate 8y ago
  Maybe it's more cultural than technical.
  - deleted 8y ago
    [deleted]
- gcb0 8y ago
  They are probably just snitching on other people. And this press release was part of a deal they managed to negotiate to make them look good. That is, sadly, how collaboration with law enforcement usually goes.
  - meowface 8y ago
    Undoubtedly, but it's also probably a combination. They seem talented and probably could have provided significant technical expertise. The Bitcoin network analyzer sounds a bit odd since you'd think the FBI already has a team dedicated to cryptocurrency investigations, but who knows. Maybe what they developed was really just that good, perhaps from their past experience tracking competitors and adversaries through the blockchain.
- retox 8y ago
  I believe employees are drug tested, which discounts a large portion of the community.
  - GW150914 8y ago
    That’s probably a factor, but the culture of entrenched government bureaucracy and pay far below what can be gained in the private sector can’t be helping either. Plus, a lot of hackers are fairly ideologically opposed to “big government” in a kind of kneejerk fashion.
excalibur 8y ago
> Get unlimited access + a free YubiKey. Subscribe What's this? > Subscribe today to get unlimited access to WIRED and get a free, exclusive WIRED YubiKey 4. > 1 year for $10 Can I get like 300 subscriptions to Wired?
- tptacek 8y ago
  It's a U2F key, not a Y4.
  - graystevens 8y ago
    I thought the same, but according to Yubico themselves[0], it’s a Yubikey 4 with some branding. Unless that was a previous campaign? [0] https://www.yubico.com/2018/02/wired-ars-technica-experts-choose-yubikey-4-new-subscribers/ https://www.yubico.com/2018/02/wired-ars-technica-experts-ch...
  - ryanlol 8y ago
    Definitely looks like a Y4 https://subscribe.wired.com/subscribe/wired https://subscribe.wired.com/subscribe/wired
    - excalibur 8y ago
      More significantly, it claims to be one.
      - tptacek 8y ago
        Wait, whoah, they're giving away Y4s? I thought (clearly) they were U2F keys. Well, I guess I was wrong.
  - tptacek 8y ago
    ^^ this is wrong
- josefresco 8y ago
  $5 my dude: https://subscribe.wired.com/subscribe/wired/116304 https://subscribe.wired.com/subscribe/wired/116304
dumbfounder 8y ago
Create a botnet that takes down portions of the Internet and you too can put "Internship at the FBI" on your resume.
- cf141q5325 8y ago
  If you are morally ambiguous enough to become a snitch.
  - dumbfounder 8y ago
    I think creating the botnet already put them in that category.
bencollier49 8y ago
And meanwhile the bloke who stopped the WannaCry outbreak is holed up waiting for a court date..
- dx87 8y ago
  He stopped the outbreak entirely by accident. For all he knew, registering the domain name being queried by WannaCry could have caused the malware to start deleting all the data with no chance for recovery. Even if he did know that he was going to stop the outbreak, it doesn't excuse the fact that he helped create tools that he knew were going to be used for illegal activities.
- meowface 8y ago
  He's being charged for activity completely unrelated to the WannaCry outbreak and which occurred years before it. He's likely fully legit now, but no one can alter the past and no one is above the law.
hellbanner 8y ago
Anyone have a link to the .txt interview were the Mirai creator claimed they made their creation to escape "a shitty eastern European country" and their main customers were "Top 5 Minecraft servers"?
savethefuture 8y ago
How did they link the three of them to creating it?
- meowface 8y ago
  It wasn't that hard. Krebs found their leader before the FBI arrested them (though he was on the FBI's radar for a while). https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/ https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-m...
  - lozaning 8y ago
    Krebs is a super impressive guy in my opinion, and him being able to do something is not where my bar for easy starts. His investigative abilities and network of sources I think is unrivaled in his domain.
    - meowface 8y ago
      Unrivaled among journalists when it comes to cybercrime investigations, absolutely. He's good at what he does and also has access to a lot of tools and helpful contributors. But if you follow the steps, which he lays out very clearly, it's pretty apparent that identifying the perpetrators wasn't rocket science, and that it probably wasn't very hard for the FBI.
  - savethefuture 8y ago
    Oh you're right! I had forgotten about this.
stevew20 8y ago
Always knew the FBI was pitching for the other team...
jondubois 8y ago
They got caught so they should be thrown in Jail. They probably made a lot of Bitcoin from operating their botnet. I hate how the government keeps giving criminals free passes. Being a criminal has never been more profitable than it is today. Maybe all honest software devs should consider a career change. Most ex-hackers are millionaires now. What kind of message is that?
- pavel_lishin 8y ago
  > Most ex-hackers are millionaires now. Big ol' [citation needed] on that claim, please.

