10 ms·
Spying tools website taken down after UK raids
- sschueller 7y agoSo is the UK going to go after gun sellers and makers as well?
- deleted 7y ago[deleted]
- rwmj 7y agoVery much so, yes, and it's widely supported by the public. eg: https://www.bbc.co.uk/news/uk-england-42430298 https://www.bbc.co.uk/news/uk-england-42430298
- pjc50 7y agoBad analogy in the UK where handguns are entirely illegal and all other firearms are subject to licensing.
- 2038AD 7y ago>where handguns are entirely illegal Handguns aren't entirely illegal in the UK. If I'm not mistaken then, roughly speaking, what the law prohibits is rifles below a certain size. In the UK it is possible, for example, to legally own long-barrelled pistols and old flintlock pistols. Another caveat is that the ban doesn't apply in Northern Ireland. I don't think this really detracts from your point at all.
- matthewheath 7y agoThe full criteria on what makes a weapon illegal to possess can be found at http://www.legislation.gov.uk/ukpga/1968/27/section/5 http://www.legislation.gov.uk/ukpga/1968/27/section/5. The law mostly concerns itself with the length of the barrel, the firing mechanism, and the ammo cartridge size, as well as the ability to discharge noxious substances.
- 2038AD 7y agothanks!
- pbhjpbhj 7y ago>By seizing control of the website, police will have been able to "take a good look at what the site has been up to, including who has bought the illegal items", said Prof Alan Woodward, a cyber-security expert from the University of Surrey. // When did the law pass making owning software illegal, as opposed to using it for nefarious means? (Last time I looked CMA required use.) Anyone have details of the exact charge?
- heyyyouu 7y agoThis was my thought as well. It has to be some sort of UK law? But I can't find it. The laws apply to surreptitiously installing the software on someone else's phone or computer. But then owning (and/or buying) the software shouldn't be illegal and the site shouldn't have been able to come down. Hacking tools aren't illegal by default, that I know of anyway.
- Symbiote 7y agoThe Europol press releases says the arrested developer and employee were in Australia and Belgium, so it's probably law of those countries that's most relevant. The website had Australian phone numbers. https://www.europol.europa.eu/newsroom/news/international-crackdown-rat-spyware-which-takes-total-control-of-victims%E2%80%99-pcs https://www.europol.europa.eu/newsroom/news/international-cr...
- jstanley 7y ago> The NCA said properties in Hull, Leeds, London, Manchester, Merseyside, Milton Keynes, Nottingham, Somerset and Surrey were among those searched. Presumably there would have to be some allegation of UK law-breaking in order to get a search warrant for properties in the UK.
- salad77 7y agoNo, just a mutual aid request from an agency recognized under law enforcement treaty. There are many agreements for mutual recognition and execution of legal process across national boundaries (normally added as part of trade treaty negotiations but sometimes in things like extradition treaties). Lots of FBI raids outside the US are conducted this way - local police do the raid and have FBI 'observe' them in action. In this case, an EU police force and a 5-Eyes nation like Australia will be zero-friction recipient of assistance.
- blowski 7y agoWhat was the software really used for? Did it have a valid use case?
- dylz 7y agoThis looks like bog standard RAT software. I don't imagine any legitimate or valid use cases. Nothing special or unique as far as I can tell?
- jascii 7y agoRemote Access Tools have lots of legitimate use cases: I'm ssh'd into 3 servers as type this..
- nested_callback 7y agoYour ssh client supports binary re-packing to evade antiviruses, hidden monero mining, and webcam and microphone capture to hidden file with "methods to disable the camera LED"?
- jascii 7y agoLol, yes, I could do any of those things if I chose to do so.. Should ssh be illegal? Or shall we stick with the principal that "commiting crimes" is illegal, not "producing tools that can be used to commit a crime"? For what it's worth: "methods to disable the camera LED" was not a feature, that functionality was provided by an external plugin.
- dylz 7y agoI would imagine it didn't help their case that the author of the tool happily endorsed this external plugin?
- Quarrelsome 7y agowhat if pretty much ALL your customers are criminals? That near enough the line for you yet? The moment you add that requested feature to disable the recording light on the camera of the targeted laptop. is that over the line yet? How about if your customers request a function that encrypts the root C:\ and puts up a message with a linked bitcoin address? We still on plausible deniability?
- rahuldottech 7y agoA snapshot of the website from October: https://web.archive.org/web/20191012003358/https://imminentmethods.net/ https://web.archive.org/web/20191012003358/https://imminentm... What it looks like now: https://imminentmethods.net/ https://imminentmethods.net/ Their YouTube channel is still up: https://www.youtube.com/channel/UCRgeFHip2Iz97P25_qGkPfw/feed https://www.youtube.com/channel/UCRgeFHip2Iz97P25_qGkPfw/fee... As is their Twitter account: https://twitter.com/imminentmethods https://twitter.com/imminentmethods From what I can tell, this is just server administration software, but I haven't taken a close look. Edit: Yeah, apparently it was just disguised as that.
- goatsi 7y agoI suspect the marketing materials on other websites give it a different purpose. It's pretty common with this type of software to have a clean website for paypal, but to then be telling people on forums or support chats exactly how to infect unsuspecting people with it. https://krebsonsecurity.com/2018/07/luminositylink-rat-author-pleads-guilty/ https://krebsonsecurity.com/2018/07/luminositylink-rat-autho... https://krebsonsecurity.com/2016/07/canadian-man-is-author-of-popular-orcus-rat/ https://krebsonsecurity.com/2016/07/canadian-man-is-author-o...
