5 ms·

The newly released affidavit was offered in support of a search warrant for the home of an Arlington, Texas couple and their son, who were among the July 19 tar

by tshtf 15y ago

The newly released affidavit was offered in support of a search warrant for the home of an Arlington, Texas couple and their son, who were among the July 19 targets, and have not been charged. The house was the source of 3,678 packets in about two-and-a-half hours starting December 8. So they're going to arrest a kid for sending an average on one packet every two seconds, over the period of two-and-a-half hours?

andreyf 15y ago
They probably won't arrest him. I'm a bit surprised that this was enough to even get a search warrant...
- melvinng 15y ago
  Considering that most DDOS attacks come from zombie bots installed on programs when people Torrent, I'm suprised that there were arrest made based on IPs
  - geekam 15y ago
    I know. I was thinking the same thing. How does an IP address translate to a human being?
    - fleitz 15y ago
      The issue is not how to translate it but whether an IP address identifies a person beyond reasonable doubt, especially given Anonymous's ability to defeat FBI/CIA and other military grade networks including those the FBI/CIA employ to protect them. It really raises question as to whether you can trust something as flimsy as an IP header given the technical sophistication of Anonymous. These people could well be innocent and in fact victims of anonymous directing attention away from itself and towards these innocent victims. When Anonymous can gain control of HB Gary and FBI/CIA assets imagine what they could do to an off the shelf system that hasn't been through the rigorous security protocols that HB Gary, the FBI and CIA follow. Given the mutability of data on a USB stick I'd also be very interested to see the chain of custody on that data and how it might have been modified. Also, the defense should request access to the source code for the IDS system in question so that it can be examined for bugs and problems that may affect its ability to generate reliable evidence.
      - GHFigs 15y ago
        These people could well be innocent and in fact victims of anonymous directing attention away from itself and towards these innocent victims. This is wishful thinking, but there is a sense in which it is true. People running LOIC are typically if not exclusively clueless mooks duped into doing so by people who know better. For all the mythos around Anonymous "having no leaders", I doubt very strongly that you'll find many examples of people who spontaneously downloaded LOIC and started flinging packets at PayPal. Instead what you'll find is people who say they got the idea from an image posted on 4chan (or elsewhere) or from "some guy" on IRC. All you have to do is convince someone to willingly join a botnet (or anything else) is that 1) this is a way to relieve their angst and 2) other people are doing it. The affidavit even includes examples of the kind of image instructions that accomplish exactly this. The "orders" spread as would memes, and the originators of those orders put themselves at almost no risk to distribute them, while "innocent" members of the herd get caught.
      - robtoo 15y ago
        When Anonymous can gain control of HB Gary and FBI/CIA assets Indeed: "When..." But AFAICR, Anonymous didn't gain control of either FBI or CIA assets. Hacking a self-described FBI "affiliate" and DDOSing cia.gov are hardly the same thing. Also, holding up HB Gary Federal as an example of an organisation with "rigorous security protocols" is an amusing claim with no real evidence.
  - wmf 15y ago
    Did you read the article? Paypal provided evidence that the DDoS was coming from LOIC, a manually-operated non-botnet tool. Also, it sounds like Paypal's evidence was only used to get search warrants, and evidence found in those searches (like LIOC) would then be used to justify arrests.
    - astrec 15y ago
      Not necessarily manually-operated. See also: LOIC Hivemind.
- InclinedPlane 15y ago
  Maybe, I'm not so sure though. If you participate in a mob that went down to some local business to throw rocks through their window, should you expect to be let off easy because you just threw a pebble? On balance I think the idea that DDoS is "ok" and should be tolerated is not a good road to travel down.
  - burgerbrain 15y ago
    The equivalent of a DDoS is a sit in, not stoning people in the streets. Do they serve search warrants for people who participate in those?
    - InclinedPlane 15y ago
