14 ms·

I opened a link some random person sent me and I got raided (2015)

251 points by geek_at 7y ago

buboard 7y ago
wow. so this person thought it OK to have all of his life and privacy violated and taken by police because some kiddie defaced some partys stupid webpage. how can one be that complacent? soft people make servile societies i wonder if i should donate him some ETH or is the police going to take that too?
- remmargorp64 7y ago
  What other option does he have, exactly?
  - buboard 7y ago
    i would at least destroy the drives, dont care if that s illegal
    - SamBam 7y ago
      So how would sitting in prison as a result of that action have made the author's life better?
      - buboard 7y ago
        that depends on the definition of a good life
    - soneil 7y ago
      I'm curious how you see this playing out in the real world. Do you: a) Destroy every storage device in your home every time you click a random link on IRC. b) Destroy every storage device in your home "when I opened the door we were greeted by the police, counter terrorism agents and a state-prosecutor". Option A would be an expensive hobby. Option B seems like it would cause more problems than it solved. I'm reminded very much of xkcd's $5 wrench. It also seems to me that in this case, his data is his alibi.
      - brokenmachine 7y ago
        >It also seems to me that in this case, his data is his alibi. Well, there was no evidence on them. If they were destroyed then there would also be no evidence. Agreed on everything else.
bgeeek 7y ago
Is it safe to open the article, though? 8)
azinman2 7y ago
Clicking random links is exactly what HN is all about ;)
- aazaa 7y ago
  Yes, but I think that the attack worked precisely because it was shared with few people (possibly just one).
  - ocdtrekkie 7y ago
    If we apply reasonable doubt that the script kiddie wanted to hurt the author specifically, shouldn't he have spread the link with as many people as possible to bury any particular identity behind tons of random innocent people?
    - Ragnarork 7y ago
      Another reasonable assumption would be that the script kiddie wanted to deflect the attention on one specific person, didn't care who, and in that case might have actually looked for one single IP address to show up at a given (damning) time in the logs.
- bryanrasmussen 7y ago
  That's why I never read the articles, I'm security conscious!
  - martin-adams 7y ago
    What article?
cellular 7y ago
Hey random person, I'm not falling for it!
wyldfire 7y ago
> After getting my drives back I checked one of my USB drives and it had a .docx file on it that didn't come from me. Booooo. Die BVT dropped the ball on preserving the chain of custody for this evidence. They should have used equipment that bars device writes.
- biot 7y ago
  Or leaving the .docx file was intentional and by opening it, the guy triggered a hidden payload which installs malware which the police use to monitor him.
  - Timpy 7y ago
    If they had his hardware for a year I don't think they would need him to trigger a hidden payload.
    - voxic11 7y ago
      Its to allow them to continue monitoring his activities going forward, without the need for annoying warrants and physical searches.
      - marblar 7y ago
        I think the point is that they could have just installed the malware since they had physical possession for an entire year.
        tjoff 7y ago
        And the counterpoint is that he'd obviously got a new computer and any further surveillance would benefit from access to that one.
        Timpy 7y ago
        That's a good point. I was assuming the old hard drive was loaded on old equipment but that's not necessarily the case.
remmargorp64 7y ago
The lesson here is not to avoid clicking random links, because that is an unrealistic expectation. So what is the lesson? Realize that you can get raided at any time, without any warning, due to random life circumstances. Live life accordingly.
- TallGuyShort 7y ago
  Agreed. My first thought was that this makes it incredibly easy for one rogue person in the right place in government and minimal skills covering their own tracks to get anyone they want raided.
- amelius 7y ago
  Encrypt your harddrives, and have some plausible deniability in case they want the encryption keys. E.g.: I'm researching pseudo random numbers, and my harddrives are full of them. Or use hidden partitions, or something like that.
  - tantalor 7y ago
    Getting better at lying to law enforcement is probably not the right lesson to take away.
    - deathanatos 7y ago
      In addition, and in this specific case, it's a lie that is easily discoverable. Just because your data is encrypted does not mean that it all looks random. For example, AIUI, LUKS has a partition header that contains a magic number, identifying it as a LUKS partition. Additionally, GPT's "partition type" field can identify the partition as a LUKS volume.
  - alasdair_ 7y ago
    “This police raid has been extremely stressful and I can’t remember” is a perfectly valid statement.
    - deleted 7y ago
deleted 7y ago
[deleted]
TallGuyShort 7y ago
