7 ms·

FBI Accesses Computers Around Country to Delete Microsoft Exchange Hacks

55 points by 1cvmask 6y ago

cyberlab 6y ago
> By deleting the web shells, FBI personnel will prevent malicious cyber actors from using the web shells to access the servers and install additional malware on them If the FBi is in your computer you have already lost. Your box is as good as dead and you might aswell do a full factory reset or it that's too bothersome, buy a new box. Sometimes buying a whole new box is cheaper than cleaning up malware using specialist tools.
- imwillofficial 6y ago
  This is very poor advice. “If the FBI is in your box you’re already dead.” No, in this case, they are fixing a hack. I don’t want them touching my stuff, but that’s hardly “dead”. “Cheaper to buy a new box” Reinstalling and reconfiguring is always cheaper than buying new and reconfiguring. This reasoning is very poor, why did you feel the need to make this comment?
  - high_byte 6y ago
    lol "rm shell.js or if that's too bothersome buy a new machine"
  - bena 6y ago
    I don't think he means that because it's the FBI. I think he means that since the FBI is using the vulnerability itself to patch affected systems that you've already been compromised if the FBI is able to do this to your system.
    - imwillofficial 6y ago
      But buy a new machine?
      - bena 6y ago
        It's a sticky wicket. A compromised machine is just that, compromised. Someone recently posted a story about an exploit wherein the compiler itself was compromised to compromise a particular set of programs when compiling those programs. Including the compiler itself. So closing this particular door does not mean that they didn't use their access to establish other doors. Or self-opening doors. Or any number of things. And you have no clue as to how far down it goes. This exploit could have compromised the boot loader or something. The only way to be completely sure is to essentially strip the machine to bare metal and audit every piece of software on it. The safest thing to do, if you want to be completely sure, is to buy a new machine. And even then, you're trusting that the machine you bought hasn't been compromised by the manufacturer or something like that. But it's a known-ish quantity. But that's a "nuke it from orbit" kind of option. Often, being completely sure isn't necessary. We can live with reasonably sure.
- slowhand09 6y ago
  ...setting up YC company to purchase FBI-"tuned" computers for cheap.
- daniel-cussen 6y ago
  They're using the vulnerability in question to go in and eliminate that vulnerability, locking themselves out. It's like a cop seeing a wide open front door, and going into the threshold in order to reach the door handle so he can pull it closed. Did he go into the house? Yes. Because it was open, and only in order to close it.
  - CountDrewku 6y ago
    Except you have no idea what else they're doing in there before they so nicely "close the door". Besides, your metaphor doesn't work since cops aren't allowed to just enter a premise due to it being unlocked or open. That doesn't fall under any of the reasons to enter a premise without warrant. Leaving a door unlocked or open is not a crime that gives them free pass. I really have a hard time understanding people's logic on here sometimes. Apparently the entire US government is systemically racist and evil but these same people want to give more power to this government? Which is it?
    - daniel-cussen 6y ago
      Really? They can't set one foot inside in order to reach the doorhandle if the door is 90 degrees open? And what America are we talking about, "your rights according to the ACLU" America, media portrayals of America, or in-real-life common sense America where you can have a ten minute conversation with a policeman about everyday things with no worries because it's actually no big deal?
      - CountDrewku 6y ago
        Yes really and this isn't just simply "door closing". https://www.law.cornell.edu/constitution/fourth_amendment https://www.law.cornell.edu/constitution/fourth_amendment
        daniel-cussen 6y ago
        I guess. Reminds me of the time in Santiago de Chile we were fixing up a place and the door was ajar. A group of Jehova's Witnesses came in without knocking, holding their pamphlet in front of them in a noticeably odd way, in case they found anybody inside they'd be all about the pamphlet. I guess they thought it was their warrant.
kevinwang 6y ago
Hah, so they're using the remote backdoor to delete the remote backdoor?
- TheCraiggers 6y ago
  That's pretty commonplace to clean up worms and the like. Once security professionals decompile the code enough to figure out where the control mechanism is and how it works, they will take control of it and use its own methods to get rid of it.
- asimpletune 6y ago
  It's sort of the same logic given why we shouldn't require backdoors in general in devices: if the good guy can use it, so can the bad guy. Just, in this case it's being done in reverse.
CivBase 6y ago
This is probably a net positive for national security... but I still don't like it. I don't want the FBI doing anything to my computer without my permission.
- hpoe 6y ago
  What are you suggesting that by setting this precedent the US Government would use it to illegally and unconstitutionally harm people who are politically unpopular. I do not think this would happen the US government is good the US government is right they protect you and keep you safe from evil terrorists who would try to hurt you. Please do not think about this too much, please go consume your next television show and remember to support any unpatriotic activity to your local authorities.
  - shillforhumanty 6y ago
    Why come you don't have a tatoo?
  - CountDrewku 6y ago
    Let me tell you about the patriot act.... these things are always done under the guise of safety when in reality it just ends up giving them more power that eventually gets used in malicious ways and restricts our freedom more and more.
hpoe 6y ago
