4 ms·

> Earlier this year, the Mirai defendants worked with FBI agents in Alaska to counter a new evolution of DDoS, known as Memcache what the heck? > The Mirai co

> Earlier this year, the Mirai defendants worked with FBI agents in Alaska to counter a new evolution of DDoS, known as Memcache what the heck? > The Mirai court documents outline how Dalton, Jha, and White jumped into action in March as the attacks propagated online, working alongside the FBI and the security industry to identify vulnerable servers. As in, scan every IP for port 11211?

chelmzy 8y ago
Yep probably. The FBI does not attract top talent these days.
- tptacek 8y ago
  Is that true? What else can you relate about the FBI's talent pool?
  - __s 8y ago
    https://www.fbi.gov/news/speeches/the-fbis-approach-to-the-cyber-threat https://www.fbi.gov/news/speeches/the-fbis-approach-to-the-c...
    - giancarlostoro 8y ago
      > Then I want share, because I can’t get on the stage without talking a little bit about the problem we call Going Dark, which is encryption. And then I’d like to take your questions. And I’m hoping you’re going to think up a question that has nothing to do with Secretary Clinton’s e-mails. Dear Lord... "going dark" like when people go to their banks website?
  - savethefuture 8y ago
    What about the whole "we cant unlock an iphone, make us a tool to unlock all iphones" or could they and lied about it.
    - deleted 8y ago
      [deleted]
    - TaylorAlexander 8y ago
      It always looked to me like they just wanted the tool, and the whole “can’t unlock” was just an excuse.
    - opportune 8y ago
      So much ignorance about this. The FBI needs its evidence to be admissible. I'm sure the FBI has no trouble accessing phones with warrantless surveillance when they need to for national security, but they need surveillance to be legal when it's used as evidence in a judicial context
      - willstrafach 8y ago
        No, this was for a locked iPhone. They were after encrypted data-at-rest. Warantless surveillamce would not apply, as they had a warrant - I believe - seeing as they went after the iCloud data and said it was not helpful (No backup stored there). Additionally, an OIG report seems to suggest they did not attempt their usual avenue for acquiring access tools in order to get in, instead trying to force a legal precedent.
  - ryanlol 8y ago
    Of course it’s true. How could the FBI possibly attract top talent beyond a few altruistic outliers?
    - tptacek 8y ago
      Why would they have any more problem buying talent than anyone else?
      - pcwalton 8y ago
        Because of the President constantly attacking and attempting to sabotage the agency, including firing its head for transparently political reasons. If I were in law enforcement, I'd certainly think twice about taking a position there. I'd be asking myself "what if I get drawn into Trump drama? Would that be good for my career?" I don't mean to overstate things—I'm sure the FBI is mostly composed of talented professionals. But I'd be amazed if the recent drama had no effect on their ability to recruit.
    - JamesBarney 8y ago
      They have an incredible brand. Way more people grow up wanting to be FBI agents than 99% of all other professions.
- trhway 8y ago
  >The FBI does not attract top talent these days. They don't attract it. They arrest it. The benefit is that prospective employee can't refuse the offer.
- pietroglyph 8y ago
  You don't need to attract top talent when they come to you via court order, I suppose…
DiabloD3 8y ago
And scanning every IP for a port is how you trigger automatic abuse reports to whoever owns the IP block, and failure to respond to said abuse reports (and, more importantly, ceasing said abusive behavior) leads to eventually the attacker (the aforementioned government office) having their Internet service ended due to ToS violations. Not only that, I suspect some ISPs now run 11211 honeypots to capture networks that source such attacks, so eventually the FBI would end up in common RBLs due to their abusive behavior. In short, I suspect this entire article is bullshit. It is on Wired, after all.
- gjs278 8y ago
  you massively overestimate what any ISP is going to do. it's nothing. they're not running honey pots, they don't care.
  - blitmap 8y ago
    I think I agree. It's better to not be proactive, especially since port scanning is a natural way to perform diagnostics. I would wait for others tell me there's a problem, I wouldn't put money toward sniffing out problems as an ISP.
- meowface 8y ago
  It's rare that abuse reports are handled quickly, and obviously the FBI is using non-attributable ranges for this kind of stuff. The article has a lot of misnomers but the core reporting seems correct. I would be shocked if the FBI (or Cyber Command or whoever) weren't doing port scanning to help secure the Internet by finding vulnerable servers and services. (I'm sure NSA is, too, but obviously with different objectives.)
- zmapuser 8y ago
  There are many, many institutions preforming global IPv4 scans daily and many tools that allow you to do it[0][1][2]. The trick is to "Be a good citizen", work with a scan friendly host, signal your benevolence, and limit the rate at which you scan. Also smart to black-list DoD networks. If you don't believe me setup a honey pot and open up a popular udp amplification port. Haven't done so myself but I would expect many instances of scanning would be seen everyday. [0]:https://zmap.io/ https://zmap.io/ [1]:https://github.com/robertdavidgraham/masscan https://github.com/robertdavidgraham/masscan [2]:https://memcachedscan.shadowserver.org/ https://memcachedscan.shadowserver.org/
bcaa7f3a8bbc 8y ago
> a new evolution of DDoS, known as Memcache I almost literally LMAOed. So, I also have an evolution way of DDoS, known as TCP/IP! It sounds like a "The hacker known as 4 Chan" joke. Honestly, that Wired magazine which has inspired the DotCom bubble, is long gone. Nowadays, it's basically a waste of time to read, except for occasional good articles.
- nitemice 8y ago
  > Honestly, that Wired magazine which has inspired the DotCom bubble, is long gone. Nowadays, it's basically a waste of time to read, except for occasional good articles. Some of the articles have some pretty nice illustration at least.
- jiveturkey 8y ago
  I still remember it. I have the first few years of issues stashed away somewhere. With it being so reviled, how does it even survive? last resort airplane reading?
foota 8y ago
Scanning every ip is relatively easy, as long as you stick to ipv4. It was done a number of years ago by some grey/black hats. See: http://census2012.sourceforge.net/paper.html http://census2012.sourceforge.net/paper.html And yeah, the explanation of memcache as a type of DDoS is laughable, but it sounds like it was just used for amplification like I think DNS and NTP have been in the past.