So keeping all of his computers for a year sounds like a major pain in the ass since he's innocent (I'm not that surprised they did it, it's understandable if you're the head detective, perhaps, but being in tech myself I'm more understanding of "I just clicked a link" and wouldn't consider that much of evidence). I'd lose sleep too just at the thought of the pending investigation and the headache that inherently is even if you're innocent of what they suspected you of. But honestly it's refreshing to read a story about a police raid where the police knocked, the warrant was in order, they were polite and sat down to talk, they explained what was going to happen next, and an agent even acknowledged in front of him that his story was reasonable. I've had a few police departments around me that routinely do none of those things.
- ptah 7y ago
  are you in US? it looks like he is in Germany as the search warrant is in German
  - TallGuyShort 7y ago
    I'm in a fairly average US state and previously lived in Africa. As a Libertarian, I tend not to be the biggest fan of those who idealize Europe's policies, but they sure seem to have avoided dysfunctional government employees better than the rest of us. (And honestly if a typical government employee in the US was of that calibre, I'd be less opposed to bigger government).
    - alasdair_ 7y ago
      The police in the UK are, on average, pretty damn polite compared to any other country I have ever visited or lived in. I honestly think it’s because they (typical beat cop) don’t have guns, so there is no overwhelming force escalation during an encounter.
      - brokenmachine 7y ago
        I'm in Australia. In my experience the cops I've dealt with have been professional and courteous, and they have guns. Horrible aggressive cops seem to be a mostly American phenomenon.
_jal 7y ago
It isn't entirely clear to me that Script Kiddie was actually setting Security Researcher up rather than bragging, but let's assume. The interesting aspect is the weaponization of legit LE - this is similar to swatting. This can easily be extended to harassment by all sorts of random government agencies depending on context. It isn't even really new - you can think of false OSHA reports and the like as similar. I think the new aspect is about the expanded reach of social connections, combined with people's willingness to be much more vicious when the interaction is virtual.
- rickety-gherkin 7y ago
  My first thought was that this was a setup by the Script Kiddie (maybe they did know what they were doing). If you knew that your actions were going to come to light then you might as well messy up the trail for investigators. I wouldn't be surprised to find out this was a planned maneuver
seemslegit 7y ago
For US readers it must be quite incredible to read all this took place amicably and - you weren't SWATed with guns drawn and would even talk to the law enforcement people by yourself (as opposed to only through a lawyer) - which was probably unwise even in Austria - they could have not have people experienced enough or just wouldn't want to admit a mistake
- cptwunderlich 7y ago
  FYI, this was in Austria, the BVT is an Austrian agency, this website is on an .AT domain and he writes in his about page that he is a Texan living in Austria =)
  - seemslegit 7y ago
    Thanks, fixed.
  - geek_at 7y ago
    Born Texan, that's right but haven't been there since a was a few years old. Still feel strangely connected though
jrochkind1 7y ago
> I told them about the script kiddie, the link and that I wasn't using a VPN because I did nothing wrong but of course they were sceptical even thought one of the agents said my story sounded plausible to him. A) This is a weird thing to tell the cops. "I wasn't using a VPN cause I wasn't doing anything illegal, I only use VPNs when I do illegal things!" Uh... you don't want to tell the cops you do illegal things and have opsec procedures for when you do illegal things! No wonder they were skeptical! B) This story is literally the explanation of why "If I'm not breaking any laws, why would I worry about my privacy from the police?" is the wrong attitude. You don't have to have known you did something wrong/illegal, you don't even actually have to had done something wrong/illegal -- for the police to really inconvenience you. It could have been a lot worse than this. Even people who never knowingly/intentionally break laws have an interest in keeping their activities from police notice. As this story demonstrates. "If you have done nothing worng you have nothing to hide, why do you mind police surveillance" -- nope nope nope.
- buboard 7y ago
  surveillance state is the price we pay for a civilized society. abolishing that would mean , like 1% more crime. nobody wants to live in a world like that
  - earlINmeyerkeg 7y ago
    A surveillance state wouldn't be such a burden if the rights we had actually could be enforced on the spot the moment they were infringed by a police force. The fact that you can be imprisoned (borderline indefinitely it seems at times) as well has basically need a lawyer even though your issue is straight up black and white really shows the failures of a police state. Whats the point in having rights in a surveillance state? The government will just make stuff up against you anyway.
    - ericns 7y ago
      Where you say "really shows the failures of a police state." It's a great success, the greatest actually. The people who fail to enforce anything against the police are the same people who need them to act as the tip of their spear. The purpose isn't everyone compliance - just the compliance of those with the potential to change things. Think FBI and MLK, or Aaron Swartz. It's like spear fishing vs mass spam, tracking the individual agents of change and their social network vs fire hoses and dogs at protests.