Sweet, since we now have the precedence that the FBI can invade your machine without permission whenever they want for national security reasons I can't wait the glorious future we have before us. Now the FBI can access your machine and start modifying things because you are expressing displeasure at your public officials which is a sign of "terrorist behavior", oops you're using your blog to say things the government doesn't like they'll go ahead and delete that for you for national security. Oh you installed or even googled Tor well that is only used by drug dealers and terrorists so clearly you are a threat to national security they'll be cutting you off from internet access now.
- the-dude 6y ago
  Look, in The Netherlands, the largest grocery chain ( AH, Albert Heijn, Ahold ) has empty cheese shelves because their cheese-logistics-company got hacked through this vulnerability. The Dutch, without cheese. Do you see the severity of the problem now? Jeez.
  - HenryBemis 6y ago
    Oh every time I fly to/from/through the Netherlands I always shop this 'net' with 4-5-6 different cheese(s). Pretty pricey at the airport, but definitely worth enjoying for the following weeks!
  - sjaak 6y ago
    Every Dutchman worth his salt has his own cow and makes his own bespoke cheese. While wearing wooden shoes no less. Don't you worry about us, there is not and will never be a cheese shortage!
  - effingwewt 6y ago
    I've seen the 'think of the kids' excuse ad nauseum, but I've never seen 'think of the cheese!' True to Poe's law, I honestly cannot tell if this was in jest or serious.
- high_byte 6y ago
  do you have an alternative? would you feel better if it wasn't FBI? or if these remained unfixed?
adaml_623 6y ago
Was there a private individual a few years ago who was doing a similar thing? Cleaning up backdoored servers?
- sen 6y ago
  This one? https://www.zdnet.com/article/a-mysterious-grey-hat-is-patching-peoples-outdated-mikrotik-routers/ https://www.zdnet.com/article/a-mysterious-grey-hat-is-patch...
- afturkrull 6y ago
  > Was there a private individual a few years ago who was doing a similar thing? Cleaning up backdoored servers? Do you mean Max Butler, who was given jail-time after deciding to not be an undercover FBI informant FBI anymore? https://www.securityfocus.com/news/203 https://www.securityfocus.com/news/203
  - antihero 6y ago
    What a strange coincidence, he is supposed to get out literally today! https://en.wikipedia.org/wiki/Max_Butler https://en.wikipedia.org/wiki/Max_Butler > Butler is currently incarcerated at FCI Victorville Medium 2 in California, he expected to be released April 14, 2021. Though it sounds like the sort of things he did involved a lot of carding and other kinda severely shitty behaviour.
  - lupire 6y ago
    After hacking into people's computers and installing backdoors for himself.
clarge1120 6y ago
The Justice Department had to get court approval to access private servers and remove malicious software. But, why does the FBI have to do this? Why does a federal agency have to remove a software virus from private servers? There are private companies that can do this.
- snypher 6y ago
  ? A private company can't obtain a warrant for access to my hardware.
  - luma 6y ago
    Technically... they can. It's the same authority which has allowed organizations like Microsoft to take over botnet C&C systems. The CFAA has specific carveouts to allow unauthorized access with a court order.
  - caspper69 6y ago
    This is actually the new frontier in the relationship between corporations and the government. The government now allows, within certain parameters, private enforcement of public policy, if one can show damage, and the government lacks the will (or resources) for enforcement. The theory goes, that guy is breaking the law, and it's hurting my business, but since it's low priority for the government, I'm going to start a private enforcement action. Both very ingenuous and scary at the same time.
afturkrull 6y ago
"The FBI obtained court approval to access vulnerable computers across the United States." So, have you got it yet. In the interests of state security, security on your computer has been so diluted that anyone and his dog can get access to your so-called confidential records.
- HenryBemis 6y ago
  But, did you really believe that sitting behind an ISP, behind a 'basic' firewall (router), running Windows OS, with its firewall, and you would be safe if the FBIs/CIAs/NSAs of this world (USA, UK, China, etc.) want to take you down.. you stand a chance? I assume that a more extreme step would be to notify the ISPs that serve specific IPs to cut them off. But that would break a lot of other things.
1970-01-01 6y ago
Smart moves by the FBI: The search order is set-up by a redacted URL, so we can't confirm if the servers are actually in USA. Maybe a few of these are a little bit out of FBI jurisdiction. Nobody will be allowed to check their work. The court order begins the path of setting a legal precedent for the next time a system is determined to need "FBI patching."
showerst 6y ago
One clever side effect I haven't seen mentioned here -- No matter how little these particular companies care about IT security, or infrastructure in general, a letter to the legal department from the FBI ought to provide a kick in the pants.
christiansakai 6y ago
Noob here. Does this imply the FBI can just remote control any PC in the US? How does that work (apart from having the client running on your computer of course)
- lupire 6y ago
  No, only computers that are configured to give remote access to the public.
caymanjim 6y ago
This is a terrible precedent and never should have been rubber-stamped by the court. I hope this attracts enough attention to bubble up to the Supreme Court and the FBI gets slapped. The correct action, if any, would have been to get a court order allowing the offending sites to be disconnected from the Internet.
ChrisArchitect 6y ago
[dupe] lots of discussion over here: https://news.ycombinator.com/item?id=26800481 https://news.ycombinator.com/item?id=26800481

