8 ms·
"To disrupt the botnet, the FBI redirected Qakbot traffic to Bureau-controlled servers that instructed infected computers to download an uninstaller file. This
by firesteelrain 3y ago
"To disrupt the botnet, the FBI redirected Qakbot traffic to Bureau-controlled servers that instructed infected computers to download an uninstaller file. This uninstaller—created to remove the Qakbot malware—untethered infected computers from the botnet and prevented the installation of any additional malware. "
That's pretty sweet that they healed hundreds of thousands of computers
- pbronez 3y agoPretty interesting. I bet there were a LOT of lawyer conversations about that.
- nickthegreek 3y agoFBI's been doing this for awhile now. So far no one has taken them to court. I do wonder how that would end.
- tw04 3y agoGiven the infected folks in question likely had their machines involved in illegal activity, I'm not sure I'd want to test it. If someone starts running a meth lab out of your unlocked cellar, at what point do you become culpable for not knowing? And are you really going to try to sue the police for shutting down the lab and locking the door on their way out?
- anonym29 3y ago>If someone starts running a meth lab out of your unlocked cellar, at what point do you become culpable for not knowing? Are you implying that the property owner is liable because they neglected to lock the cellar, or because they weren't aware a crime was taking place there? If the former, isn't that as clear an example of victim blaming as telling people to carry firearms/protection if they don't want to be sexually assaulted? In a civil society, it is not the responsibility or duty of the victim to set up security measures to prevent themselves from being victimized. It is the responsibility and duty of the culprit to not commit those unlawful crimes in the first place. Bringing the analogy back to security - who is guilty of a crime when a ransomware attack happens, the victim, or the criminal (who obtained unauthorized access, and used that access to perform extortion)?
- tw04 3y ago>or because they weren't aware a crime was taking place there? If someone is running a meth lab out of your cellar for a year, and you don't notice the smell, the power bill, the people coming and going, at what point are you no longer able to claim ignorance? If your answer is: you can claim ignorance indefinitely, what is preventing someone from just letting a meth lab be run from their basement and taking cash on the side? If the police can't find the cash, you're just not guilty? >It is not the responsibility of the victim to set up security measures to prevent themselves from being victimized. It is ABSOLUTELY the responsibility of the "victim" to not create an environment that FACILITATES crime. If you leave a gun unsupervised and unlocked on your front step, and a neighbor kid "steals" the gun off your front steps and proceeds to shoot and kill their friend, you are going to jail despite you being the "victim" of theft. Your internet connection in this instance is the loaded gun when your systems are being used in DDoS attacks.
- AndrewKemendo 3y agoYes, and there’s plenty of case law to support that - In fact, one of the most popular TV shows of all time had its finale specifically addressing the fact that a law needed to be made to discourage “bystanders” from actively ignoring crime.
- lelanthran 3y agoWhich show was this?
- dcow 3y ago> and taking cash on the side With this statement you’re arguing past the person you’re responding to. If you are taking cash on the side to feign ignorance when the DEA comes squawking about the meth lab in your basement then you are clearly in the know. Nobody is talking about negligence here. Your rebuttal is essentially “well victims can be blamed if they’re being negligent”. Yeah, sure, by definition they’re not just a victim, they’re a negligent individual. (I mean I’d even argue they can be blamed for less—I’m not one of those 100% the victim is always innocent types, but that’s a different topic.) The original question is if you are honestly unaware (and not negligent) that your property is being used to commit a crime, are you culpable for the crime? The answer is a resounding “no”. If someone hacks your PC and installs botnet software, and it evades your OS antivirus heuristics and protections because it’s a sophisticated root-kit, then no, you’re not culpable.