124 points by kposehn 8y ago

Snitches. Nkt!

> Earlier this year, the Mirai defendants worked with FBI agents in Alaska to counter a new evolution of DDoS, known as Memcache what the heck? > The Mirai court documents outline how Dalton, Jha, and White jumped into action in March as the attacks propagated online, working alongside the FBI and the security industry to identify vulnerable servers. As in, scan every IP for port 11211?

chelmzy 8y ago
Yep probably. The FBI does not attract top talent these days.
- tptacek 8y ago
  Is that true? What else can you relate about the FBI's talent pool?
  - __s 8y ago
    https://www.fbi.gov/news/speeches/the-fbis-approach-to-the-cyber-threat https://www.fbi.gov/news/speeches/the-fbis-approach-to-the-c...
    - giancarlostoro 8y ago
      > Then I want share, because I can’t get on the stage without talking a little bit about the problem we call Going Dark, which is encryption. And then I’d like to take your questions. And I’m hoping you’re going to think up a question that has nothing to do with Secretary Clinton’s e-mails. Dear Lord... "going dark" like when people go to their banks website?
  - savethefuture 8y ago
    What about the whole "we cant unlock an iphone, make us a tool to unlock all iphones" or could they and lied about it.
    - deleted 8y ago
      [deleted]
    - TaylorAlexander 8y ago
      It always looked to me like they just wanted the tool, and the whole “can’t unlock” was just an excuse.
    - opportune 8y ago
      So much ignorance about this. The FBI needs its evidence to be admissible. I'm sure the FBI has no trouble accessing phones with warrantless surveillance when they need to for national security, but they need surveillance to be legal when it's used as evidence in a judicial context
      - willstrafach 8y ago
        No, this was for a locked iPhone. They were after encrypted data-at-rest. Warantless surveillamce would not apply, as they had a warrant - I believe - seeing as they went after the iCloud data and said it was not helpful (No backup stored there). Additionally, an OIG report seems to suggest they did not attempt their usual avenue for acquiring access tools in order to get in, instead trying to force a legal precedent.
  - ryanlol 8y ago
    Of course it’s true. How could the FBI possibly attract top talent beyond a few altruistic outliers?
    - tptacek 8y ago
      Why would they have any more problem buying talent than anyone else?
      - pcwalton 8y ago
        Because of the President constantly attacking and attempting to sabotage the agency, including firing its head for transparently political reasons. If I were in law enforcement, I'd certainly think twice about taking a position there. I'd be asking myself "what if I get drawn into Trump drama? Would that be good for my career?" I don't mean to overstate things—I'm sure the FBI is mostly composed of talented professionals. But I'd be amazed if the recent drama had no effect on their ability to recruit.
    - JamesBarney 8y ago
      They have an incredible brand. Way more people grow up wanting to be FBI agents than 99% of all other professions.
- trhway 8y ago
  >The FBI does not attract top talent these days. They don't attract it. They arrest it. The benefit is that prospective employee can't refuse the offer.
- pietroglyph 8y ago
  You don't need to attract top talent when they come to you via court order, I suppose…
DiabloD3 8y ago
And scanning every IP for a port is how you trigger automatic abuse reports to whoever owns the IP block, and failure to respond to said abuse reports (and, more importantly, ceasing said abusive behavior) leads to eventually the attacker (the aforementioned government office) having their Internet service ended due to ToS violations. Not only that, I suspect some ISPs now run 11211 honeypots to capture networks that source such attacks, so eventually the FBI would end up in common RBLs due to their abusive behavior. In short, I suspect this entire article is bullshit. It is on Wired, after all.
- gjs278 8y ago