_sbrk 7y ago
( .. opening link with Startpage's anonymous feature .. )
jchw 7y ago
>Don’t click random links! Alternatively, consider always using at least some kind of VPN. In the modern climate of VPN ads all over tech videos I doubt it is terribly unusual if you have one, yet it immediately makes this kind of bullshit considerably less likely. I feel Wireguard (for those not in the know: a VPN protocol and software suite like OpenVPN) provides the kind of performance and latency that is completely acceptable for almost all traffic other than video games, and if you are a Linux user you can even play with things like network namespaces to force some apps through Wireguard (and maybe some through bare metal.) I am not affiliated with any VPN but I am a happy customer of Mullvad for years, and I don’t recall any time they’ve ended up in the news for bad reasons. I’ve also heard ExpressVPN and PIA are good options.
- robrtsql 7y ago
  PIA might not be a good option anymore: https://restoreprivacy.com/private-internet-access-kape-crossrider/ https://restoreprivacy.com/private-internet-access-kape-cros...
  - colejohnson66 7y ago
    PRQ (run by the people who run the Pirate Bay) has a VPN tunneling service run out of Sweden. It’s about $10/month for the slowest package. https://prq.se/?p=tunnel https://prq.se/?p=tunnel
- jiofih 7y ago
  Will that help at all? The VPN itself will keep track of all your activity, just a warrant away, that’s how they make real money.
  - jchw 7y ago
    >The VPN itself will keep track of all your activity - The trouble here is that the ISP is in the same country as your police. Having a VPN that is in a different jurisdiction requires international warrants. (IANAL.) - Mullvad claims they do not log, as many VPN providers. I have a tin foil hat usually but I think their track record warrants an unusual amount of trust. - You can also do multi hop through Wireguard, if you’re into that kind of thing. >just a warrant away, that’s how they make real money. Now that is unbelievable. You are suggesting to me that the police are paying VPNs for logs? Why would they pay if they have a warrant? I don’t think the data that ISPs or VPNs have is actually worth that much. For VPNs most of it is probably genuinely torrent traffic and HTTPS traffic. Even DNS can be encrypted nowadays (and should be imo.) It’s one thing to say they are selling logs, but it’s hard to believe that’s where they make the real money from. And either way, it’s a completely unsourced claim.
Jerry2 7y ago
What's even scarier is when your browser "clicks" on the link by itself [1] and you don't even realize that you've just sent a request to some 'random' server and that server now has the log of your IP. If you browse 'questionable' sites, definition of which is growing by the day, you should be careful in which log your IP might end up in. I now disable page prefetch on every browser I use. Some browsers don't even use it (which is a sensible thing in 2020 given the risk vs rewards of having it turned on). [1] https://en.wikipedia.org/wiki/Link_prefetching https://en.wikipedia.org/wiki/Link_prefetching
- SamBam 7y ago
  It took me a while to find the setting -- search Chrome preferences found nothing for "prefetch," and a how-to article I found claimed the setting was called "Use a prediction service to load pages more quickly," which also returned nothing, but I finally found it under Advanced -> Privacy -> Preload pages. I was quite pleased, however, to find that this had already been turned off for me, and enforced, by uBlock Origin: https://imgur.com/a/9seIFEU https://imgur.com/a/9seIFEU
  - rickety-gherkin 7y ago
    you can find the option in FF in about:config by searching "prefetch", but mine was also disabled already because of uBlock origin.
- yellowarchangel 7y ago
  Moral of the story is actually to use a VPN regardless of what you do, so you can't be held accountable for someone else's actions or lack of security of IT department of some company.
welly2103 7y ago
> I was also asked for my password and if I had any encrypted data on my PC (which I didn't have at the time). Today you probably encrypted everything, right? Would they force you to tell your password, or what was the intention of just asking for it?
- monkeynotes 7y ago
  https://en.wikipedia.org/wiki/Key_disclosure_law#Germany https://en.wikipedia.org/wiki/Key_disclosure_law#Germany Laws in the UK are pretty Orwellian to say the least: https://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingdom https://en.wikipedia.org/wiki/Key_disclosure_law#United_King...
  - iSnow 7y ago
    This is Austria, not Germany, though the laws are probably very similar.
  - shadowprofile77 7y ago
    One of the comments above mentioned that police in the UK (and western Europe) tend to be more polite than the often aggressive police in the U.S. This is believable, so too is the notion that police and the justice apparatus in the US are also more punitive than their western European counterparts. With these things in mind, it's rather ironic that the U.S turns out to be the much better place for protecting ones digital privacy by refusing to disclose passwords. Since it's not even legally allowed in the US due to the Fifth Amendment... (border crossings still being extremely ambiguous places on this).
6510 7y ago
Google search by image reveals its a doberman. https://www.pictshare.net/500/f8df258bbb.jpg https://www.pictshare.net/500/f8df258bbb.jpg