chelmzy 8y ago

Yep probably. The FBI does not attract top talent these days.

tptacek 8y ago
Is that true? What else can you relate about the FBI's talent pool?
- __s 8y ago
  https://www.fbi.gov/news/speeches/the-fbis-approach-to-the-cyber-threat https://www.fbi.gov/news/speeches/the-fbis-approach-to-the-c...
  - giancarlostoro 8y ago
    > Then I want share, because I can’t get on the stage without talking a little bit about the problem we call Going Dark, which is encryption. And then I’d like to take your questions. And I’m hoping you’re going to think up a question that has nothing to do with Secretary Clinton’s e-mails. Dear Lord... "going dark" like when people go to their banks website?
- savethefuture 8y ago
  What about the whole "we cant unlock an iphone, make us a tool to unlock all iphones" or could they and lied about it.
  - deleted 8y ago
    [deleted]
  - TaylorAlexander 8y ago
    It always looked to me like they just wanted the tool, and the whole “can’t unlock” was just an excuse.
  - opportune 8y ago
    So much ignorance about this. The FBI needs its evidence to be admissible. I'm sure the FBI has no trouble accessing phones with warrantless surveillance when they need to for national security, but they need surveillance to be legal when it's used as evidence in a judicial context
    - willstrafach 8y ago
      No, this was for a locked iPhone. They were after encrypted data-at-rest. Warantless surveillamce would not apply, as they had a warrant - I believe - seeing as they went after the iCloud data and said it was not helpful (No backup stored there). Additionally, an OIG report seems to suggest they did not attempt their usual avenue for acquiring access tools in order to get in, instead trying to force a legal precedent.
- ryanlol 8y ago
  Of course it’s true. How could the FBI possibly attract top talent beyond a few altruistic outliers?
  - tptacek 8y ago
    Why would they have any more problem buying talent than anyone else?
    - pcwalton 8y ago
      Because of the President constantly attacking and attempting to sabotage the agency, including firing its head for transparently political reasons. If I were in law enforcement, I'd certainly think twice about taking a position there. I'd be asking myself "what if I get drawn into Trump drama? Would that be good for my career?" I don't mean to overstate things—I'm sure the FBI is mostly composed of talented professionals. But I'd be amazed if the recent drama had no effect on their ability to recruit.
  - JamesBarney 8y ago
    They have an incredible brand. Way more people grow up wanting to be FBI agents than 99% of all other professions.
trhway 8y ago
>The FBI does not attract top talent these days. They don't attract it. They arrest it. The benefit is that prospective employee can't refuse the offer.
pietroglyph 8y ago
You don't need to attract top talent when they come to you via court order, I suppose…

