10 ms·

Analysing the alleged Minneapolis police department “hack”

260 points by weinzierl 6y ago

julianeon 6y ago
Sounds like the 'hack' wasn't one. From the article: > So by all means, be angry, but don't spread disinformation and right now, all signs point to just that - the alleged Minneapolis Police Department "breach" is fake.
- TremendousJudge 6y ago
  Yes, that's why the title has scare quotes and says "alleged"
  - julianeon 6y ago
    It's a long article and I thought I could be helpful by summarizing the conclusion; I don't think a person who didn't read it would grasp that from the quotation marks alone.
MattGaiser 6y ago
The power of disinformation even when it was not even done well. I swallowed the report hook, line, and sinker.
- jcims 6y ago
  I'm sure some would reject this but it's the human condition, we've all let our guard down at some point and let falsehoods...not just the uncertain or unsubstantiated, but outright intentional lies...gain purchase in our worldview.
  - snazz 6y ago
    For sure. I forget who said it, but there's some quote about the intelligent person having strong opinions weakly held. I'm willing to reevaluate my beliefs on things, but unless I've seen evidence to the contrary, I hold them strongly.
rvz 6y ago
Great analysis on uncovering a credential stuffing attack (using passwords found from a previous breach) disguised as a "MPD hack" by "Anonymous" which Troy also discussed here. [0] > But anger shouldn't mean throwing logic and reason out the window and I cannot think of a time where fact-checking has ever been more important than now, not just because of the Minneapolis situation, but because so much of what we see online simply can't be trusted. So by all means, be angry, but don't spread disinformation and right now all signs point to just that - the alleged Minneapolis Police Department "breach" is fake. The above text really does question what we see on the internet since it is very easy to fabricate news and evidence like this. With that being disproved, we should take such news on social media with a grain of salt until the full evidence from each side and analysis is available. Once we do that we will be less susceptible to being deceived unlike the retweeter at the bottom of the blog post. [0] https://twitter.com/troyhunt/status/1267237884949483522 https://twitter.com/troyhunt/status/1267237884949483522
- amrrs 6y ago
  My heuristics is, By default, Anything controversial I see on the internet is fake until it's proven to be true. I've been advocating this to my parents and a few others for quite a while. Especially from a country like India where there are people being lynched and killed just based on WhatsApp videos (mostly fake), Skepticism is required more than ever.
  - jobigoud 6y ago
    This rule means you have to consider almost everything as fake. Like say, a video of police brutality filmed by one person. How do you "prove" it to be non fake?
    - rvz 6y ago
      > a video of police brutality filmed by one person. How do you "prove" it to be non fake? You might have almost answered your own question. If there are many videos shot by random bystanders in multiple angles of the event, even if one is fabricated, another video can disprove it; making it harder to fake the event. This would mean that one would have to 'fake' all the videos and angles from other people which is difficult to do, especially if it is live. So with that, it can be proved to 'have happened' but only if the bystanders are un-related to each other. Otherwise it will look 'staged'.
a-wu 6y ago
The other thing I keep seeing is a "leak" of a court filing by "Anonymous" alleging that Trump and Epstein committed various sexual offenses. I think it's unfortunate that the disinformation attributing this to Anonymous is spreading because the court filing has been publicly available since 2016. It seems that two Twitter accounts are parroting this around under the guises on Anonymous which really discredits the actual group.
- zucker42 6y ago
  Has Anonymous ever been an actual group or more of a loose collection of people claiming the name?
  - kart23 6y ago
    Read the wikipedia page, its pretty accurate. There have been arrests for 'Anonymous' hacks but it's not really a group, more so an idea.
    - a-wu 6y ago
      You're totally right and I shouldn't have referred to them as one entity. Even so, I think that Twitter accounts "representing" Anonymous spreading misinformation really discredits the work other Anonymous members do.
      - ryanlol 6y ago
        > the work other Anonymous members do such as?
      - aspenmayer 6y ago