55 points by 1cvmask 6y ago

> By deleting the web shells, FBI personnel will prevent malicious cyber actors from using the web shells to access the servers and install additional malware on them If the FBi is in your computer you have already lost. Your box is as good as dead and you might aswell do a full factory reset or it that's too bothersome, buy a new box. Sometimes buying a whole new box is cheaper than cleaning up malware using specialist tools.

imwillofficial 6y ago
This is very poor advice. “If the FBI is in your box you’re already dead.” No, in this case, they are fixing a hack. I don’t want them touching my stuff, but that’s hardly “dead”. “Cheaper to buy a new box” Reinstalling and reconfiguring is always cheaper than buying new and reconfiguring. This reasoning is very poor, why did you feel the need to make this comment?
- high_byte 6y ago
  lol "rm shell.js or if that's too bothersome buy a new machine"
- bena 6y ago
  I don't think he means that because it's the FBI. I think he means that since the FBI is using the vulnerability itself to patch affected systems that you've already been compromised if the FBI is able to do this to your system.
  - imwillofficial 6y ago
    But buy a new machine?
    - bena 6y ago
      It's a sticky wicket. A compromised machine is just that, compromised. Someone recently posted a story about an exploit wherein the compiler itself was compromised to compromise a particular set of programs when compiling those programs. Including the compiler itself. So closing this particular door does not mean that they didn't use their access to establish other doors. Or self-opening doors. Or any number of things. And you have no clue as to how far down it goes. This exploit could have compromised the boot loader or something. The only way to be completely sure is to essentially strip the machine to bare metal and audit every piece of software on it. The safest thing to do, if you want to be completely sure, is to buy a new machine. And even then, you're trusting that the machine you bought hasn't been compromised by the manufacturer or something like that. But it's a known-ish quantity. But that's a "nuke it from orbit" kind of option. Often, being completely sure isn't necessary. We can live with reasonably sure.
slowhand09 6y ago
...setting up YC company to purchase FBI-"tuned" computers for cheap.
daniel-cussen 6y ago
They're using the vulnerability in question to go in and eliminate that vulnerability, locking themselves out. It's like a cop seeing a wide open front door, and going into the threshold in order to reach the door handle so he can pull it closed. Did he go into the house? Yes. Because it was open, and only in order to close it.
- CountDrewku 6y ago
  Except you have no idea what else they're doing in there before they so nicely "close the door". Besides, your metaphor doesn't work since cops aren't allowed to just enter a premise due to it being unlocked or open. That doesn't fall under any of the reasons to enter a premise without warrant. Leaving a door unlocked or open is not a crime that gives them free pass. I really have a hard time understanding people's logic on here sometimes. Apparently the entire US government is systemically racist and evil but these same people want to give more power to this government? Which is it?
  - daniel-cussen 6y ago
    Really? They can't set one foot inside in order to reach the doorhandle if the door is 90 degrees open? And what America are we talking about, "your rights according to the ACLU" America, media portrayals of America, or in-real-life common sense America where you can have a ten minute conversation with a policeman about everyday things with no worries because it's actually no big deal?
    - CountDrewku 6y ago