DiabloD3 8y ago

And scanning every IP for a port is how you trigger automatic abuse reports to whoever owns the IP block, and failure to respond to said abuse reports (and, more importantly, ceasing said abusive behavior) leads to eventually the attacker (the aforementioned government office) having their Internet service ended due to ToS violations. Not only that, I suspect some ISPs now run 11211 honeypots to capture networks that source such attacks, so eventually the FBI would end up in common RBLs due to their abusive behavior. In short, I suspect this entire article is bullshit. It is on Wired, after all.

gjs278 8y ago
you massively overestimate what any ISP is going to do. it's nothing. they're not running honey pots, they don't care.
- blitmap 8y ago
  I think I agree. It's better to not be proactive, especially since port scanning is a natural way to perform diagnostics. I would wait for others tell me there's a problem, I wouldn't put money toward sniffing out problems as an ISP.
meowface 8y ago
It's rare that abuse reports are handled quickly, and obviously the FBI is using non-attributable ranges for this kind of stuff. The article has a lot of misnomers but the core reporting seems correct. I would be shocked if the FBI (or Cyber Command or whoever) weren't doing port scanning to help secure the Internet by finding vulnerable servers and services. (I'm sure NSA is, too, but obviously with different objectives.)
zmapuser 8y ago
There are many, many institutions preforming global IPv4 scans daily and many tools that allow you to do it[0][1][2]. The trick is to "Be a good citizen", work with a scan friendly host, signal your benevolence, and limit the rate at which you scan. Also smart to black-list DoD networks. If you don't believe me setup a honey pot and open up a popular udp amplification port. Haven't done so myself but I would expect many instances of scanning would be seen everyday. [0]:https://zmap.io/ https://zmap.io/ [1]:https://github.com/robertdavidgraham/masscan https://github.com/robertdavidgraham/masscan [2]:https://memcachedscan.shadowserver.org/ https://memcachedscan.shadowserver.org/

bcaa7f3a8bbc 8y ago

> a new evolution of DDoS, known as Memcache I almost literally LMAOed. So, I also have an evolution way of DDoS, known as TCP/IP! It sounds like a "The hacker known as 4 Chan" joke. Honestly, that Wired magazine which has inspired the DotCom bubble, is long gone. Nowadays, it's basically a waste of time to read, except for occasional good articles.

nitemice 8y ago
> Honestly, that Wired magazine which has inspired the DotCom bubble, is long gone. Nowadays, it's basically a waste of time to read, except for occasional good articles. Some of the articles have some pretty nice illustration at least.
jiveturkey 8y ago
I still remember it. I have the first few years of issues stashed away somewhere. With it being so reviled, how does it even survive? last resort airplane reading?

foota 8y ago

Scanning every ip is relatively easy, as long as you stick to ipv4. It was done a number of years ago by some grey/black hats. See: http://census2012.sourceforge.net/paper.html http://census2012.sourceforge.net/paper.html And yeah, the explanation of memcache as a type of DDoS is laughable, but it sounds like it was just used for amplification like I think DNS and NTP have been in the past.