- michaelt 7y agoPeople have been calling trojan horses "administration software" since at least Back Orifice in 1998 - probably before. This is "administration software" in the same way the cannabis-leaf-engraved glass smoking pipes sold in your local weed shop are "for tobacco use only"
- dk3 7y agoAre they going to shut down Github next?
- eitland 7y agoCurrently downvoted but very valid point, ref the Sherlock tool posted the other day: it is not hard for me to imagine more bad uses for it than good, but that alone shouldn't make it illegal. Same with guns.
- Quarrelsome 7y agoI'm assuming these people were offering product and service as opposed to code. Here's the old scrap of the site: https://web.archive.org/web/20191012003358/https://imminentmethods.net/ https://web.archive.org/web/20191012003358/https://imminentm... Bung some code whereever but make profit and market it and you've crossed a line.
- jascii 7y agoAn article with a bit more details: https://www.bleepingcomputer.com/news/security/law-enforcement-shuts-down-imminent-monitor-malware-makes-arrests/ https://www.bleepingcomputer.com/news/security/law-enforceme... From what I gleaned from that article, IM-RAT was publicly marketed as a remote management tool. The article further states: "With the amount of reports of this tool being used for malware and the discussion on illegal forums, it would be very hard for the developer to argue that he did not know how the software was being used." This seems pretty thin. Would the authors of say nmap be liable because people can/do use it for illegal purposes? Assuming judges signed of on the raids and domain seizure, I sure hope there was evidence of actual criminal activity beyond what is mentioned in the media.
- rhizome 7y ago>Would the authors of say nmap be liable because people can/do use it for illegal purposes? Don't give them any ideas.
- nested_callback 7y agoFor the people that think this is legitimate software, this is not legitimate software. It is sold and encouraged as malware, used to blackmail girls (barely women) - that's what "cam capture" is for - keylogger, general malware, backconnect proxy, auto-start and persistence. See https://unit42.paloaltonetworks.com/imminent-monitor-a-rat-down-under/ https://unit42.paloaltonetworks.com/imminent-monitor-a-rat-d... for more details and screenshots/quotes of posts by the creator of the tool. This is _not_ for server administration. This is _not_ like PuTTY or Remote Desktop. This is like Blackshades or Orcus. It is malicious, only sold for malicious usage.
- jascii 7y agoI don't think anyone seriously doubts the intended, arguable unethical, use of IM-RAT. The question is whether authoring and or selling these tools is or should be illegal. I'd argue that would set a dangerous precedent allowing governments to go after any security researchers whenever they feel it convenient to do so.
- nested_callback 7y agoI mean, there's probably more than enough intent here for prosecution. There's a fairly significant difference in selling a RAT that does remote administration, and selling a RAT that includes bulletpoint features to evade antivirus detection, persist through removals, and other features explicitly against the wishes of the device owner while the author actively and exclusively only advertises on script-kiddie forums and provides advice and encouragement of malicious infections. I don't think I've ever seen people gone after for the former, even when it's been abused by miscreants. At least in the US, people already "go after" security researchers all the time (at least the companies not smart enough to realise just how much a well meaning email can save them).
- jascii 7y agoFor what it's worth: I have tracked, managed, and recovered hundreds of devices using tools that were hardent against detection and removal at the express request of the device owners in enterprise, educational, and private settings. Mobile asset tracking is a thing. So yeah, there is a legitimate use for that too.
- Rotten194 7y agoFor people who believe the marketing: why would a legitimate sysadmin tool include a cryptocurrency miner and a feature to turn off the webcam indicator light? This was used to exploit people, plain and simple. While I don't think blanket arresting people who downloaded it is reasonable (someone may have fallen for the marketing and used it for legit reasons), shutting down the C&C servers to disable it from working and aiding in exploitation & blackmail is a net good.
- kauffj 7y agoFrom a purely consequentialist perspective, it's not clearly a net good if it has a chilling effect on legitimate research, increases economic costs due to regulatory uncertainty, or has other negative second-order effects concomitant with arbitrary and overly subjective legal systems. From a deontological perspective, it's not clear that this is good if one of your values is clearly and consistently enforced law.
- scoot 7y ago> a feature to turn off the webcam indicator light I naively always assumed that a webcam indicator light was hard wired to turn on when the camera was in use. If it isn't, why on earth not?
- xnyan 7y agoIn addition to more cost, if any part of the led indication circuitry were to fail then you also lost your mic. For some this may be preferred, but I can see some people not happy if the failure of an unrelated part took out their mic.
- __jal 7y agoOlder Macs had the indicator light hardwired. I don't know if they still do. > If it isn't, why on earth not? The same reason for nearly every other design defect in retail-grade hardware: cost vs. margins.
- autoexec 7y ago
- MercuryRising13 7y agoWow,about time they started taking down those sites. No only if other places would as well.
- atypeoferror 7y agoWhat's amusing about all this is companies that offer the exact same services to state or corporate clients are allowed to operate with impunity. e.g. - Zerodium - https://zerodium.com https://zerodium.com - Exodus Intelligence - https://www.exodusintel.com https://www.exodusintel.com - Hacking Team - https://en.wikipedia.org/wiki/Hacking_Team https://en.wikipedia.org/wiki/Hacking_Team (now dead due to the actions of a very skilled gray hat)
- stebann 7y agoGood job UK
- mirimir 7y agoWhy the bloody hell would a firm selling this stuff commercially be so easy to track down and take down? I can't imagine how people are so clueless. I mean, is it like "Sure, we're doing iffy stuff, but it's all in good fun, so why would anyone ever bother us?"