      Yes really and this isn't just simply "door closing". https://www.law.cornell.edu/constitution/fourth_amendment https://www.law.cornell.edu/constitution/fourth_amendment
      - daniel-cussen 6y ago
        I guess. Reminds me of the time in Santiago de Chile we were fixing up a place and the door was ajar. A group of Jehova's Witnesses came in without knocking, holding their pamphlet in front of them in a noticeably odd way, in case they found anybody inside they'd be all about the pamphlet. I guess they thought it was their warrant.

kevinwang 6y ago

Hah, so they're using the remote backdoor to delete the remote backdoor?

TheCraiggers 6y ago
That's pretty commonplace to clean up worms and the like. Once security professionals decompile the code enough to figure out where the control mechanism is and how it works, they will take control of it and use its own methods to get rid of it.
asimpletune 6y ago
It's sort of the same logic given why we shouldn't require backdoors in general in devices: if the good guy can use it, so can the bad guy. Just, in this case it's being done in reverse.

CivBase 6y ago

This is probably a net positive for national security... but I still don't like it. I don't want the FBI doing anything to my computer without my permission.

hpoe 6y ago
What are you suggesting that by setting this precedent the US Government would use it to illegally and unconstitutionally harm people who are politically unpopular. I do not think this would happen the US government is good the US government is right they protect you and keep you safe from evil terrorists who would try to hurt you. Please do not think about this too much, please go consume your next television show and remember to support any unpatriotic activity to your local authorities.
- shillforhumanty 6y ago
  Why come you don't have a tatoo?
- CountDrewku 6y ago
  Let me tell you about the patriot act.... these things are always done under the guise of safety when in reality it just ends up giving them more power that eventually gets used in malicious ways and restricts our freedom more and more.

hpoe 6y ago

Sweet, since we now have the precedence that the FBI can invade your machine without permission whenever they want for national security reasons I can't wait the glorious future we have before us. Now the FBI can access your machine and start modifying things because you are expressing displeasure at your public officials which is a sign of "terrorist behavior", oops you're using your blog to say things the government doesn't like they'll go ahead and delete that for you for national security. Oh you installed or even googled Tor well that is only used by drug dealers and terrorists so clearly you are a threat to national security they'll be cutting you off from internet access now.

the-dude 6y ago
Look, in The Netherlands, the largest grocery chain ( AH, Albert Heijn, Ahold ) has empty cheese shelves because their cheese-logistics-company got hacked through this vulnerability. The Dutch, without cheese. Do you see the severity of the problem now? Jeez.
- HenryBemis 6y ago
  Oh every time I fly to/from/through the Netherlands I always shop this 'net' with 4-5-6 different cheese(s). Pretty pricey at the airport, but definitely worth enjoying for the following weeks!
- sjaak 6y ago
  Every Dutchman worth his salt has his own cow and makes his own bespoke cheese. While wearing wooden shoes no less. Don't you worry about us, there is not and will never be a cheese shortage!
- effingwewt 6y ago
  I've seen the 'think of the kids' excuse ad nauseum, but I've never seen 'think of the cheese!' True to Poe's law, I honestly cannot tell if this was in jest or serious.
high_byte 6y ago
do you have an alternative? would you feel better if it wasn't FBI? or if these remained unfixed?

