5 ms·
Interesting. They're violating their own CFAA law (accessing a computer without authorization or exceeding the access granted) to remove web shells. Legally, th
by mmaunder 6y ago
Interesting. They're violating their own CFAA law (accessing a computer without authorization or exceeding the access granted) to remove web shells. Legally, this is hacking. Which means that the FBI just hacked a bunch of Exchange servers to clean them.
So the message here is, if you don't clean up your act and you're on a USA network, we'll do it for you without your permission.
The beef is at the end of the article:
This operation was successful in copying and removing those web shells. However, it did not patch any Microsoft Exchange Server zero-day vulnerabilities or search for or remove any additional malware or hacking tools that hacking groups may have placed on victim networks by exploiting the web shells. The Department strongly encourages network defenders to review Microsoft’s remediation guidance and the March 10 Joint Advisory for further guidance on detection and patching.
The FBI is attempting to provide notice of the court-authorized operation to all owners or operators of the computers from which it removed the hacking group’s web shells. For those victims with publicly available contact information, the FBI will send an e-mail message from an official FBI e-mail account (@FBI.gov) notifying the victim of the search. For those victims whose contact information is not publicly available, the FBI will send an e-mail message from the same FBI e-mail account to providers (such as a victim’s ISP) who are believed to have that contact information and ask them to provide notice to the victim.
If you believe you have a compromised computer running Microsoft Exchange Server, please contact your local FBI Field Office for assistance. The FBI continues to conduct a thorough and methodical investigation into this cyber incident.
- chris_wot 6y agoAre we sure? It appears the court gave them authority.
- tony101 6y agoIndeed, there is a search warrant signed by a judge: https://www.justice.gov/opa/press-release/file/1386631/download https://www.justice.gov/opa/press-release/file/1386631/downl... See pages 18 to 21.
- andrewmg 6y agoIt's no CFAA violation: "This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an intelligence agency of the United States." 18 U.S.C. § 1030(f). DOJ obtained authorization here, most likely under Fed. R. Crim. P. 41(b)(6)(B)--which, interestingly enough, cross-references the CFAA.
- mmaunder 6y agoOf course not. I'm using CFAA as a moral definition of hacking, not legal. I'd be amazed if this doesn't lead to warrants issued that enable search & seizure on domestic individuals and corporations. Edit: After re-reading my post above, I guess I did suggest they violated the CFAA in law. Not my intent to say that. I'll leave it as is.
- deleted 6y ago[deleted]
- spoonjim 6y agoLaws aren’t great references for morality.
- eru 6y agoYes, and no. By default, we expect moral people to conform to the laws of their jurisdiction. Not because the laws are necessarily morally positive; most laws are morally kind of neutral, but because the predictability itself is a good virtue. Of course, that default presumption can be overcome with a relatively low burden of proof.
- alfiedotwtf 6y ago> most laws are morally kind of neutral Slavery was once legal, and this kind of thinking is what made people want to continue it
- walrus01 6y ago> So the message here is, if you don't clean up your act and you're on a USA network, we'll do it for you without your permission. I am not sure on any prior case law on this, but there's examples in the real world if you leave a dangerous attractive nuisance out in the public space, where it could potentially be harmful to people or animals. Local law enforcement or civic-minded citizens will remove it. It could be argued that leaving exposed outlook web access rooted systems out there for anyone to use on the public internet is not too dissimilar. On a federal level? If you leave an abandoned ship leaking toxic chemicals anchored somewhere in a bay, don't be surprised if the USCG, a federal law enforcement agency, comes and seizes it...
- duxup 6y ago> court-authorized There you go. Microsoft and the DOJ have several times gone to a judge to get permission to take over botnets. The reason being that to do so they take over the botnet and the result is of course that if they control the botnet they then have control of those computers. But you can't completely disassemble some botnets without taking it over.