        sabu[1] existed and was an actual person behind a keyboard at least some of the time. Hard to say where it starts and where it ends now, or then. [1] https://en.wikipedia.org/wiki/Hector_Monsegur https://en.wikipedia.org/wiki/Hector_Monsegur
      - monadic2 6y ago
brenden2 6y ago
My take: I don't think the government understands how must distrust there is for public institutions. The fact that they keep going on these pressers and lying to the public, only to be discredited after the fact, shows how tone deaf and disconnected from reality the politicians are. What's even more bizarre is all the people who are cheering on the police brutality, and encouraging more violence against unarmed protestors. There are systemic issues all throughout the government, and as long as cops keep killing people the riots will continue. Maybe they'll temporarily subside, but when the next killing happens it will flare right back up. Cops operate with impunity, and the politicians go on TV apologizing for them because they're afraid of the police too. Just look what happened to de Blasio's daughter, who was arrested by the NYPD under questionable circumstances. It's crazy watching this all unfold, but if real change isn't implemented soon it will continue to foment. It doesn't help that along with racism, there's significantly economic inequality. Real unemployment is somewhere around 24%[0], food prices keep going up[1], and many still haven't been able to access unemployment benefits. [0]: https://fortune.com/2020/05/28/us-unemployment-rate-numbers-claims-this-week-total-job-losses-may-28-2020-benefits-claims-job-losses/ https://fortune.com/2020/05/28/us-unemployment-rate-numbers-... [1]: https://apnews.com/54f1efe0afa71b0a939fda91cf917366 https://apnews.com/54f1efe0afa71b0a939fda91cf917366
- quinnd 6y ago
  > But in a post subsequently removed from Twitter, the NYPD Sergeants Benevolent Association (SBA) accused de Blasio, 25, of “object throwing.” > The account also posted de Blasio’s internal arrest file, which included her home address (Gracie Mansion, the mayor’s residence), ID number and other personal information. [0] https://talkingpointsmemo.com/news/nypd-sergeants-union-tweets-arrest-report-for-mayor-de-blasios-daughter https://talkingpointsmemo.com/news/nypd-sergeants-union-twee... apparently the address is public knowledge anyway, if that wasn't true the doxing would be a lot worse.
- Mirioron 6y ago
  The government isn't a single person or even consistent entity. Different people and groups are vying for control via control of the government. Some people distrusting the current government and others supporting it is pretty much what politicians want (it's also the natural result of politics). I don't think this will change much when it comes to governing. Hopefully there will be change with how the police work in the US, but the political play is going to stay the same. Some people might just end up being switched out. Just think of it this way: almost all of the rioting/protesting is happening in blue areas. They have a Democratic mayor, police chief, state representatives etc. The police are under the control of these local officials, not federal officials. At the same time, many of protestors are angry at Trump and other Republicans on a federal level. So who do they vote for to enact change? Voting for those same Democrats in local ejections keeps the status quo, but at the same time they don't like the opposition (Republicans). They can elect a different federal president, but that isn't going to change the police issue as long as the local status quo remains. All in all, I would say that politically not much is going to change.
raverbashing 6y ago
Most often, when the media/pr announces a "sophisticated cyber attack" has happened, what actually has happened is that the password was "123456" or the site ran an old WordPress version, etc
- genghisjahn 6y ago
  Example?
  - willcipriano 6y ago
    Weevs AT&T 'hack' (unsecured api) is the first thing that comes to mind.
  - taneq 6y ago
    The Cambridge Analytica scandal comes to mind. It was reported in some places as a "hack" when they literally just used Facebook's APIs for their intended purposes.
pelasaco 6y ago
somebody with a twitter handle "Antifa Bunny #BlackLivesMatter #ACAB ️ ️" doesn't need this analysis to discover that he/she is dumb.
bargle0 6y ago
What is the point of fabricating this attack?
- PavewayIV 6y ago
  Sad that nobody recognized this bit of social engineering for what it probably is: another way for the feds to vacuum up IPs for anyone dumb enough to try to log in using one of them. No, they're not going to SWAT your apartment tonight if you violate federal CISA laws. It's simply another data point (of thousands or millions) on you in MAIN CORE to profile you. For what? Who knows. If you already have an 'interesting' profile, maybe they will drop by. You: "But the password didn't work - I didn't get in!" Judge: "You and your cellmate Brutus will have, oh... five years or so to discuss the finer legal points of your case... when you two are not 'otherwise' occupied. Baliff, let's not keep Brutus waiting."