- martin-adams 7y ago
  Okay, so who is brave enough to click that link?
- colejohnson66 7y ago
  I got “stallion,” as in, a horse.
weinzierl 7y ago
> After getting my drives back I checked one of my USB drives and it had a .docx file on it that didn't come from me. In this Word file there was a photo of some guy (unpixeled). I have no idea who that is (maybe the script kiddie?) but the federal agency must have put it in there by accident. Plot twist: I opened a word document some random agency put on my USB drive and I got a federal trojan.
LinuxBender 7y ago
This might be a good use case for a RasPi for web browsing. If it gets taken, you have not lost much money. You could PXE boot and have the OS run from ram, so you don't even need a hard drive. It really should not use much power. The PXE boot device could just be a generic cheap consumer NAS. If you need to save a file, just https post or sftp it to the cloud somewhere.
- alasdair_ 7y ago
  The police will take everything in your home that even tangentially looks like a computer. Cds, usb sticks, cameras, networking equipment, even things like monitors that can’t store any data have all been taken. The reason seems to be, in part, that they often get to keep the stuff as part of any plea deal and can, and do, use it to equip their computer crime labs with better equipment. This has been happening since the operation Sundevil days where it was documented in Bruce Sterling’s The Hacker Crackdown.
  - LinuxBender 7y ago
    That's a good point. So maybe all they should find is a cheap RasPi and the cheapest NAS and wifi AP you can find.
- geek_at 7y ago
  have you ever surfed the web on a Pi? even a 4.. it's not fun :D
  - alex7o 7y ago
    There is an embedded version of the webkit browser that has hardware acceleration on the pi and works prety well.
  - LinuxBender 7y ago
    I have, but I also tend to not visit sites that have a lot of bloat. El Reg and Scientific American are about the most bloated site I visit and I only pull them up once a day.
clSTophEjUdRanu 7y ago
Why does a security researcher not use a VPN while on IRC? The security community is crawling with bad actors.
A_No_Name_Mouse 7y ago
Something similar but less intrusive happened to me. 10 years ago I was in the early stages of building a price comparison website, still hosted at home. It scraped product prices of several hundreds of online stores. One day I got a letter from the police asking me to come to the police station. I called them asking what this was about, but they said they couldn't tell me on the phone. I said fine, but I won't bother to make the trip if this is not something serious. They then told me I was suspected of fraud. So I made an appointment and talked to the investigator. He told me someone placed an order at a web shop, then hacked the iDeal transaction, the electronic payment system in the Netherlands. My home IP address showed up in the logging. I asked him what the IP address was and I confirmed it was indeed my IP address. For the investigator, this was a sure sign I was the hacker, because who on earth knows his IP address by heart unless you're a hacker? Yeah, I know, not a very smart move. I told him why my IP address had shown up: the scraper had visited the store to update prices. And I told him if I was able to hack iDeal transactions I wouldn't have bothered to make a transaction for a few hundred Euro's. In the end it turned out someone had just placed an order, had it delivered, but didn't pay the invoice afterwards. After a couple of months I received a letter stating I was no longer a suspect, and that seemed the end of end. But not quite: whenever I buy some form of insurance, one of the questions is if I have ever been suspected of fraud. Answer yes and there's a good chance the insurer will refuse. Answer no, and I'm actually committing fraud and the insurance may not be valid. It's also inconvenient as the same question comes up during screening (I'm a security officer now). Lesson learned: my home router now routes all traffic through Mullvad. Just in case.
- 0xffff2 7y ago
  Interesting that "suspected" flies in the EU. I'm not 100% sure, but I don't think an insurer would be allowed to ask anything more than if you've been convicted of fraud in the US.
  - microtherion 7y ago
    I seem to recall that US forms not infrequently ask whether you've ever been "arrested" for X (which is another standard falling short of conviction), but maybe that's just govt forms.
pbreit 7y ago
I'm wondering if this happened to me if I would report it and the result might be quite different?
plumednom 7y ago
I wonder if you can sue the government for preventing the use of your equipment while it depreciated in value?
sh1mmer 7y ago
It seems odd to me that the lesson here wasn’t reporting to the police when some rando you met on IRC has apparently hacked into a political party. Especially given all the state-sponsored meddling in politics recently. They might have done the same thing and taken all your computers but you probably would be in the clear a lot sooner.
thomas232233 7y ago
The author of the post says "I was on a site around the time it was hacked and I had no proxy or VPN." How would a VPN would have saved in this situation. A free public proxy might hide the original ip address to some extent. The VPN would still be linked to his real identity straight away. Right?

