4 ms·

I can't believe all they were doing was validating the email, if that's true. Virtually every town, city, borough, county, etc. across the country has a police/

I can't believe all they were doing was validating the email, if that's true. Virtually every town, city, borough, county, etc. across the country has a police/sheriff's department, sometimes as small as a few people. Even a few private companies have them. Sure the NYPD, FBI, etc. are going to (theoretically) have top security, but if any LEO anywhere in the country is good enough, just hack some podunk PD that exists solely to generate ticket revenue and has no IT department, no 2FA, no security training.

judge2020 5y ago
Pretty much what they did. https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/ https://krebsonsecurity.com/2022/03/hackers-gaining-power-of... ( https://news.ycombinator.com/item?id=30842757 https://news.ycombinator.com/item?id=30842757 ) > Providers have a streamlined process where they publish the fax or contact information for police to get emergency access to data. But there’s no real mechanism defined by most Internet service providers or tech companies to test the validity of a search warrant or subpoena. And so as long as it looks right, they’ll comply
gonehome 5y ago
I can't really fault the tech companies for this, it's not a great place to be in and there isn't an obvious solution. The bad actors are explicitly exploiting an emergency provision intended for quick information return to prevent serious harm/death using verified police accounts they've compromised. You either end up with the headline we have here or "Apple's failure to comply with an emergency request led to the death of X" I don't know what the right policy is, but this is just a tradeoff without an easy answer.
- DennisP 5y ago
  I don't know, maybe look up the police department's number online and call them back? If we can do it when the "bank" calls us and asks for private information, maybe these guys could do the same.
- dvtrn 5y ago
  I can't really fault the tech companies for this, it's not a great place to be in and there isn't an obvious solution. For all of the box ticking, theatrical diligence and audit-preparedness work I’ve had assigned to me in my Devops career, and bespoke security “services” and “products” out there that merely exist to enable more box ticking in the name of “security and compliance”, I think maybe we should start.
- klyrs 5y ago
  Sadly, the "common sense" solution would be a single email provider -- something provided by the federal government. Alas, sense isn't common in the US: it's up to every state (and, it would appear, county, city, university, etc) to decide.
- throwaway81523 5y ago
  One obvious thing I'd do if Officer Bob from the Podunk PD asked me for anything, is say "let me call you back", find the published phone number of the Podunk PD, call it, and ask for Officer Bob. I'd of course tell him I was about to do that, so he could arrange to receive a call from the PD front desk, or at least have them confirm that they had just talked to him. So the crooks would have to intercept that front desk number too, if they wanted to fake it. That would at least slow them down a little more, I hope.
  - manquer 5y ago
    Social engineering this is trival. Lookup for a phone will likely be on their website. The threat actor could compromise the website just as they did for the email, Or create a legitimate looking fake one, not every department has one or is indexed well Tech support staff handling these requests cannot possibly know the thousands of police departments sites to know if the site is legitimate. There is simply no single national authoritative source for validation ( international is even more complex with different laws and languages)
    - gjs278 5y ago
    - throwaway81523 5y ago
      Back in the day you could get national phone directories on cd-rom. So the crooks would have had to compromise the phone book or the cd. Idk if those cd's still exist. Yes, the police web site is another point of vulnerability. But with any luck you can reliably find the area code for Podunk, then call directory assistance in that area code to ask for the police department number. So the crooks would have to compromise that too.
    - rib3ye 5y ago
      Creating a national db of validated police department phone numbers seems like the easiest problem to solve in this chain of issues. What’s on the EDR form?
ashtonkem 5y ago
Nevermind the risk that it’s actually a cop sending these requests for their own personal reasons. It’s far from unheard of for cops to abuse these systems to harass former partners and personal rivals; the courts are supposed to provide oversight to prevent these abuses.
- CrazyMusicians 5y ago
  You're absolutely right. Here's one high-profile example: https://www.thedailybeast.com/feds-say-bounty-hunter-matthew-marre-used-suicide-hoax-to-con-verizon-t-mobile-out-of-customer-data https://www.thedailybeast.com/feds-say-bounty-hunter-matthew...

judge2020 5y ago

Pretty much what they did. https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/ https://krebsonsecurity.com/2022/03/hackers-gaining-power-of... ( https://news.ycombinator.com/item?id=30842757 https://news.ycombinator.com/item?id=30842757 ) > Providers have a streamlined process where they publish the fax or contact information for police to get emergency access to data. But there’s no real mechanism defined by most Internet service providers or tech companies to test the validity of a search warrant or subpoena. And so as long as it looks right, they’ll comply

gonehome 5y ago

I can't really fault the tech companies for this, it's not a great place to be in and there isn't an obvious solution. The bad actors are explicitly exploiting an emergency provision intended for quick information return to prevent serious harm/death using verified police accounts they've compromised. You either end up with the headline we have here or "Apple's failure to comply with an emergency request led to the death of X" I don't know what the right policy is, but this is just a tradeoff without an easy answer.

DennisP 5y ago
I don't know, maybe look up the police department's number online and call them back? If we can do it when the "bank" calls us and asks for private information, maybe these guys could do the same.
dvtrn 5y ago
I can't really fault the tech companies for this, it's not a great place to be in and there isn't an obvious solution. For all of the box ticking, theatrical diligence and audit-preparedness work I’ve had assigned to me in my Devops career, and bespoke security “services” and “products” out there that merely exist to enable more box ticking in the name of “security and compliance”, I think maybe we should start.
klyrs 5y ago
Sadly, the "common sense" solution would be a single email provider -- something provided by the federal government. Alas, sense isn't common in the US: it's up to every state (and, it would appear, county, city, university, etc) to decide.
throwaway81523 5y ago
One obvious thing I'd do if Officer Bob from the Podunk PD asked me for anything, is say "let me call you back", find the published phone number of the Podunk PD, call it, and ask for Officer Bob. I'd of course tell him I was about to do that, so he could arrange to receive a call from the PD front desk, or at least have them confirm that they had just talked to him. So the crooks would have to intercept that front desk number too, if they wanted to fake it. That would at least slow them down a little more, I hope.
- manquer 5y ago
  Social engineering this is trival. Lookup for a phone will likely be on their website. The threat actor could compromise the website just as they did for the email, Or create a legitimate looking fake one, not every department has one or is indexed well Tech support staff handling these requests cannot possibly know the thousands of police departments sites to know if the site is legitimate. There is simply no single national authoritative source for validation ( international is even more complex with different laws and languages)
  - gjs278 5y ago
  - throwaway81523 5y ago
    Back in the day you could get national phone directories on cd-rom. So the crooks would have had to compromise the phone book or the cd. Idk if those cd's still exist. Yes, the police web site is another point of vulnerability. But with any luck you can reliably find the area code for Podunk, then call directory assistance in that area code to ask for the police department number. So the crooks would have to compromise that too.
  - rib3ye 5y ago
    Creating a national db of validated police department phone numbers seems like the easiest problem to solve in this chain of issues. What’s on the EDR form?

ashtonkem 5y ago

Nevermind the risk that it’s actually a cop sending these requests for their own personal reasons. It’s far from unheard of for cops to abuse these systems to harass former partners and personal rivals; the courts are supposed to provide oversight to prevent these abuses.

CrazyMusicians 5y ago
You're absolutely right. Here's one high-profile example: https://www.thedailybeast.com/feds-say-bounty-hunter-matthew-marre-used-suicide-hoax-to-con-verizon-t-mobile-out-of-customer-data https://www.thedailybeast.com/feds-say-bounty-hunter-matthew...