- dcow 3y ago> And are you really going to try to sue the police for shutting down the lab and locking the door on their way out? If the police enter your property without a warrant then sure. The potential presence of illegal activity does not grant the police special powers to skirt judicial process (unless there’s imminent danger to someone’s life or something, obviously). If the police unduly lock you out of your own property on the way out then doubly sure. Obviously most people will be relieved that their machine no longer has malware on it (save willing participants, which is a different question altogether…). What would piss me off is not being notified, and not being given the chance to remediate myself (what if the police damage other pieces of property on the way and I could avoid the damage if I’m simply made aware), etc. So let’s go back to the meth lab example: do you think it’s okay for the police to show up on your property unannounced in the middle of the night while you’re sleeping to silently shut down the meth lab without notifying you that they’re trespassing and then slap a lock on your basement door behind which you store your emergency cash, medical supplies, prescription drug refills, personal protection equipment, defensive firearms, etc. without leaving the keys or so much as a word? Edit (two more things): 1. It’s possible someone might have been running a copy of the botnet for research purposes, so presumably this copy is not engaged in illicit activity and only installed on lab hardware. I wonder if the FBI’s program considered this scenario. Maybe they only targeted IPs involved in actual DDOS attacks? That’d be cool. 2. You can question something without implying it’s wrong. One can both believe the FBI is acting in a responsible and just way while also being curious how this would play out in court. The fervor in your responses seems slightly out of place considering the comment you’re responding to is simply raising a question.
- mandevil 3y agoOh hey, look at that, the FBI did get a warrant authorizing this action, and signed off by a United States Magistrate Judge: https://www.justice.gov/d9/2023-08/23mj4244_application_redacted.pdf https://www.justice.gov/d9/2023-08/23mj4244_application_reda... Now, are judges sometimes too easy with warrants? Certainly. But this is definitely not the same as entering your house without a warrant, because the FBI did get a warrant. The warrant involves them promising to a judge under penalty of perjury that the Qakbot Uninstaller they are using makes no further changes and collects no additional data on any of the victim computers they are running on. So, the FBI is aware of your concerns and is taking steps to alleviate them. Does that make you feel better?
- airstrike 3y ago> If someone starts running a meth lab out of your unlocked cellar, at what point do you become culpable for not knowing? The problem with analogies is that they assume they are correctly "analogous" but 9/10 times they really describe an entirely different situation, making them unhelpful if not misleading
- ToValueFunfetti 3y agoThe problem with analogies is that people who disagree tend to just say "X is not Y" instead of "X is different from Y in this context due to Z". I'm not sure whether that is just a social behavior or if saying the second thing is especially hard.
- rzzzt 3y agoA duck is not a horse due to... it not being a horse. You can macroexpand Z to "not having four legs", etc., but incomparable things will end up being different just based on their very essence.
- ToValueFunfetti 3y ago"Why can't I pull a small wagon with a team of ducks? I can pull a large wagon with a team of horses." Useful answers: Ducks are not as intelligent as horses and aren't as easy to train. There is not a good way to strap a harness onto a duck for this task. Ducks waddle and this introduces turbulence. Ducks have substantially less pulling power. etc. Useless answer: A duck is not a horse because a duck is different from a horse. The person making the analogy knows that it is an analogy; it is not the source of confusion.
- airstrike 3y agoIt's not especially hard -- the burden of proof just isn't on the listener. Saying "X is not Y" is just saying "I'm not convinced, you must do better with your analogies". With enough context, one can infer as much Letting someone run a meth lab in your cellar is pretty obviously not the same as "letting" some malware run on your box, for crying out loud
- hinkley 3y agoProbably at the moment you try to sue them for taking away your volunteer meth lab.
- wutwutwat 3y ago[dead]
- neodymiumphish 3y agoThere's plenty of room for security researchers running infected machines to monitor for behavioral and developmental changes in the malware to be more than a little irritated by the notion that the FBI or anyone else abused the malware servers to remove the infection surreptitiously.
- pfdietz 3y agoI wonder if the FBI could legally brick the machines involved (particular if some were devices that had never been patched.)
- wutwutwat 3y ago[dead]
- ip_addr 3y agoHere's the application and search warrant. https://www.justice.gov/d9/2023-08/23mj4244_application_redacted.pdf https://www.justice.gov/d9/2023-08/23mj4244_application_reda... https://www.justice.gov/d9/2023-08/23mj4244_warrant_redacted.pdf https://www.justice.gov/d9/2023-08/23mj4244_warrant_redacted...
- doakes 3y agoI'm getting 403'd on these links
- AtomicOrbital 3y agoLinks work
- libraryatnight 3y agoThis was really interesting to read, thank you for the links.
- hanniabu 3y agoIt's the government, since when are they concerned about legality
- revscat 3y agoMore often than you’d think.
- verve_rat 3y agoMy question: how does a US warrant apply to computers outside US jurisdiction?
- paxys 3y agoThey didn't access any random computers outside of their jurisdiction, only Qakbot servers.
