4 ms·

"KT said fake EDRs don’t have to come from police departments based in the United States, and that some people in the community of those sending fake EDRs are h

"KT said fake EDRs don’t have to come from police departments based in the United States, and that some people in the community of those sending fake EDRs are hacking into police department emails by first compromising the agency’s website. From there, they can drop a backdoor “shell” on the server to secure permanent access, and then create new email accounts within the hacked organization." This sounds extremely unlikely. Maybe in 1999 someone would have hosted their mail server on the same server as their web site. But today?

detaro 5y ago
> But today? Today they use the same crappy hosting company as in 1999, that does the same thing it's always done, just only slightly newer hardware. Especially on a municipal level, there still is not much of a standard when it comes to such things.
- rahimnathwani 5y ago
  Hmm... it seems trivial to do a lookup of the A records for @ and www, and see if there's any overlap with the MX records. If so, then it was likely set up a long time ago and not maintained well.
CrazyMusicians 5y ago
From: https://twitter.com/briankrebs/status/1508819347963363329 https://twitter.com/briankrebs/status/1508819347963363329 Some backstory that's not in the piece. I originally started reporting this about six months ago, when an anonymous tip suggested people were creating fake police department .org domains and sending requests from there. Spent ridiculous amt of time chasing that to no end. As part of that research I looked at all new police dept domains in the last year. Found so many I was sure were fake. They were all real. Some were half-done. Some completely wide open, security-wise. It was depressing to learn after that there are > 18k police depts nationwide.
- ellen364 5y ago
  18k police departments is mind blowing. I looked it up because I wasn’t sure it was plausible, but a Department of Justice publication confirmed [0]. Meanwhile the UK has 48 police forces [1]. 330,000,000 / 18,000 = 18,500 Americans per police force 67,000,000 / 48 = 1,396,000 Brits per police force Not sure what to make of that. [0] https://bjs.ojp.gov/content/pub/pdf/nsleed.pdf https://bjs.ojp.gov/content/pub/pdf/nsleed.pdf [1] https://www.police.uk/pu/contact-the-police/uk-police-forces/ https://www.police.uk/pu/contact-the-police/uk-police-forces...
  - just_steve_h 5y ago
    "We don't live in a police state. We just happen to have a lot of [State | Federal | Regional | Capitol | Transit | Park | University | Hospital | County | Airport | Local] Police!"
  - TechBro8615 5y ago
    Yeah, it sounds pretty bad, but at least it's somewhat decentralized so that power is diffuse. One way to make it worse would be to connect all those agencies to a central aggregator that acts on their behalf. I'm surprised to see so many comments in this thread advocating for exactly that kind of centralization of power.
    - Terry_Roll 5y ago
      >One way to make it worse would be to connect all those agencies to a central aggregator that acts on their behalf. I'm surprised to see so many comments in this thread advocating for exactly that kind of centralization of power. So here in the UK, Special Branch are the intermediate between the security services and police forces, but dont be fooled into thinking UK police forces are independent, there are official channels which is what gets reported and the public are allowed to know about and then there are unofficial channels, in financial stock trading, this could be likened to Dark Pools.
  - pessimizer 5y ago
    Individual UK police forces were created through acts of Parliament, and after an act was passed making UK policing universal, each force was monitored by the central "Inspectorate of Constabulary." Parliament passed two more acts; "The Police Act of 1946" merging towns with counties reducing the number of forces to 117, and the "1964 Police Act" reducing forces to 67. The US just blanket legalized every local paramilitary. Any random-ass local law could give you the right to create your own personal police force. ----- > It's easier than you think to create your own police department in the United States. > Yosef Maiwandi formed the San Gabriel Valley Transit Authority -- a tiny, privately run nonprofit organization that provides bus rides to disabled people and senior citizens. It operates out of an auto repair shop. Then, because the law seems to allow transit companies to form their own police departments, he formed the San Gabriel Valley Transit Authority Police Department. As a thank you, he made Stefan Eriksson a deputy police commissioner of the San Gabriel Transit Authority Police's anti-terrorism division, and gave him business cards. https://www.schneier.com/blog/archives/2006/03/police_departme.html https://www.schneier.com/blog/archives/2006/03/police_depart...
jahewson 5y ago
I wouldn’t put it past them. But hacking an admin portal would probably suffice.
cwkoss 5y ago
The average police officer doesn't even know the law very well. I'd be shocked if the average police dept had someone technically competent enough to speak to network security concerns: that's not their job.
- rahimnathwani 5y ago
  Right, but setting up a web site and email server on the same host (even poorly, in a just-about-works state) requires more expertise to set up than getting a web site and email set up on GoDaddy or whatever.