  you massively overestimate what any ISP is going to do. it's nothing. they're not running honey pots, they don't care.
  - blitmap 8y ago
    I think I agree. It's better to not be proactive, especially since port scanning is a natural way to perform diagnostics. I would wait for others tell me there's a problem, I wouldn't put money toward sniffing out problems as an ISP.
- meowface 8y ago
  It's rare that abuse reports are handled quickly, and obviously the FBI is using non-attributable ranges for this kind of stuff. The article has a lot of misnomers but the core reporting seems correct. I would be shocked if the FBI (or Cyber Command or whoever) weren't doing port scanning to help secure the Internet by finding vulnerable servers and services. (I'm sure NSA is, too, but obviously with different objectives.)
- zmapuser 8y ago
  There are many, many institutions preforming global IPv4 scans daily and many tools that allow you to do it[0][1][2]. The trick is to "Be a good citizen", work with a scan friendly host, signal your benevolence, and limit the rate at which you scan. Also smart to black-list DoD networks. If you don't believe me setup a honey pot and open up a popular udp amplification port. Haven't done so myself but I would expect many instances of scanning would be seen everyday. [0]:https://zmap.io/ https://zmap.io/ [1]:https://github.com/robertdavidgraham/masscan https://github.com/robertdavidgraham/masscan [2]:https://memcachedscan.shadowserver.org/ https://memcachedscan.shadowserver.org/
bcaa7f3a8bbc 8y ago
> a new evolution of DDoS, known as Memcache I almost literally LMAOed. So, I also have an evolution way of DDoS, known as TCP/IP! It sounds like a "The hacker known as 4 Chan" joke. Honestly, that Wired magazine which has inspired the DotCom bubble, is long gone. Nowadays, it's basically a waste of time to read, except for occasional good articles.
- nitemice 8y ago
  > Honestly, that Wired magazine which has inspired the DotCom bubble, is long gone. Nowadays, it's basically a waste of time to read, except for occasional good articles. Some of the articles have some pretty nice illustration at least.
- jiveturkey 8y ago
  I still remember it. I have the first few years of issues stashed away somewhere. With it being so reviled, how does it even survive? last resort airplane reading?
foota 8y ago
Scanning every ip is relatively easy, as long as you stick to ipv4. It was done a number of years ago by some grey/black hats. See: http://census2012.sourceforge.net/paper.html http://census2012.sourceforge.net/paper.html And yeah, the explanation of memcache as a type of DDoS is laughable, but it sounds like it was just used for amplification like I think DNS and NTP have been in the past.

rhcom2 8y ago

Something weird to me about the FBI not having good enough technical abilities that the cooperation of these three had such an effect.

neonate 8y ago
Maybe it's more cultural than technical.
- deleted 8y ago
  [deleted]
gcb0 8y ago
They are probably just snitching on other people. And this press release was part of a deal they managed to negotiate to make them look good. That is, sadly, how collaboration with law enforcement usually goes.
- meowface 8y ago
  Undoubtedly, but it's also probably a combination. They seem talented and probably could have provided significant technical expertise. The Bitcoin network analyzer sounds a bit odd since you'd think the FBI already has a team dedicated to cryptocurrency investigations, but who knows. Maybe what they developed was really just that good, perhaps from their past experience tracking competitors and adversaries through the blockchain.
retox 8y ago
I believe employees are drug tested, which discounts a large portion of the community.
- GW150914 8y ago
  That’s probably a factor, but the culture of entrenched government bureaucracy and pay far below what can be gained in the private sector can’t be helping either. Plus, a lot of hackers are fairly ideologically opposed to “big government” in a kind of kneejerk fashion.