adaml_623 6y ago

Was there a private individual a few years ago who was doing a similar thing? Cleaning up backdoored servers?

sen 6y ago
This one? https://www.zdnet.com/article/a-mysterious-grey-hat-is-patching-peoples-outdated-mikrotik-routers/ https://www.zdnet.com/article/a-mysterious-grey-hat-is-patch...
afturkrull 6y ago
> Was there a private individual a few years ago who was doing a similar thing? Cleaning up backdoored servers? Do you mean Max Butler, who was given jail-time after deciding to not be an undercover FBI informant FBI anymore? https://www.securityfocus.com/news/203 https://www.securityfocus.com/news/203
- antihero 6y ago
  What a strange coincidence, he is supposed to get out literally today! https://en.wikipedia.org/wiki/Max_Butler https://en.wikipedia.org/wiki/Max_Butler > Butler is currently incarcerated at FCI Victorville Medium 2 in California, he expected to be released April 14, 2021. Though it sounds like the sort of things he did involved a lot of carding and other kinda severely shitty behaviour.
- lupire 6y ago
  After hacking into people's computers and installing backdoors for himself.

clarge1120 6y ago

The Justice Department had to get court approval to access private servers and remove malicious software. But, why does the FBI have to do this? Why does a federal agency have to remove a software virus from private servers? There are private companies that can do this.

snypher 6y ago
? A private company can't obtain a warrant for access to my hardware.
- luma 6y ago
  Technically... they can. It's the same authority which has allowed organizations like Microsoft to take over botnet C&C systems. The CFAA has specific carveouts to allow unauthorized access with a court order.
- caspper69 6y ago
  This is actually the new frontier in the relationship between corporations and the government. The government now allows, within certain parameters, private enforcement of public policy, if one can show damage, and the government lacks the will (or resources) for enforcement. The theory goes, that guy is breaking the law, and it's hurting my business, but since it's low priority for the government, I'm going to start a private enforcement action. Both very ingenuous and scary at the same time.

afturkrull 6y ago

"The FBI obtained court approval to access vulnerable computers across the United States." So, have you got it yet. In the interests of state security, security on your computer has been so diluted that anyone and his dog can get access to your so-called confidential records.

HenryBemis 6y ago
But, did you really believe that sitting behind an ISP, behind a 'basic' firewall (router), running Windows OS, with its firewall, and you would be safe if the FBIs/CIAs/NSAs of this world (USA, UK, China, etc.) want to take you down.. you stand a chance? I assume that a more extreme step would be to notify the ISPs that serve specific IPs to cut them off. But that would break a lot of other things.

1970-01-01 6y ago

Smart moves by the FBI: The search order is set-up by a redacted URL, so we can't confirm if the servers are actually in USA. Maybe a few of these are a little bit out of FBI jurisdiction. Nobody will be allowed to check their work. The court order begins the path of setting a legal precedent for the next time a system is determined to need "FBI patching."

showerst 6y ago

One clever side effect I haven't seen mentioned here -- No matter how little these particular companies care about IT security, or infrastructure in general, a letter to the legal department from the FBI ought to provide a kick in the pants.

christiansakai 6y ago

Noob here. Does this imply the FBI can just remote control any PC in the US? How does that work (apart from having the client running on your computer of course)

lupire 6y ago
No, only computers that are configured to give remote access to the public.

caymanjim 6y ago

This is a terrible precedent and never should have been rubber-stamped by the court. I hope this attracts enough attention to bubble up to the Supreme Court and the FBI gets slapped. The correct action, if any, would have been to get a court order allowing the offending sites to be disconnected from the Internet.

ChrisArchitect 6y ago

[dupe] lots of discussion over here: https://news.ycombinator.com/item?id=26800481 https://news.ycombinator.com/item?id=26800481