- lolc 6y ago
  I can't decide whether this was done for the lulz or to make the police look incompetent. Maybe both?
  - bargle0 6y ago
    Or to create a fake threat against the police to justify further action, maybe? Or maybe a third party actor just doing it to create confusion and a lack of trust? I think a state actor would do a better job, though.
- seangrogg 6y ago
  Consider whose voice, opinion, or stance stands to gain by making the police look incompetent or incapable of managing their own affairs.
  - rectang 6y ago
    Or, stands to gain from making Anonymous appear more threatening.
  - deleted 6y ago
tehjoker 6y ago
I get the point that's being made here, but the real question is do the passwords work even if they are derivative? Did someone extract anything of value using them?
chroem- 6y ago
Russia was caught running ads during the 2016 election that were sympathetic to radical white and black nationalist groups, with the end goal of sowing racial tensions. [0] I'm of the firm belief that we're being played by a hostile state actor here. I have no way of proving this, but I strongly suspect that Russia and/or China are trying to spur on the unrest through digital disinformation like in the OP. EDIT: by unrest I am (of course) referring to violence and looting, not peaceful protest [0] https://slate.com/technology/2018/05/russian-trolls-are-obsessed-with-black-lives-matter.html https://slate.com/technology/2018/05/russian-trolls-are-obse...
- simion314 6y ago
  It is also a very human thing to find someone else to blame for your faults, especially when elections are around the corner.
- xenospn 6y ago
  I think you're absolutely right. It's easy, too - fake a few Antifa tweets, white suburbia panics (literally happened today), pay someone to break a few windows and run away, cops hit anything that moves.
- joe_the_user 6y ago
  Your claim has nothing to do with this alleged hack.
- boomboomsubban 6y ago
  The US is by far the most likely hostile state actor. They are the ones that benefit from the protesters being seen as more radical and destructive than they are, while Russia or China would be working towards hypothetical future benefits.
  - bravo22 6y ago
    The media and the government are both very clear that there are fringe elements (both far-left and far-right) infiltrating the protests and trying to derail the efforts. So everyone is going out of their way to separate protesting from looting. The only place I see where there is concentrated effort to equate protestors and rioting is on the twitter left.
tialaramex 6y ago
> it's extremely unusual to see the same email address with multiple different passwords in a legitimate data breach as most systems simply won't let an address register more than once I've actually built a system which did this years ago, over our initial protestations, and the reasoning went like this: Our client (this was a white label product) has lots of elderly couples as customers, these are our end users and although they're on the Internet (makes sense, this is after all a web site you've white labelled so if you have customers without Internet that's a red flag right there) they only have one email address between them. So some end users want two accounts, but with one email address. This made the login procedure a bit hairy and obviously there are scary corner cases for things like change password (Alice decides to use the same password as her husband Bob, now we can't tell their accounts apart!) but we felt that arguing with clients about why they should do Single Sign On (and thus eliminate the separate login for our white label product altogether) was more valuable than trying to change old people's minds about what constitutes a reasonable thing for two people to share.
- fastball 6y ago
  nice.old.couple+alice@gmail.com nice.old.couple+bob@gmail.com
  - hobofan 6y ago
    That works for GMail but not for a lot of other email providers.
    - bildung 6y ago
      Isn't that part of the email RFCs for 2 decades or so? Postfix certainly supports this for quite a while now. Edit: sendmail and qmail, too, apparently: https://www.cs.rutgers.edu/~watrous/plus-signs-in-email-addresses.html https://www.cs.rutgers.edu/~watrous/plus-signs-in-email-addr...
      - lighthazard 6y ago
        Too bad Comcast/Xfinity and other ISPs don't really provide up-to-spec email clients or servers. Who cute.old.couple@comcast most likely uses.