      Sit ins are not legal either, you can be arrested for trespassing on someone's property if you've been told to leave. The purpose of a sit in is to draw attention to an issue through non-violent means, and it's accepted that there may be consequences to that (including jail time) but the cause justifies the risk. Regardless, it's questionable whether a DDoS and a sit-in are comparable. For one, DDoS does not require the presence of the individual, this makes it more difficult to form a connection with their cause and the activity. For another, a sit-in doesn't typically totally shut down a business, let alone at a national scale. With a DDoS a very tiny minority of people are able to disrupt the business activities of millions. This is not the sort of thing that we want to become accepted a legitimate form of protest. You may think it's all well and good when people who are "fighting" for causes you believe in are "sticking it to the man" but if it becomes the norm then everyone with a grudge will use it. And then it won't be the "good guys" wielding the power it'll be the people most fanatical in its use who will get what they want. If you want to find a form of protest that mimics a sit-in, fine, go ahead, by find something other than DDoS, because that isn't it.
      - burgerbrain 15y ago
        Reading compression. I am not suggesting that sit ins are legal. I am asking if participating in one is enough for the police to get a warrant to thrash your house. Furthermore, sit ins are by definition denial of service attacks. Assertions about differences of scale are 1) irrelevant, 2) questionable (most DDoS fail miserably). This has nothing at all to do with my approval or disapproval of the politics.
maqr 15y ago
If you assume an MTU of 1500 bytes, then this kid sent about 5.25MB worth of data.
- jrockway 15y ago
  But he didn't buy anything! This is like walking into a book store, looking around at books, reading a bit, and leaving the store without making a purchase. Clearly a federal crime.
  - umright 15y ago
    Yeah but he looked at over 9000 books and therefore committed the crime. Of course, the only crime he is guilty of is being young and inept. They're going after these people to make an example of them, not because they did anything actually harmful.
  - Joakal 15y ago
    Analogy time: One person taking a book means others can not see the same book. Acceptable DoS because the owner thinks you may purchase it. One person taking several books means others can not see the same books. Questionable DoS because the owner thinks you're screwing around. Many people doing taking several books out in the store leaves the owner to suspect a DDoS attack because there's not usually that many people and none seem to want to buy. It's especially malicious if there's intent. Ugly thing about DDoS is that since there's unexceptionally large amount of people and no books to check out, loyal and new customers will be put off and may not return causing future loss.
  - benhalllondon 15y ago
    I think a better analogy would be one where everyone was standing in the doorway and not letting anyone else use the store. Probably a crime, but a pretty minor one.
quandrum 15y ago
Is that even the rate of putting something on the F5 key on the webpage and letting the browser refresh?
VladRussian 15y ago
the point isn't the amount, the point is participation. Such a low intensive, no damage, DoS is akin to a peaceful protest in front of the company store, only virtual. Any real protest in front of a real store is in turn also kind of DoS - thinking about that i wonder whether real protests can be more successfully prosecuted on such a grounds, especially that stretching DoS to an "act of domestic terrorism" is very acceptable today.
tzs 15y ago
> So they're going to arrest a kid for sending an average on one packet every two seconds, over the period of two-and-a-half hours? As a general principle, if it is illegal for one person to perpetrate an act against a victim, I don't see how it should not be illegal for a large group of people to perpetrate the same act, even though the individual contribution of each member of the large group might be small enough that if he were alone it would not rise to the level of a crime. To do it any other way would open up a hell of a big loophole, it seems to me.
- redthrowaway 15y ago
  It's an interesting question, though. If 1000 people tell one person that they don't like them, and the person commits suicide, then it's reasonable to claim that the group drove them to do it. However, do you prosecute an individual who merely tells someone, "I don't like you?" On an individual basis, it's a weak case. I'm not sure how the law deals with this, or even if there exists any legal principles dealing with how to prosecute actions that are, by themselves, harmless and not illegal (running LOIC may signal an intent to block access, but in the same way that gunning a Pinto on the highway may signal an intent to speed, you're unlikely to be able to break the law).
  - kiiski 15y ago
    If the 1000 people did it in coordinated manner with the intent of causing harm to the one person then it would seem like a crime to me. Of course, it's the leaders who should get the severe punishments, but you still have to punish the others too (to a lesser extent). Otherwise you're just saying that it's acceptable to help people commit a crime. And why are people complaining about the FBI going after people anyway? It's their job to catch (probable) criminals, so they can't really start deciding which ones to pursue. It's the judges and jurys (and lawmakers) who make that decision.
mister_jasckson 15y ago
Yes. And ruin his life. How to launch a worse attack than these people did: 1) Browse to website. 2) Place heavy object on F5 key. Seriously.