251 points by geek_at 7y ago

wow. so this person thought it OK to have all of his life and privacy violated and taken by police because some kiddie defaced some partys stupid webpage. how can one be that complacent? soft people make servile societies i wonder if i should donate him some ETH or is the police going to take that too?

remmargorp64 7y ago
What other option does he have, exactly?
- buboard 7y ago
  i would at least destroy the drives, dont care if that s illegal
  - SamBam 7y ago
    So how would sitting in prison as a result of that action have made the author's life better?
    - buboard 7y ago
      that depends on the definition of a good life
  - soneil 7y ago
    I'm curious how you see this playing out in the real world. Do you: a) Destroy every storage device in your home every time you click a random link on IRC. b) Destroy every storage device in your home "when I opened the door we were greeted by the police, counter terrorism agents and a state-prosecutor". Option A would be an expensive hobby. Option B seems like it would cause more problems than it solved. I'm reminded very much of xkcd's $5 wrench. It also seems to me that in this case, his data is his alibi.
    - brokenmachine 7y ago
      >It also seems to me that in this case, his data is his alibi. Well, there was no evidence on them. If they were destroyed then there would also be no evidence. Agreed on everything else.

bgeeek 7y ago

Is it safe to open the article, though? 8)

azinman2 7y ago

Clicking random links is exactly what HN is all about ;)

aazaa 7y ago
Yes, but I think that the attack worked precisely because it was shared with few people (possibly just one).
- ocdtrekkie 7y ago
  If we apply reasonable doubt that the script kiddie wanted to hurt the author specifically, shouldn't he have spread the link with as many people as possible to bury any particular identity behind tons of random innocent people?
  - Ragnarork 7y ago
    Another reasonable assumption would be that the script kiddie wanted to deflect the attention on one specific person, didn't care who, and in that case might have actually looked for one single IP address to show up at a given (damning) time in the logs.
bryanrasmussen 7y ago
That's why I never read the articles, I'm security conscious!
- martin-adams 7y ago
  What article?

cellular 7y ago

Hey random person, I'm not falling for it!

wyldfire 7y ago

> After getting my drives back I checked one of my USB drives and it had a .docx file on it that didn't come from me. Booooo. Die BVT dropped the ball on preserving the chain of custody for this evidence. They should have used equipment that bars device writes.

biot 7y ago
Or leaving the .docx file was intentional and by opening it, the guy triggered a hidden payload which installs malware which the police use to monitor him.
- Timpy 7y ago
  If they had his hardware for a year I don't think they would need him to trigger a hidden payload.
  - voxic11 7y ago
    Its to allow them to continue monitoring his activities going forward, without the need for annoying warrants and physical searches.
    - marblar 7y ago
      I think the point is that they could have just installed the malware since they had physical possession for an entire year.
      - tjoff 7y ago
        And the counterpoint is that he'd obviously got a new computer and any further surveillance would benefit from access to that one.
        Timpy 7y ago
        That's a good point. I was assuming the old hard drive was loaded on old equipment but that's not necessarily the case.

remmargorp64 7y ago

The lesson here is not to avoid clicking random links, because that is an unrealistic expectation. So what is the lesson? Realize that you can get raided at any time, without any warning, due to random life circumstances. Live life accordingly.

TallGuyShort 7y ago
Agreed. My first thought was that this makes it incredibly easy for one rogue person in the right place in government and minimal skills covering their own tracks to get anyone they want raided.
amelius 7y ago
Encrypt your harddrives, and have some plausible deniability in case they want the encryption keys. E.g.: I'm researching pseudo random numbers, and my harddrives are full of them. Or use hidden partitions, or something like that.
- tantalor 7y ago
  Getting better at lying to law enforcement is probably not the right lesson to take away.
  - deathanatos 7y ago
    In addition, and in this specific case, it's a lie that is easily discoverable. Just because your data is encrypted does not mean that it all looks random. For example, AIUI, LUKS has a partition header that contains a magic number, identifying it as a LUKS partition. Additionally, GPT's "partition type" field can identify the partition as a LUKS volume.
- alasdair_ 7y ago
  “This police raid has been extremely stressful and I can’t remember” is a perfectly valid statement.
  - deleted 7y ago

deleted 7y ago

[deleted]