260 points by weinzierl 6y ago

Sounds like the 'hack' wasn't one. From the article: > So by all means, be angry, but don't spread disinformation and right now, all signs point to just that - the alleged Minneapolis Police Department "breach" is fake.

TremendousJudge 6y ago
Yes, that's why the title has scare quotes and says "alleged"
- julianeon 6y ago
  It's a long article and I thought I could be helpful by summarizing the conclusion; I don't think a person who didn't read it would grasp that from the quotation marks alone.

MattGaiser 6y ago

The power of disinformation even when it was not even done well. I swallowed the report hook, line, and sinker.

jcims 6y ago
I'm sure some would reject this but it's the human condition, we've all let our guard down at some point and let falsehoods...not just the uncertain or unsubstantiated, but outright intentional lies...gain purchase in our worldview.
- snazz 6y ago
  For sure. I forget who said it, but there's some quote about the intelligent person having strong opinions weakly held. I'm willing to reevaluate my beliefs on things, but unless I've seen evidence to the contrary, I hold them strongly.

rvz 6y ago

Great analysis on uncovering a credential stuffing attack (using passwords found from a previous breach) disguised as a "MPD hack" by "Anonymous" which Troy also discussed here. [0] > But anger shouldn't mean throwing logic and reason out the window and I cannot think of a time where fact-checking has ever been more important than now, not just because of the Minneapolis situation, but because so much of what we see online simply can't be trusted. So by all means, be angry, but don't spread disinformation and right now all signs point to just that - the alleged Minneapolis Police Department "breach" is fake. The above text really does question what we see on the internet since it is very easy to fabricate news and evidence like this. With that being disproved, we should take such news on social media with a grain of salt until the full evidence from each side and analysis is available. Once we do that we will be less susceptible to being deceived unlike the retweeter at the bottom of the blog post. [0] https://twitter.com/troyhunt/status/1267237884949483522 https://twitter.com/troyhunt/status/1267237884949483522

amrrs 6y ago
My heuristics is, By default, Anything controversial I see on the internet is fake until it's proven to be true. I've been advocating this to my parents and a few others for quite a while. Especially from a country like India where there are people being lynched and killed just based on WhatsApp videos (mostly fake), Skepticism is required more than ever.
- jobigoud 6y ago
  This rule means you have to consider almost everything as fake. Like say, a video of police brutality filmed by one person. How do you "prove" it to be non fake?
  - rvz 6y ago
    > a video of police brutality filmed by one person. How do you "prove" it to be non fake? You might have almost answered your own question. If there are many videos shot by random bystanders in multiple angles of the event, even if one is fabricated, another video can disprove it; making it harder to fake the event. This would mean that one would have to 'fake' all the videos and angles from other people which is difficult to do, especially if it is live. So with that, it can be proved to 'have happened' but only if the bystanders are un-related to each other. Otherwise it will look 'staged'.

a-wu 6y ago

The other thing I keep seeing is a "leak" of a court filing by "Anonymous" alleging that Trump and Epstein committed various sexual offenses. I think it's unfortunate that the disinformation attributing this to Anonymous is spreading because the court filing has been publicly available since 2016. It seems that two Twitter accounts are parroting this around under the guises on Anonymous which really discredits the actual group.

zucker42 6y ago
Has Anonymous ever been an actual group or more of a loose collection of people claiming the name?
- kart23 6y ago
  Read the wikipedia page, its pretty accurate. There have been arrests for 'Anonymous' hacks but it's not really a group, more so an idea.
  - a-wu 6y ago
    You're totally right and I shouldn't have referred to them as one entity. Even so, I think that Twitter accounts "representing" Anonymous spreading misinformation really discredits the work other Anonymous members do.
    - ryanlol 6y ago
      > the work other Anonymous members do such as?
    - aspenmayer 6y ago
      sabu[1] existed and was an actual person behind a keyboard at least some of the time. Hard to say where it starts and where it ends now, or then. [1] https://en.wikipedia.org/wiki/Hector_Monsegur https://en.wikipedia.org/wiki/Hector_Monsegur
    - monadic2 6y ago