- paganel 3y agoI must have missed it, but does the article mention that those servers were all located inside the US? (where I supposed FBI has jurisdiction for stuff like this).
- deleted 3y ago[deleted]
- paxys 3y ago> As part of the operation, the FBI gained lawful access to Qakbot’s infrastructure and identified over 700,000 infected computers worldwide—including more than 200,000 in the U.S. "Lawful access" is doing a lot of heavy lifting, but at least they specified it.
- wutwutwat 3y ago[dead]
- rainsford 3y agoThe first sentence of the article describes it as a "multinational operation" and the title credits both FBI and "partners". That makes it pretty clear it wasn't just a US agency operating with the authority of a US warrant.
- anonym29 3y ago[flagged]
- neovialogistics 3y agoI'd trust it a hell of a lot more than a binary originating from any other USG letter agency, except maybe OSHA and the NWS.
- galleywest200 3y agoNASA has a good set of open source projects available for public use: https://code.nasa.gov/ https://code.nasa.gov/
- anonym29 3y agoKeyword: "open source", as in, you are permitted/encouraged to understand what it's doing.
- dcow 3y agoAnd the big question is what if your machine is configure in a way that is incompatible with the FBI’s justice.exe and you lose irreplaceable data?
- shadowgovt 3y agoLegally speaking? While IANAL, looking at the warrant issued and signed, the nature of such a loss would be akin to any other loss incurred during a search and seizure. In general, such losses are understood as incidental and the searchee is not protected from them. If the police smash your front door in, they aren't responsible for paying to replace the lock; if they think you hid drugs in your wall and take a Sawzall to it, they don't owe you drywall. In the extreme, it's been found that if a flashbang burns your house down during a raid, they aren't liable to replace your house (even if the target of the raid wasn't on that property). Warrants basically suspend some civil rights temporarily; that's why they require a judicial concurrence. So I have no specific case citation for data loss due to a digital search and seizure, but my guess from analogy is that if you have an unusual configuration (cracked the botnet control program open and stored your private Bitcoin key in there?) and the FBI's counter-net wipes your data, you will not prevail in a court of law, much as if your front door was somehow load-bearing and the cops, upon hitting it with the battering ram, knocked your house over. But since I can't point to a specific case to give precedent, hey, whatever you and the lawyer you can afford can argue, I guess. ;)
- deleted 3y ago[deleted]
- shadowgovt 3y agoOne of my favorite tricks in dealing with botnets: if you can access the control plane, you can convince the network to do most anything... Including self-terminate.
- georgeburdell 3y agoImagine if a race condition in someone’s backend was fixed by being slowed down just a little bit by this malware, and then the malware issue was surreptitiously fixed by the FBI and it broke again https://xkcd.com/1172/ https://xkcd.com/1172/
- m_0x 3y agoUsing malware to combat malware. Hopefully they aren't lying.
- debarshri 3y agoAnti viruses act like malware anyways
- koolba 3y ago> Using malware to combat malware. Though it’s only legal when they do it. Pretty sure it’d still be a crime if a good Samaritan tried it out.
- paxys 3y agoWhy are you making it sound like that's some profound revelation? Law enforcement is allowed to run stings, serve warrants and make arrests, you aren't. The military is allowed to invade countries and drop nukes, you aren't. Yes it is legal when they do it and not some average Joe who wants to play hero. That's how the world works, and it is a good thing.
- KRAKRISMOTT 3y ago[flagged]
- fluoridation 3y agoI don't believe there's any laws that forbid individuals from invading countries and using nuclear weapons.
- glasshug 3y ago18 U.S.C. 960 > Whoever, within the United States, knowingly begins or sets on foot or provides or prepares a means for or furnishes the money for, or takes part in, any military or naval expedition or enterprise to be carried on from thence against the territory or dominion of any foreign prince or state, or of any colony, district, or people with whom the United States is at peace, shall be fined under this title or imprisoned not more than three years, or both.
- jszymborski 3y agoAm I missing something or wouldn't the author(s) of Qakbot be able to avoid this attack by cryptographically signing commands and having clients check them?
- paxys 3y agoIt doesn't matter. If you gain access to their servers you can sign the commands yourself.
- rcxdude 3y agoDepends on where the key is. Command and control servers don't need to have the keys for the commands they are relaying.
- datadeft 3y agoI am pretty sure that is not their top priority.