TallGuyShort 7y ago

So keeping all of his computers for a year sounds like a major pain in the ass since he's innocent (I'm not that surprised they did it, it's understandable if you're the head detective, perhaps, but being in tech myself I'm more understanding of "I just clicked a link" and wouldn't consider that much of evidence). I'd lose sleep too just at the thought of the pending investigation and the headache that inherently is even if you're innocent of what they suspected you of. But honestly it's refreshing to read a story about a police raid where the police knocked, the warrant was in order, they were polite and sat down to talk, they explained what was going to happen next, and an agent even acknowledged in front of him that his story was reasonable. I've had a few police departments around me that routinely do none of those things.

ptah 7y ago
are you in US? it looks like he is in Germany as the search warrant is in German
- TallGuyShort 7y ago
  I'm in a fairly average US state and previously lived in Africa. As a Libertarian, I tend not to be the biggest fan of those who idealize Europe's policies, but they sure seem to have avoided dysfunctional government employees better than the rest of us. (And honestly if a typical government employee in the US was of that calibre, I'd be less opposed to bigger government).
  - alasdair_ 7y ago
    The police in the UK are, on average, pretty damn polite compared to any other country I have ever visited or lived in. I honestly think it’s because they (typical beat cop) don’t have guns, so there is no overwhelming force escalation during an encounter.
    - brokenmachine 7y ago
      I'm in Australia. In my experience the cops I've dealt with have been professional and courteous, and they have guns. Horrible aggressive cops seem to be a mostly American phenomenon.

_jal 7y ago

It isn't entirely clear to me that Script Kiddie was actually setting Security Researcher up rather than bragging, but let's assume. The interesting aspect is the weaponization of legit LE - this is similar to swatting. This can easily be extended to harassment by all sorts of random government agencies depending on context. It isn't even really new - you can think of false OSHA reports and the like as similar. I think the new aspect is about the expanded reach of social connections, combined with people's willingness to be much more vicious when the interaction is virtual.

rickety-gherkin 7y ago
My first thought was that this was a setup by the Script Kiddie (maybe they did know what they were doing). If you knew that your actions were going to come to light then you might as well messy up the trail for investigators. I wouldn't be surprised to find out this was a planned maneuver

seemslegit 7y ago

For US readers it must be quite incredible to read all this took place amicably and - you weren't SWATed with guns drawn and would even talk to the law enforcement people by yourself (as opposed to only through a lawyer) - which was probably unwise even in Austria - they could have not have people experienced enough or just wouldn't want to admit a mistake

cptwunderlich 7y ago
FYI, this was in Austria, the BVT is an Austrian agency, this website is on an .AT domain and he writes in his about page that he is a Texan living in Austria =)
- seemslegit 7y ago
  Thanks, fixed.
- geek_at 7y ago
  Born Texan, that's right but haven't been there since a was a few years old. Still feel strangely connected though

jrochkind1 7y ago

> I told them about the script kiddie, the link and that I wasn't using a VPN because I did nothing wrong but of course they were sceptical even thought one of the agents said my story sounded plausible to him. A) This is a weird thing to tell the cops. "I wasn't using a VPN cause I wasn't doing anything illegal, I only use VPNs when I do illegal things!" Uh... you don't want to tell the cops you do illegal things and have opsec procedures for when you do illegal things! No wonder they were skeptical! B) This story is literally the explanation of why "If I'm not breaking any laws, why would I worry about my privacy from the police?" is the wrong attitude. You don't have to have known you did something wrong/illegal, you don't even actually have to had done something wrong/illegal -- for the police to really inconvenience you. It could have been a lot worse than this. Even people who never knowingly/intentionally break laws have an interest in keeping their activities from police notice. As this story demonstrates. "If you have done nothing worng you have nothing to hide, why do you mind police surveillance" -- nope nope nope.

buboard 7y ago
surveillance state is the price we pay for a civilized society. abolishing that would mean , like 1% more crime. nobody wants to live in a world like that
- earlINmeyerkeg 7y ago
  A surveillance state wouldn't be such a burden if the rights we had actually could be enforced on the spot the moment they were infringed by a police force. The fact that you can be imprisoned (borderline indefinitely it seems at times) as well has basically need a lawyer even though your issue is straight up black and white really shows the failures of a police state. Whats the point in having rights in a surveillance state? The government will just make stuff up against you anyway.
  - ericns 7y ago
    Where you say "really shows the failures of a police state." It's a great success, the greatest actually. The people who fail to enforce anything against the police are the same people who need them to act as the tip of their spear. The purpose isn't everyone compliance - just the compliance of those with the potential to change things. Think FBI and MLK, or Aaron Swartz. It's like spear fishing vs mass spam, tracking the individual agents of change and their social network vs fire hoses and dogs at protests.