brenden2 6y ago

My take: I don't think the government understands how must distrust there is for public institutions. The fact that they keep going on these pressers and lying to the public, only to be discredited after the fact, shows how tone deaf and disconnected from reality the politicians are. What's even more bizarre is all the people who are cheering on the police brutality, and encouraging more violence against unarmed protestors. There are systemic issues all throughout the government, and as long as cops keep killing people the riots will continue. Maybe they'll temporarily subside, but when the next killing happens it will flare right back up. Cops operate with impunity, and the politicians go on TV apologizing for them because they're afraid of the police too. Just look what happened to de Blasio's daughter, who was arrested by the NYPD under questionable circumstances. It's crazy watching this all unfold, but if real change isn't implemented soon it will continue to foment. It doesn't help that along with racism, there's significantly economic inequality. Real unemployment is somewhere around 24%[0], food prices keep going up[1], and many still haven't been able to access unemployment benefits. [0]: https://fortune.com/2020/05/28/us-unemployment-rate-numbers-claims-this-week-total-job-losses-may-28-2020-benefits-claims-job-losses/ https://fortune.com/2020/05/28/us-unemployment-rate-numbers-... [1]: https://apnews.com/54f1efe0afa71b0a939fda91cf917366 https://apnews.com/54f1efe0afa71b0a939fda91cf917366

quinnd 6y ago
> But in a post subsequently removed from Twitter, the NYPD Sergeants Benevolent Association (SBA) accused de Blasio, 25, of “object throwing.” > The account also posted de Blasio’s internal arrest file, which included her home address (Gracie Mansion, the mayor’s residence), ID number and other personal information. [0] https://talkingpointsmemo.com/news/nypd-sergeants-union-tweets-arrest-report-for-mayor-de-blasios-daughter https://talkingpointsmemo.com/news/nypd-sergeants-union-twee... apparently the address is public knowledge anyway, if that wasn't true the doxing would be a lot worse.
Mirioron 6y ago
The government isn't a single person or even consistent entity. Different people and groups are vying for control via control of the government. Some people distrusting the current government and others supporting it is pretty much what politicians want (it's also the natural result of politics). I don't think this will change much when it comes to governing. Hopefully there will be change with how the police work in the US, but the political play is going to stay the same. Some people might just end up being switched out. Just think of it this way: almost all of the rioting/protesting is happening in blue areas. They have a Democratic mayor, police chief, state representatives etc. The police are under the control of these local officials, not federal officials. At the same time, many of protestors are angry at Trump and other Republicans on a federal level. So who do they vote for to enact change? Voting for those same Democrats in local ejections keeps the status quo, but at the same time they don't like the opposition (Republicans). They can elect a different federal president, but that isn't going to change the police issue as long as the local status quo remains. All in all, I would say that politically not much is going to change.

raverbashing 6y ago

Most often, when the media/pr announces a "sophisticated cyber attack" has happened, what actually has happened is that the password was "123456" or the site ran an old WordPress version, etc

genghisjahn 6y ago
Example?
- willcipriano 6y ago
  Weevs AT&T 'hack' (unsecured api) is the first thing that comes to mind.
- taneq 6y ago
  The Cambridge Analytica scandal comes to mind. It was reported in some places as a "hack" when they literally just used Facebook's APIs for their intended purposes.

pelasaco 6y ago

somebody with a twitter handle "Antifa Bunny #BlackLivesMatter #ACAB ️ ️" doesn't need this analysis to discover that he/she is dumb.

bargle0 6y ago

What is the point of fabricating this attack?

