5 ms·

I think this is the relevant court record: https://www.justice.gov/opa/press-release/file/1386631/download https://www.justice.gov/opa/press-release/file/138663

by mjn 5y ago

I think this is the relevant court record: https://www.justice.gov/opa/press-release/file/1386631/download https://www.justice.gov/opa/press-release/file/1386631/downl... The mechanism seems to be a search warrant. The FBI applied for a warrant to "search" all compromised Exchange servers in the United States, and to "seize" the illicit malware on those servers by executing a specified series of commands. A few excerpts from the above link: "FBI personnel now seek authorization to search the compromised Microsoft Exchange Servers and uninstall the web shells on those servers". (6th page of the PDF) "This warrant authorizes the United States to seize and copy from Microsoft Exchange Servers located in the United States the web shells identified in Attachment A, and to delete the web shells from those servers." (11th page)

deleted 5y ago
[deleted]
iudqnolq 5y ago
Here's the authorities they cite > a magistrate judge ... has authority to issue a warrant to use remote access to search electronic storage media and to seize or copy electronically stored information located within or outside that district if ... the media are protected computers that have been damaged without authorization and are located in five or more districts. > A warrant may be issued for any of the following: (1) evidence of a crime; (2) contraband, fruits of crime, or other items illegally possessed; (3) property designed for use, intended for use, or used in committing a crime; or (4) a person to be arrested or a person who is unlawfully restrained. https://www.law.cornell.edu/rules/frcrmp/rule_41 https://www.law.cornell.edu/rules/frcrmp/rule_41
- mjn 5y ago
  Interesting, I had missed that. The language allowing remote searches when computers "have been damaged without authorization and are located in five or more districts" seems to be recent, added by Congress in a 2016 amendment: https://www.justice.gov/archives/opa/blog/rule-41-changes-ensure-judge-may-consider-warrants-certain-remote-searches https://www.justice.gov/archives/opa/blog/rule-41-changes-en...
  - iudqnolq 5y ago
    Interesting. Fyi I found those quotes by looking up the citations in the application.
- cryptonector 5y ago
  Usually warrants have to be pretty specific. This one is, as to the thing that they are searching for. But it isn't, not as to the places to search. Anyways, I doubt the warrant will be challenged, so it works. It's quite the innovation. I... like it, provided they really do only uninstall the malware and close the vulnerability.
  - cldellow 5y ago
    It's very specific about the places to search. They are listed in appendix A -- every server that has a web shell installed is enumerated by the URL of the shell.
    - cryptonector 5y ago
      Ah, got it. Thanks!
  - bimboler38 5y ago
    Inb4 in a couple years we find out they did just a bit more than expected
  - jrochkind1 5y ago
    The first time they innovate like this, they'll be very careful to do it in a way that seems beyond reproach, probably only uninstall the malware and close the vuln etc. Once it gets established as a legal thing, they'll keep pushing it...
vimax 5y ago
Is this setting any new precedent for a warrant allowing removal of a file from a server, or is it already common practice when shutting down illicit servers?
- trhway 5y ago
  can they also copy anything suspicious in "plain view", like whatever is brought by a simple search on the hacked Exchange? That is one huge dragnet. Of course any good citizen wouldn't mind when a law enforcement would come take a look around after the crooks have already broken into the place. Edit: to the iudqnolq's reply below - warrant doesn't have to explicitly permit it. My understanding [IANAL] is that, at least in the physical world, whatever gets in "plain view" of the officer during any authorized law enforcement activity also becomes a fair game. I.e. they were called for the noise and upon entering see a kilo of heroin laying on the table - the heroin comes into play even though they didn't have a search warrant for it. So i'd expect that the same principle would be applicable in the virtual world too.
  - iudqnolq 5y ago
    No, the warrent does not permit that.
    - cryptonector 5y ago
      Warrants don't specifically allow for the "plain view exception", do they. Another sibling comment provided a good answer though.
  - dragonwriter 5y ago
    > can they also copy anything suspicious in "plain view", like whatever is brought by a simple search on the hacked Exchange? If it isn’t passively visible, it is not, by definition, in plain view. If they have to do a search, however simple, beyond what is explicitly authorized in the warrant, to find the information or to find whatever would give them probable cause to believe it is contraband or evidence of crime, they can neither seize it nor get a search/seizure warrant based on their observation of it under the plain view doctrine.
jrochkind1 5y ago
Yeah. I don't like the idea that law around search warrants can be used to authorize the government to do things like this. That's not what a search warrant is for. I think the judge was wrong to authorize it, but I don't count on judges to resist law enforcement requests. If this sort of thing is a good idea, there should really be legislation about it specifically.
- nojito 5y ago
  Why? Warrants are issued if there is an evidence of a crime. The existence of these shells is the evidence.