_sbrk 7y ago

( .. opening link with Startpage's anonymous feature .. )

jchw 7y ago

>Don’t click random links! Alternatively, consider always using at least some kind of VPN. In the modern climate of VPN ads all over tech videos I doubt it is terribly unusual if you have one, yet it immediately makes this kind of bullshit considerably less likely. I feel Wireguard (for those not in the know: a VPN protocol and software suite like OpenVPN) provides the kind of performance and latency that is completely acceptable for almost all traffic other than video games, and if you are a Linux user you can even play with things like network namespaces to force some apps through Wireguard (and maybe some through bare metal.) I am not affiliated with any VPN but I am a happy customer of Mullvad for years, and I don’t recall any time they’ve ended up in the news for bad reasons. I’ve also heard ExpressVPN and PIA are good options.

robrtsql 7y ago
PIA might not be a good option anymore: https://restoreprivacy.com/private-internet-access-kape-crossrider/ https://restoreprivacy.com/private-internet-access-kape-cros...
- colejohnson66 7y ago
  PRQ (run by the people who run the Pirate Bay) has a VPN tunneling service run out of Sweden. It’s about $10/month for the slowest package. https://prq.se/?p=tunnel https://prq.se/?p=tunnel
jiofih 7y ago
Will that help at all? The VPN itself will keep track of all your activity, just a warrant away, that’s how they make real money.
- jchw 7y ago
  >The VPN itself will keep track of all your activity - The trouble here is that the ISP is in the same country as your police. Having a VPN that is in a different jurisdiction requires international warrants. (IANAL.) - Mullvad claims they do not log, as many VPN providers. I have a tin foil hat usually but I think their track record warrants an unusual amount of trust. - You can also do multi hop through Wireguard, if you’re into that kind of thing. >just a warrant away, that’s how they make real money. Now that is unbelievable. You are suggesting to me that the police are paying VPNs for logs? Why would they pay if they have a warrant? I don’t think the data that ISPs or VPNs have is actually worth that much. For VPNs most of it is probably genuinely torrent traffic and HTTPS traffic. Even DNS can be encrypted nowadays (and should be imo.) It’s one thing to say they are selling logs, but it’s hard to believe that’s where they make the real money from. And either way, it’s a completely unsourced claim.

Jerry2 7y ago

What's even scarier is when your browser "clicks" on the link by itself [1] and you don't even realize that you've just sent a request to some 'random' server and that server now has the log of your IP. If you browse 'questionable' sites, definition of which is growing by the day, you should be careful in which log your IP might end up in. I now disable page prefetch on every browser I use. Some browsers don't even use it (which is a sensible thing in 2020 given the risk vs rewards of having it turned on). [1] https://en.wikipedia.org/wiki/Link_prefetching https://en.wikipedia.org/wiki/Link_prefetching

SamBam 7y ago
It took me a while to find the setting -- search Chrome preferences found nothing for "prefetch," and a how-to article I found claimed the setting was called "Use a prediction service to load pages more quickly," which also returned nothing, but I finally found it under Advanced -> Privacy -> Preload pages. I was quite pleased, however, to find that this had already been turned off for me, and enforced, by uBlock Origin: https://imgur.com/a/9seIFEU https://imgur.com/a/9seIFEU
- rickety-gherkin 7y ago
  you can find the option in FF in about:config by searching "prefetch", but mine was also disabled already because of uBlock origin.
yellowarchangel 7y ago
Moral of the story is actually to use a VPN regardless of what you do, so you can't be held accountable for someone else's actions or lack of security of IT department of some company.

welly2103 7y ago

> I was also asked for my password and if I had any encrypted data on my PC (which I didn't have at the time). Today you probably encrypted everything, right? Would they force you to tell your password, or what was the intention of just asking for it?

monkeynotes 7y ago
https://en.wikipedia.org/wiki/Key_disclosure_law#Germany https://en.wikipedia.org/wiki/Key_disclosure_law#Germany Laws in the UK are pretty Orwellian to say the least: https://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingdom https://en.wikipedia.org/wiki/Key_disclosure_law#United_King...
- iSnow 7y ago
  This is Austria, not Germany, though the laws are probably very similar.
- shadowprofile77 7y ago
  One of the comments above mentioned that police in the UK (and western Europe) tend to be more polite than the often aggressive police in the U.S. This is believable, so too is the notion that police and the justice apparatus in the US are also more punitive than their western European counterparts. With these things in mind, it's rather ironic that the U.S turns out to be the much better place for protecting ones digital privacy by refusing to disclose passwords. Since it's not even legally allowed in the US due to the Fifth Amendment... (border crossings still being extremely ambiguous places on this).