PavewayIV 6y ago
Sad that nobody recognized this bit of social engineering for what it probably is: another way for the feds to vacuum up IPs for anyone dumb enough to try to log in using one of them. No, they're not going to SWAT your apartment tonight if you violate federal CISA laws. It's simply another data point (of thousands or millions) on you in MAIN CORE to profile you. For what? Who knows. If you already have an 'interesting' profile, maybe they will drop by. You: "But the password didn't work - I didn't get in!" Judge: "You and your cellmate Brutus will have, oh... five years or so to discuss the finer legal points of your case... when you two are not 'otherwise' occupied. Baliff, let's not keep Brutus waiting."
lolc 6y ago
I can't decide whether this was done for the lulz or to make the police look incompetent. Maybe both?
- bargle0 6y ago
  Or to create a fake threat against the police to justify further action, maybe? Or maybe a third party actor just doing it to create confusion and a lack of trust? I think a state actor would do a better job, though.
seangrogg 6y ago
Consider whose voice, opinion, or stance stands to gain by making the police look incompetent or incapable of managing their own affairs.
- rectang 6y ago
  Or, stands to gain from making Anonymous appear more threatening.
- deleted 6y ago

tehjoker 6y ago

I get the point that's being made here, but the real question is do the passwords work even if they are derivative? Did someone extract anything of value using them?

chroem- 6y ago

Russia was caught running ads during the 2016 election that were sympathetic to radical white and black nationalist groups, with the end goal of sowing racial tensions. [0] I'm of the firm belief that we're being played by a hostile state actor here. I have no way of proving this, but I strongly suspect that Russia and/or China are trying to spur on the unrest through digital disinformation like in the OP. EDIT: by unrest I am (of course) referring to violence and looting, not peaceful protest [0] https://slate.com/technology/2018/05/russian-trolls-are-obsessed-with-black-lives-matter.html https://slate.com/technology/2018/05/russian-trolls-are-obse...

simion314 6y ago
It is also a very human thing to find someone else to blame for your faults, especially when elections are around the corner.
xenospn 6y ago
I think you're absolutely right. It's easy, too - fake a few Antifa tweets, white suburbia panics (literally happened today), pay someone to break a few windows and run away, cops hit anything that moves.
joe_the_user 6y ago
Your claim has nothing to do with this alleged hack.
boomboomsubban 6y ago
The US is by far the most likely hostile state actor. They are the ones that benefit from the protesters being seen as more radical and destructive than they are, while Russia or China would be working towards hypothetical future benefits.
- bravo22 6y ago
  The media and the government are both very clear that there are fringe elements (both far-left and far-right) infiltrating the protests and trying to derail the efforts. So everyone is going out of their way to separate protesting from looting. The only place I see where there is concentrated effort to equate protestors and rioting is on the twitter left.

tialaramex 6y ago

> it's extremely unusual to see the same email address with multiple different passwords in a legitimate data breach as most systems simply won't let an address register more than once I've actually built a system which did this years ago, over our initial protestations, and the reasoning went like this: Our client (this was a white label product) has lots of elderly couples as customers, these are our end users and although they're on the Internet (makes sense, this is after all a web site you've white labelled so if you have customers without Internet that's a red flag right there) they only have one email address between them. So some end users want two accounts, but with one email address. This made the login procedure a bit hairy and obviously there are scary corner cases for things like change password (Alice decides to use the same password as her husband Bob, now we can't tell their accounts apart!) but we felt that arguing with clients about why they should do Single Sign On (and thus eliminate the separate login for our white label product altogether) was more valuable than trying to change old people's minds about what constitutes a reasonable thing for two people to share.

fastball 6y ago
nice.old.couple+alice@gmail.com nice.old.couple+bob@gmail.com
- hobofan 6y ago
  That works for GMail but not for a lot of other email providers.
  - bildung 6y ago
    Isn't that part of the email RFCs for 2 decades or so? Postfix certainly supports this for quite a while now. Edit: sendmail and qmail, too, apparently: https://www.cs.rutgers.edu/~watrous/plus-signs-in-email-addresses.html https://www.cs.rutgers.edu/~watrous/plus-signs-in-email-addr...
    - lighthazard 6y ago
      Too bad Comcast/Xfinity and other ISPs don't really provide up-to-spec email clients or servers. Who cute.old.couple@comcast most likely uses.