detaro 5y ago

> But today? Today they use the same crappy hosting company as in 1999, that does the same thing it's always done, just only slightly newer hardware. Especially on a municipal level, there still is not much of a standard when it comes to such things.

rahimnathwani 5y ago
Hmm... it seems trivial to do a lookup of the A records for @ and www, and see if there's any overlap with the MX records. If so, then it was likely set up a long time ago and not maintained well.

CrazyMusicians 5y ago

From: https://twitter.com/briankrebs/status/1508819347963363329 https://twitter.com/briankrebs/status/1508819347963363329 Some backstory that's not in the piece. I originally started reporting this about six months ago, when an anonymous tip suggested people were creating fake police department .org domains and sending requests from there. Spent ridiculous amt of time chasing that to no end. As part of that research I looked at all new police dept domains in the last year. Found so many I was sure were fake. They were all real. Some were half-done. Some completely wide open, security-wise. It was depressing to learn after that there are > 18k police depts nationwide.

ellen364 5y ago
18k police departments is mind blowing. I looked it up because I wasn’t sure it was plausible, but a Department of Justice publication confirmed [0]. Meanwhile the UK has 48 police forces [1]. 330,000,000 / 18,000 = 18,500 Americans per police force 67,000,000 / 48 = 1,396,000 Brits per police force Not sure what to make of that. [0] https://bjs.ojp.gov/content/pub/pdf/nsleed.pdf https://bjs.ojp.gov/content/pub/pdf/nsleed.pdf [1] https://www.police.uk/pu/contact-the-police/uk-police-forces/ https://www.police.uk/pu/contact-the-police/uk-police-forces...
- just_steve_h 5y ago
  "We don't live in a police state. We just happen to have a lot of [State | Federal | Regional | Capitol | Transit | Park | University | Hospital | County | Airport | Local] Police!"
- TechBro8615 5y ago
  Yeah, it sounds pretty bad, but at least it's somewhat decentralized so that power is diffuse. One way to make it worse would be to connect all those agencies to a central aggregator that acts on their behalf. I'm surprised to see so many comments in this thread advocating for exactly that kind of centralization of power.
  - Terry_Roll 5y ago
    >One way to make it worse would be to connect all those agencies to a central aggregator that acts on their behalf. I'm surprised to see so many comments in this thread advocating for exactly that kind of centralization of power. So here in the UK, Special Branch are the intermediate between the security services and police forces, but dont be fooled into thinking UK police forces are independent, there are official channels which is what gets reported and the public are allowed to know about and then there are unofficial channels, in financial stock trading, this could be likened to Dark Pools.
- pessimizer 5y ago
  Individual UK police forces were created through acts of Parliament, and after an act was passed making UK policing universal, each force was monitored by the central "Inspectorate of Constabulary." Parliament passed two more acts; "The Police Act of 1946" merging towns with counties reducing the number of forces to 117, and the "1964 Police Act" reducing forces to 67. The US just blanket legalized every local paramilitary. Any random-ass local law could give you the right to create your own personal police force. ----- > It's easier than you think to create your own police department in the United States. > Yosef Maiwandi formed the San Gabriel Valley Transit Authority -- a tiny, privately run nonprofit organization that provides bus rides to disabled people and senior citizens. It operates out of an auto repair shop. Then, because the law seems to allow transit companies to form their own police departments, he formed the San Gabriel Valley Transit Authority Police Department. As a thank you, he made Stefan Eriksson a deputy police commissioner of the San Gabriel Transit Authority Police's anti-terrorism division, and gave him business cards. https://www.schneier.com/blog/archives/2006/03/police_departme.html https://www.schneier.com/blog/archives/2006/03/police_depart...

jahewson 5y ago

I wouldn’t put it past them. But hacking an admin portal would probably suffice.

cwkoss 5y ago

The average police officer doesn't even know the law very well. I'd be shocked if the average police dept had someone technically competent enough to speak to network security concerns: that's not their job.

rahimnathwani 5y ago
Right, but setting up a web site and email server on the same host (even poorly, in a just-about-works state) requires more expertise to set up than getting a web site and email set up on GoDaddy or whatever.