6 ms·
If I'm understanding this correctly, the DOJ authorized the FBI to exploit the exploit to remove the exploit from exploited servers? This proactivity is somethi
by pizza 6y ago
If I'm understanding this correctly, the DOJ authorized the FBI to exploit the exploit to remove the exploit from exploited servers? This proactivity is something I remember hearing recently that the NSA wished they could have
- tiahura 6y agoNot quite. A federal judge authorized the FBI to act. Not my area of practice, but seems odd - maybe akin to an ex parte tro?
- mrstubbs 6y agoThe statement says they were authorized to send commands to vulnerable servers through the exploited services/webshells which removed said webshells from the system.
- paxys 6y agoMore like – FBI wanted to patch affected servers remotely without getting every owner's consent but weren't sure of legality so they asked a judge to sign off on it.
- elliekelly 6y agoWhoa. Has this ever been done before?
- vmception 6y agoAsking a judge for a really broad constructive warrant and pretending that the founding fathers anticipated this use case in their aggregate infinite wisdom is very common
- tony101 6y agoThe warrant is actually quite specific, down to the exact URL paths of the shells to be searched and removed. See pages 20 and 21 of https://www.justice.gov/opa/press-release/file/1386631/download https://www.justice.gov/opa/press-release/file/1386631/downl...
- atat7024 6y agoHow many IPs are they allowed to break into to find the webserver behind those domains?
- not2b 6y agoIt's bizarre to think that we should be bound forever more to only do the things that people in 1789 thought appropriate. But it seems to me that they followed the procedure outlined in the 4th amendment; they went to court and got a specific warrant to remove a specific bit of malware from a specified set of servers. Madison deliberately left many provisions in the Constitution and Bill of Rights open-ended because he wasn't an idiot and knew that the founders could not anticipate everything. Had the FBI acted on its own it would be overreach. They went to court, got a warrant, and did pretty much the minimum required to eliminate the threat.
- jamiek88 6y agoGood job those aristocrats from 1790's were omnipotent then.
- IHLayman 6y agoActually, according to the brief they actually didn’t patch the servers, but only removed the web shell: “This operation was successful in copying and removing those web shells. However, it did not patch any Microsoft Exchange Server zero-day vulnerabilities or search for or remove any additional malware or hacking tools that hacking groups may have placed on victim networks by exploiting the web shells.”
- mjn 6y agoI think this is the relevant court record: https://www.justice.gov/opa/press-release/file/1386631/download https://www.justice.gov/opa/press-release/file/1386631/downl... The mechanism seems to be a search warrant. The FBI applied for a warrant to "search" all compromised Exchange servers in the United States, and to "seize" the illicit malware on those servers by executing a specified series of commands. A few excerpts from the above link: "FBI personnel now seek authorization to search the compromised Microsoft Exchange Servers and uninstall the web shells on those servers". (6th page of the PDF) "This warrant authorizes the United States to seize and copy from Microsoft Exchange Servers located in the United States the web shells identified in Attachment A, and to delete the web shells from those servers." (11th page)
- deleted 6y ago[deleted]
- iudqnolq 6y agoHere's the authorities they cite > a magistrate judge ... has authority to issue a warrant to use remote access to search electronic storage media and to seize or copy electronically stored information located within or outside that district if ... the media are protected computers that have been damaged without authorization and are located in five or more districts. > A warrant may be issued for any of the following: (1) evidence of a crime; (2) contraband, fruits of crime, or other items illegally possessed; (3) property designed for use, intended for use, or used in committing a crime; or (4) a person to be arrested or a person who is unlawfully restrained. https://www.law.cornell.edu/rules/frcrmp/rule_41 https://www.law.cornell.edu/rules/frcrmp/rule_41
- mjn 6y agoInteresting, I had missed that. The language allowing remote searches when computers "have been damaged without authorization and are located in five or more districts" seems to be recent, added by Congress in a 2016 amendment: https://www.justice.gov/archives/opa/blog/rule-41-changes-ensure-judge-may-consider-warrants-certain-remote-searches https://www.justice.gov/archives/opa/blog/rule-41-changes-en...
- alfiedotwtf 6y agoWhat if servers that got “fixed” weren’t American? Would that mean the FBI went outside its jurisdiction and could be seen as an illegal act across international borders?
- brown9-2 6y agoWhat harm could the owner claim and who would prosecute that? I think an act of shutting down exploited servers is being overthought here.
- yjftsjthsd-h 6y agoWell the most obvious thought is if it doesn't go perfectly - server is compromised but works, feds patch it, patch breaks it in some unforseen way.
- Geezus_42 6y agoA previous comment quoted officials stating that no patch was applied. They only removed the specific malware in the warrant and left the servers as they were. Which means they could simply be exploited again.
- salawat 6y agoA Government overstep is never a topic where overthinking is a hazard. This type of thing sets precedents that case law keeps alive into perpetuity.
- 7952 6y agoWhat troubles me is such broad use of a warrant. Is this really search and seizure?
- nojito 6y agoNo chance of this happening because the IPs are required to be disclosed before getting the sign off to do it.
- OGWhales 6y agoThat was a fun way to phrase that.