excalibur 8y ago

> Get unlimited access + a free YubiKey. Subscribe What's this? > Subscribe today to get unlimited access to WIRED and get a free, exclusive WIRED YubiKey 4. > 1 year for $10 Can I get like 300 subscriptions to Wired?

tptacek 8y ago
It's a U2F key, not a Y4.
- graystevens 8y ago
  I thought the same, but according to Yubico themselves[0], it’s a Yubikey 4 with some branding. Unless that was a previous campaign? [0] https://www.yubico.com/2018/02/wired-ars-technica-experts-choose-yubikey-4-new-subscribers/ https://www.yubico.com/2018/02/wired-ars-technica-experts-ch...
- ryanlol 8y ago
  Definitely looks like a Y4 https://subscribe.wired.com/subscribe/wired https://subscribe.wired.com/subscribe/wired
  - excalibur 8y ago
    More significantly, it claims to be one.
    - tptacek 8y ago
      Wait, whoah, they're giving away Y4s? I thought (clearly) they were U2F keys. Well, I guess I was wrong.
- tptacek 8y ago
  ^^ this is wrong
josefresco 8y ago
$5 my dude: https://subscribe.wired.com/subscribe/wired/116304 https://subscribe.wired.com/subscribe/wired/116304

dumbfounder 8y ago

Create a botnet that takes down portions of the Internet and you too can put "Internship at the FBI" on your resume.

cf141q5325 8y ago
If you are morally ambiguous enough to become a snitch.
- dumbfounder 8y ago
  I think creating the botnet already put them in that category.

bencollier49 8y ago

And meanwhile the bloke who stopped the WannaCry outbreak is holed up waiting for a court date..

dx87 8y ago
He stopped the outbreak entirely by accident. For all he knew, registering the domain name being queried by WannaCry could have caused the malware to start deleting all the data with no chance for recovery. Even if he did know that he was going to stop the outbreak, it doesn't excuse the fact that he helped create tools that he knew were going to be used for illegal activities.
meowface 8y ago
He's being charged for activity completely unrelated to the WannaCry outbreak and which occurred years before it. He's likely fully legit now, but no one can alter the past and no one is above the law.

hellbanner 8y ago

Anyone have a link to the .txt interview were the Mirai creator claimed they made their creation to escape "a shitty eastern European country" and their main customers were "Top 5 Minecraft servers"?

savethefuture 8y ago

How did they link the three of them to creating it?

meowface 8y ago
It wasn't that hard. Krebs found their leader before the FBI arrested them (though he was on the FBI's radar for a while). https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/ https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-m...
- lozaning 8y ago
  Krebs is a super impressive guy in my opinion, and him being able to do something is not where my bar for easy starts. His investigative abilities and network of sources I think is unrivaled in his domain.
  - meowface 8y ago
    Unrivaled among journalists when it comes to cybercrime investigations, absolutely. He's good at what he does and also has access to a lot of tools and helpful contributors. But if you follow the steps, which he lays out very clearly, it's pretty apparent that identifying the perpetrators wasn't rocket science, and that it probably wasn't very hard for the FBI.
- savethefuture 8y ago
  Oh you're right! I had forgotten about this.

stevew20 8y ago

Always knew the FBI was pitching for the other team...

jondubois 8y ago

They got caught so they should be thrown in Jail. They probably made a lot of Bitcoin from operating their botnet. I hate how the government keeps giving criminals free passes. Being a criminal has never been more profitable than it is today. Maybe all honest software devs should consider a career change. Most ex-hackers are millionaires now. What kind of message is that?

pavel_lishin 8y ago
> Most ex-hackers are millionaires now. Big ol' [citation needed] on that claim, please.