by tshtf 15y ago

andreyf 15y ago

They probably won't arrest him. I'm a bit surprised that this was enough to even get a search warrant...

melvinng 15y ago
Considering that most DDOS attacks come from zombie bots installed on programs when people Torrent, I'm suprised that there were arrest made based on IPs
- geekam 15y ago
  I know. I was thinking the same thing. How does an IP address translate to a human being?
  - fleitz 15y ago
    The issue is not how to translate it but whether an IP address identifies a person beyond reasonable doubt, especially given Anonymous's ability to defeat FBI/CIA and other military grade networks including those the FBI/CIA employ to protect them. It really raises question as to whether you can trust something as flimsy as an IP header given the technical sophistication of Anonymous. These people could well be innocent and in fact victims of anonymous directing attention away from itself and towards these innocent victims. When Anonymous can gain control of HB Gary and FBI/CIA assets imagine what they could do to an off the shelf system that hasn't been through the rigorous security protocols that HB Gary, the FBI and CIA follow. Given the mutability of data on a USB stick I'd also be very interested to see the chain of custody on that data and how it might have been modified. Also, the defense should request access to the source code for the IDS system in question so that it can be examined for bugs and problems that may affect its ability to generate reliable evidence.
    - GHFigs 15y ago
      These people could well be innocent and in fact victims of anonymous directing attention away from itself and towards these innocent victims. This is wishful thinking, but there is a sense in which it is true. People running LOIC are typically if not exclusively clueless mooks duped into doing so by people who know better. For all the mythos around Anonymous "having no leaders", I doubt very strongly that you'll find many examples of people who spontaneously downloaded LOIC and started flinging packets at PayPal. Instead what you'll find is people who say they got the idea from an image posted on 4chan (or elsewhere) or from "some guy" on IRC. All you have to do is convince someone to willingly join a botnet (or anything else) is that 1) this is a way to relieve their angst and 2) other people are doing it. The affidavit even includes examples of the kind of image instructions that accomplish exactly this. The "orders" spread as would memes, and the originators of those orders put themselves at almost no risk to distribute them, while "innocent" members of the herd get caught.
    - robtoo 15y ago
      When Anonymous can gain control of HB Gary and FBI/CIA assets Indeed: "When..." But AFAICR, Anonymous didn't gain control of either FBI or CIA assets. Hacking a self-described FBI "affiliate" and DDOSing cia.gov are hardly the same thing. Also, holding up HB Gary Federal as an example of an organisation with "rigorous security protocols" is an amusing claim with no real evidence.
- wmf 15y ago
  Did you read the article? Paypal provided evidence that the DDoS was coming from LOIC, a manually-operated non-botnet tool. Also, it sounds like Paypal's evidence was only used to get search warrants, and evidence found in those searches (like LIOC) would then be used to justify arrests.
  - astrec 15y ago
    Not necessarily manually-operated. See also: LOIC Hivemind.
InclinedPlane 15y ago
Maybe, I'm not so sure though. If you participate in a mob that went down to some local business to throw rocks through their window, should you expect to be let off easy because you just threw a pebble? On balance I think the idea that DDoS is "ok" and should be tolerated is not a good road to travel down.
- burgerbrain 15y ago
  The equivalent of a DDoS is a sit in, not stoning people in the streets. Do they serve search warrants for people who participate in those?
  - InclinedPlane 15y ago
    Sit ins are not legal either, you can be arrested for trespassing on someone's property if you've been told to leave. The purpose of a sit in is to draw attention to an issue through non-violent means, and it's accepted that there may be consequences to that (including jail time) but the cause justifies the risk. Regardless, it's questionable whether a DDoS and a sit-in are comparable. For one, DDoS does not require the presence of the individual, this makes it more difficult to form a connection with their cause and the activity. For another, a sit-in doesn't typically totally shut down a business, let alone at a national scale. With a DDoS a very tiny minority of people are able to disrupt the business activities of millions. This is not the sort of thing that we want to become accepted a legitimate form of protest. You may think it's all well and good when people who are "fighting" for causes you believe in are "sticking it to the man" but if it becomes the norm then everyone with a grudge will use it. And then it won't be the "good guys" wielding the power it'll be the people most fanatical in its use who will get what they want. If you want to find a form of protest that mimics a sit-in, fine, go ahead, by find something other than DDoS, because that isn't it.
    - burgerbrain 15y ago
      Reading compression. I am not suggesting that sit ins are legal. I am asking if participating in one is enough for the police to get a warrant to thrash your house. Furthermore, sit ins are by definition denial of service attacks. Assertions about differences of scale are 1) irrelevant, 2) questionable (most DDoS fail miserably). This has nothing at all to do with my approval or disapproval of the politics.