- chilmers 3y agoFrom https://www.secureworks.com/blog/law-enforcement-takes-down-qakbot https://www.secureworks.com/blog/law-enforcement-takes-down-... "To interact with infected hosts, the replacement servers required a certificate that can sign messages. It appears that the certificates were obtained and used for good intentions."
- jagged-chisel 3y agoHaving been around during the 90s Cryptowars (and related culture and counterculture) I do wonder if in a few years we’ll hear that NSA piggybacked some “fun” toys on this uninstaller.
- neodymiumphish 3y agoConsidering the (il)legality of what they did just by running the uninstaller without authority, and the obvious implications and attention this would have, I highly doubt they did any such thing in this particular instance.
- weird-eye-issue 3y agoThey did something highly illegal so you highly doubt they did one extra illegal thing at the same time?
- neodymiumphish 3y agoI worked in federal law enforcement on these same kinds of cases. The approvals needed to authorize a plan like this are very heavily scrutinized. Any aside added in to leave a lasting effect directed toward monitored lawful activity would have blown this all up immediately.
- smfjaw 3y agolol, seen the edward snowden documentry?
- jchw 3y agoThe track record that U.S. government agencies have says otherwise. Was there any accountability at all for the Snowden revelations? I mean, aside from Snowden himself, anyway.
- 1vuio0pswjnm7 3y agoSometimes I wonder why the American public has to be subject to the all the evils of so-called "tech" companies when clearly the US government has the personnel to write safe, reliable software. Unlike so-called "tech" companies that can smugly ignore Americans' reasonable expectations of privacy in order to generate obscene profits, there are laws that prohibit the US government from engaging in similar shenangigans. (The "shenangigans" should be crimes but money has intervened.) Even if hypothetical government-issued software might be "inferior" to whatever the so-called "tech" companies are producing, it would still be "superior" from a legal/regulatory standpoint. Americans would have some enforceable rights as software users. (Other countries are making some progress.) Someone is inevitably going to make a wise crack reply about government contracting in the US. But I'm not referring to contractors. I'm referring to government employees. We'll also likely see some reply about the technical superiority of so-called "tech" company software. But I'm not referring to technical superiority, I'm referring to (a) legal/regulatory limits on software authors and (b) software user rights.
- TylerE 3y agoGovernment software is great if you have a decade and a billion dollars to spend.
- themagician 3y ago>"Sometimes I wonder why the American public has to be subject to the all the evils of so-called "tech" companies when clearly the US government has the personnel to write safe, reliable software." It's not just the American public, it's every computer user—everywhere. The reason is because it's easy. There's plenty of secure software and systems out there. It's hard to use. The costs outweigh the benefits for most people most of the time. We could all be running Qubes or openBSD but we don't because it's hard. It's hard to do simple things. Most of the world runs on Windows and people are logged in as admin. It's a point and click world. I don't know if the government needs to write software, but I do think there is room for a vendor to step up, particularly in the business world, with systems that offer ironclad security. IMO we are in an increasingly dangerous world. I'm surprised the internet connected world hasn't collapsed yet. Every day seems to be a new kind of scam or malware. It takes incredible effort to safeguard systems today. One wrong click and in 5 minutes your entire life can be destroyed. I'm curious what the stats are on malware that has completely destroyed businesses. Cyber insurance policies are almost necessary now even if you consider yourself a skilled user.
- kvetching 3y ago"The FBI Supernode Module and the Qakbot Uninstaller DO NOT remediate malware that was already installed on the infected computer through Qakbot, such as ransomware or other malware that steals financial credentials. However, the Qakbot Uninstaller is designed to prevent additional malware from being installed on the infected computer through the Qakbot botnet by untethering the victim computer from the botnet. " -https://www.justice.gov/d9/2023-08/23mj4244_application_redacted.pdf https://www.justice.gov/d9/2023-08/23mj4244_application_reda...
- adolph 3y ago> That's pretty sweet that they healed hundreds of thousands of computers The cynical part of me says that (1) they just installed an NSA backdoor in hundreds of thousands of computers; (2) the FBI probably didn't even realize it; (3) it'll all come to light some years from now when the NSA tooling is leaked by a careless contractor and used by various worse actors; (4) but the "leak" was NSA's plan all along to spy on said various worse actors. The meta-cynical part of me says all that is way too convoluted and I should take off the tin-foil fedora and tip it to m'lady.