6510 7y ago

Google search by image reveals its a doberman. https://www.pictshare.net/500/f8df258bbb.jpg https://www.pictshare.net/500/f8df258bbb.jpg

martin-adams 7y ago
Okay, so who is brave enough to click that link?
colejohnson66 7y ago
I got “stallion,” as in, a horse.

weinzierl 7y ago

> After getting my drives back I checked one of my USB drives and it had a .docx file on it that didn't come from me. In this Word file there was a photo of some guy (unpixeled). I have no idea who that is (maybe the script kiddie?) but the federal agency must have put it in there by accident. Plot twist: I opened a word document some random agency put on my USB drive and I got a federal trojan.

LinuxBender 7y ago

This might be a good use case for a RasPi for web browsing. If it gets taken, you have not lost much money. You could PXE boot and have the OS run from ram, so you don't even need a hard drive. It really should not use much power. The PXE boot device could just be a generic cheap consumer NAS. If you need to save a file, just https post or sftp it to the cloud somewhere.

alasdair_ 7y ago
The police will take everything in your home that even tangentially looks like a computer. Cds, usb sticks, cameras, networking equipment, even things like monitors that can’t store any data have all been taken. The reason seems to be, in part, that they often get to keep the stuff as part of any plea deal and can, and do, use it to equip their computer crime labs with better equipment. This has been happening since the operation Sundevil days where it was documented in Bruce Sterling’s The Hacker Crackdown.
- LinuxBender 7y ago
  That's a good point. So maybe all they should find is a cheap RasPi and the cheapest NAS and wifi AP you can find.
geek_at 7y ago
have you ever surfed the web on a Pi? even a 4.. it's not fun :D
- alex7o 7y ago
  There is an embedded version of the webkit browser that has hardware acceleration on the pi and works prety well.
- LinuxBender 7y ago
  I have, but I also tend to not visit sites that have a lot of bloat. El Reg and Scientific American are about the most bloated site I visit and I only pull them up once a day.

clSTophEjUdRanu 7y ago

Why does a security researcher not use a VPN while on IRC? The security community is crawling with bad actors.

A_No_Name_Mouse 7y ago

Something similar but less intrusive happened to me. 10 years ago I was in the early stages of building a price comparison website, still hosted at home. It scraped product prices of several hundreds of online stores. One day I got a letter from the police asking me to come to the police station. I called them asking what this was about, but they said they couldn't tell me on the phone. I said fine, but I won't bother to make the trip if this is not something serious. They then told me I was suspected of fraud. So I made an appointment and talked to the investigator. He told me someone placed an order at a web shop, then hacked the iDeal transaction, the electronic payment system in the Netherlands. My home IP address showed up in the logging. I asked him what the IP address was and I confirmed it was indeed my IP address. For the investigator, this was a sure sign I was the hacker, because who on earth knows his IP address by heart unless you're a hacker? Yeah, I know, not a very smart move. I told him why my IP address had shown up: the scraper had visited the store to update prices. And I told him if I was able to hack iDeal transactions I wouldn't have bothered to make a transaction for a few hundred Euro's. In the end it turned out someone had just placed an order, had it delivered, but didn't pay the invoice afterwards. After a couple of months I received a letter stating I was no longer a suspect, and that seemed the end of end. But not quite: whenever I buy some form of insurance, one of the questions is if I have ever been suspected of fraud. Answer yes and there's a good chance the insurer will refuse. Answer no, and I'm actually committing fraud and the insurance may not be valid. It's also inconvenient as the same question comes up during screening (I'm a security officer now). Lesson learned: my home router now routes all traffic through Mullvad. Just in case.

0xffff2 7y ago
Interesting that "suspected" flies in the EU. I'm not 100% sure, but I don't think an insurer would be allowed to ask anything more than if you've been convicted of fraud in the US.
- microtherion 7y ago
  I seem to recall that US forms not infrequently ask whether you've ever been "arrested" for X (which is another standard falling short of conviction), but maybe that's just govt forms.

pbreit 7y ago

I'm wondering if this happened to me if I would report it and the result might be quite different?

plumednom 7y ago

I wonder if you can sue the government for preventing the use of your equipment while it depreciated in value?

sh1mmer 7y ago

It seems odd to me that the lesson here wasn’t reporting to the police when some rando you met on IRC has apparently hacked into a political party. Especially given all the state-sponsored meddling in politics recently. They might have done the same thing and taken all your computers but you probably would be in the clear a lot sooner.

thomas232233 7y ago

The author of the post says "I was on a site around the time it was hacked and I had no proxy or VPN." How would a VPN would have saved in this situation. A free public proxy might hide the original ip address to some extent. The VPN would still be linked to his real identity straight away. Right?