maqr 15y ago

If you assume an MTU of 1500 bytes, then this kid sent about 5.25MB worth of data.

jrockway 15y ago
But he didn't buy anything! This is like walking into a book store, looking around at books, reading a bit, and leaving the store without making a purchase. Clearly a federal crime.
- umright 15y ago
  Yeah but he looked at over 9000 books and therefore committed the crime. Of course, the only crime he is guilty of is being young and inept. They're going after these people to make an example of them, not because they did anything actually harmful.
- Joakal 15y ago
  Analogy time: One person taking a book means others can not see the same book. Acceptable DoS because the owner thinks you may purchase it. One person taking several books means others can not see the same books. Questionable DoS because the owner thinks you're screwing around. Many people doing taking several books out in the store leaves the owner to suspect a DDoS attack because there's not usually that many people and none seem to want to buy. It's especially malicious if there's intent. Ugly thing about DDoS is that since there's unexceptionally large amount of people and no books to check out, loyal and new customers will be put off and may not return causing future loss.
- benhalllondon 15y ago
  I think a better analogy would be one where everyone was standing in the doorway and not letting anyone else use the store. Probably a crime, but a pretty minor one.

quandrum 15y ago

Is that even the rate of putting something on the F5 key on the webpage and letting the browser refresh?

VladRussian 15y ago

the point isn't the amount, the point is participation. Such a low intensive, no damage, DoS is akin to a peaceful protest in front of the company store, only virtual. Any real protest in front of a real store is in turn also kind of DoS - thinking about that i wonder whether real protests can be more successfully prosecuted on such a grounds, especially that stretching DoS to an "act of domestic terrorism" is very acceptable today.

tzs 15y ago

> So they're going to arrest a kid for sending an average on one packet every two seconds, over the period of two-and-a-half hours? As a general principle, if it is illegal for one person to perpetrate an act against a victim, I don't see how it should not be illegal for a large group of people to perpetrate the same act, even though the individual contribution of each member of the large group might be small enough that if he were alone it would not rise to the level of a crime. To do it any other way would open up a hell of a big loophole, it seems to me.

redthrowaway 15y ago
It's an interesting question, though. If 1000 people tell one person that they don't like them, and the person commits suicide, then it's reasonable to claim that the group drove them to do it. However, do you prosecute an individual who merely tells someone, "I don't like you?" On an individual basis, it's a weak case. I'm not sure how the law deals with this, or even if there exists any legal principles dealing with how to prosecute actions that are, by themselves, harmless and not illegal (running LOIC may signal an intent to block access, but in the same way that gunning a Pinto on the highway may signal an intent to speed, you're unlikely to be able to break the law).
- kiiski 15y ago
  If the 1000 people did it in coordinated manner with the intent of causing harm to the one person then it would seem like a crime to me. Of course, it's the leaders who should get the severe punishments, but you still have to punish the others too (to a lesser extent). Otherwise you're just saying that it's acceptable to help people commit a crime. And why are people complaining about the FBI going after people anyway? It's their job to catch (probable) criminals, so they can't really start deciding which ones to pursue. It's the judges and jurys (and lawmakers) who make that decision.

mister_jasckson 15y ago

Yes. And ruin his life. How to launch a worse attack than these people did: 1) Browse to website. 2) Place heavy object on F5 key. Seriously.