by mjn 5y ago

deleted 5y ago

[deleted]

iudqnolq 5y ago

Here's the authorities they cite > a magistrate judge ... has authority to issue a warrant to use remote access to search electronic storage media and to seize or copy electronically stored information located within or outside that district if ... the media are protected computers that have been damaged without authorization and are located in five or more districts. > A warrant may be issued for any of the following: (1) evidence of a crime; (2) contraband, fruits of crime, or other items illegally possessed; (3) property designed for use, intended for use, or used in committing a crime; or (4) a person to be arrested or a person who is unlawfully restrained. https://www.law.cornell.edu/rules/frcrmp/rule_41 https://www.law.cornell.edu/rules/frcrmp/rule_41

mjn 5y ago
Interesting, I had missed that. The language allowing remote searches when computers "have been damaged without authorization and are located in five or more districts" seems to be recent, added by Congress in a 2016 amendment: https://www.justice.gov/archives/opa/blog/rule-41-changes-ensure-judge-may-consider-warrants-certain-remote-searches https://www.justice.gov/archives/opa/blog/rule-41-changes-en...
- iudqnolq 5y ago
  Interesting. Fyi I found those quotes by looking up the citations in the application.
cryptonector 5y ago
Usually warrants have to be pretty specific. This one is, as to the thing that they are searching for. But it isn't, not as to the places to search. Anyways, I doubt the warrant will be challenged, so it works. It's quite the innovation. I... like it, provided they really do only uninstall the malware and close the vulnerability.
- cldellow 5y ago
  It's very specific about the places to search. They are listed in appendix A -- every server that has a web shell installed is enumerated by the URL of the shell.
  - cryptonector 5y ago
    Ah, got it. Thanks!
- bimboler38 5y ago
  Inb4 in a couple years we find out they did just a bit more than expected
- jrochkind1 5y ago
  The first time they innovate like this, they'll be very careful to do it in a way that seems beyond reproach, probably only uninstall the malware and close the vuln etc. Once it gets established as a legal thing, they'll keep pushing it...

vimax 5y ago

Is this setting any new precedent for a warrant allowing removal of a file from a server, or is it already common practice when shutting down illicit servers?

trhway 5y ago
can they also copy anything suspicious in "plain view", like whatever is brought by a simple search on the hacked Exchange? That is one huge dragnet. Of course any good citizen wouldn't mind when a law enforcement would come take a look around after the crooks have already broken into the place. Edit: to the iudqnolq's reply below - warrant doesn't have to explicitly permit it. My understanding [IANAL] is that, at least in the physical world, whatever gets in "plain view" of the officer during any authorized law enforcement activity also becomes a fair game. I.e. they were called for the noise and upon entering see a kilo of heroin laying on the table - the heroin comes into play even though they didn't have a search warrant for it. So i'd expect that the same principle would be applicable in the virtual world too.
- iudqnolq 5y ago
  No, the warrent does not permit that.
  - cryptonector 5y ago
    Warrants don't specifically allow for the "plain view exception", do they. Another sibling comment provided a good answer though.
- dragonwriter 5y ago
  > can they also copy anything suspicious in "plain view", like whatever is brought by a simple search on the hacked Exchange? If it isn’t passively visible, it is not, by definition, in plain view. If they have to do a search, however simple, beyond what is explicitly authorized in the warrant, to find the information or to find whatever would give them probable cause to believe it is contraband or evidence of crime, they can neither seize it nor get a search/seizure warrant based on their observation of it under the plain view doctrine.

jrochkind1 5y ago

Yeah. I don't like the idea that law around search warrants can be used to authorize the government to do things like this. That's not what a search warrant is for. I think the judge was wrong to authorize it, but I don't count on judges to resist law enforcement requests. If this sort of thing is a good idea, there should really be legislation about it specifically.

nojito 5y ago
Why? Warrants are issued if there is an evidence of a crime. The existence of these shells is the evidence.