15 ms·
Verizon fell for fake "search warrant," gave victim's phone data to stalker
- piperswe 3y agoIt’s wild that the primary way of validating an order was signed off by a judge is by looking at an easily forgeable signature.
- vivekd 3y agoSeems like the government's fault. In every other area of even marginal importance we have better and more advanced authentication systems. Yet governments the world over continue to use signatures. I mean something as simple as a piece of paper with a password that lets you find an authentication info in the court website. An email. Or even an automated phone or email address that lets you authenticate online
- Eisenstein 3y agoThe problem is that there are tens of thousands of counties with more judges and cops and each county has an IT department and are you telling me that there is any way to get them all to agree to some standard procedure that they are going to have to figure out, and then pay for? The only way to accomplish this would be to centralize it at least by state, like a DMV for courts.
- vivekd 3y agoYou don't need a standard procedure followed all over the world. You just need some authentication procedure that's better than an easily forgable signature. I gave a few examples of the top of my head in the parent. This is why I would rather have profit hungry corporations manage things than governments. Because with government there's always a legion of people rushing to excuse and explain away even the most serious examples of ineptitude and mismanagement. Would you accept it if Facebook or Google let people login to user accounts via signed letter? So why is a signature enough for a search warrant? A signature is not an acceptable method of authentication in 2023 for important documents. I don't see how that's not obvious.
- deleted 3y ago[deleted]
- Eisenstein 3y agoWhat does having local governments have to do with huge monolithic corporations? If google was in charge of our physical security then a) it would be a de facto government b) it wouldn't care about individuals at all. Google doesn't let you log in with a signature not because they care about your security, but because it wouldn't be profitable. The problem is that when it becomes more profitable to sell your data to Corp B, who then has as a client Stalker Creep A, then they will do that. Making motivation money instead of public good is a strange way to achieve either of those goals.
- vivekd 3y agoHow would google lose money if stalkers broke into my Gmail? No it's because in every other area besides government we have standards of security because government is the only place where people tolerate, accept and even defend massive security lapses There's a large group of the population that has an ideological frenzy to defend government no matter what so they're able to get away with terrible lapses like this
- Eisenstein 3y agoNot sure I understand. You brought up a claim that for profit companies are better to manage people's physical and legal security needs than the courts themselves and law enforcement. That would de facto make them government -- so we are both defending government, just different forms. You think an undemocratic, for profit motivation would work to fulfill public good, and I disagree. > No it's because in every other area besides government we have standards of security I guess you never heard of NIST? I suppose private companies never get hacked and have all their customer's data stolen?
- vivekd 3y agoYou're getting lost in words not touching substance. I can distill it to this - If private contractors did warrants we'd be better off because there are no ideologically driven zealots who will defend and excuse it if they had weak security like a signature and nothing else. Thus they would be forced to have a basic workable security system. This can be extrapolated to every other area
- dclowd9901 3y agoThis isn’t even close to true. Sure, for legal documents. But any cursory check of this document would’ve led right back to the judge in the court who supposedly signed it and a quick “hey did you actually sign this” would have rendered a very specific and correct answer. Otherwise, the government uses all sorts of modern authentication mechanisms when dealing with sensitive materials.
- spacebanana7 3y agoUnfortunately any information in the government can be accessed with the right legal document.
- aidenn0 3y agoForging a judges signature, by itself, will get you jail time. So will impersonating a police officer in most states[1]. By taking this method of locating the woman, the stalker basically guaranteed himself prison time; plenty of stalkers do some really scary stuff without getting sentenced to any time in prison. 1: It really varies; surprisingly enough it's not a felony in all states, and in at least one state, it's only a felony if there is intent to benefit from the authority granted.
- jonhohle 3y agoThat’s the thing with laws, they don’t prevent crime, they just enumerate it. Any time I hear a politician say they are going to reduce a particular crime by passing a law, I wonder why existing laws aren’t enforced that likely already cover the behavior being targeted. I suppose that would mean planning, logistics, and execution - things politicians don’t know how to do.
- b112 3y agoThere is most definitely a section of society which is held in check by laws, and their outcome. Those that do not fit the above, having no impulse control, or perhaps mental issues, then laws result in stuffing them away. It's not perfect. Yet every human society does this, and has done this for millenia. Consider that.
- deleted 3y ago[deleted]
- boomboomsubban 3y agoWow, the emails even included the proton default signature of "sent with Proton Mail secure email." I can maybe see not noticing in the "from" field, but how does that not raise red flags? I wouldn't be surprised if the answer is that police routinely use their personal accounts for such things.
- marcus0x62 3y agoOr "nobody reads or even looks at email signatures."
- bombcar 3y agoLook, it said it was secure right in the email. Very diligent. Much due.
- whalesalad 3y agoKevin Mitnick taught us decades ago that the weakest link in any environment are humans. Social engineering is so much easier than you’d imagine it to be.
- shermozle 3y agoI worked at a telco next to the law enforcement liason team's office and overheard a lot of their calls and conversations. They were all ex-cops and extremely inclined to hand over anything requested, ever. They also weren't particularly sharp, shall we say.
- acchow 3y agoThis is probably intentional so they filter away all the agents that have a high guard about security.
- n_plus_1_acc 3y ago"But it says secure"
- wmf 3y agoStraight out of Mr. Robot.
- pseingatl 3y agoForging a judicial order is trivial. There is no way Verizon or anyone else knows if there is a specific form used in one of the 1700+ counties that comprise the US. Federal subpoenae are even easier because they are uniform and are filed under seal. Verizon can't call the Clerk's office and ask, "did the grand jury really issue a subpoena?" The documents are written on simple copy paper and lack any kind of security features. Expect more of these as word gets out. Also, it's easy enough to file a small claims case and have a subpoena issued. Usually, there's no one to quash the subpoena. Civil subpoenas take a little longer than criminal ones and you have to pay to have them served, but so what?
- chatmasta 3y agoI'm always torn about this kind of exploit. On the one hand it's obviously vulnerable. On the other hand, securing it would require centralization of authority. I think I'm actually okay with accepting the tradeoff of insecure verification of "legitimacy," in exchange for decentralization of police power. But it's also worth noting that the "vulnerable" system is not the centuries old system of policing. If you get arrested by a fake cop, that system affords you legal remedies - it might take a few days but you'll see justice. The vulnerable system here is Verizon's process for responding to inbound messages claiming to be search warrants. And when this system fails, the victim has effectively no remedy - their stalker already read the data that Verizon sent him. So that's even less of a reason to increase centralization of the policing system. It won't solve the problem because the problem is with a different system.
- pas 3y agoevery judiciary authorized to issue warrants should simply put them on their own website, put some id on the paper, folks can verify. what else is needed? these aren't supposed to be secret anyway
- chatmasta 3y agoThat's the least bad solution available IMO, since the Internet and DNS is the closest thing to decentralized we have available to us. But it requires a special TLD available exclusively to courts, which would make the TLD registry a centralized authority. What if a political activist refuses to validate the TLD of a court in the middle of Texas because of a disagreement with a ruling?
- gjsman-1000 3y ago[flagged]
- deleted 3y ago[deleted]
- midtake 3y agoIt's almost as if such emails should be PGP signed.
- eqvinox 3y agoAnd how do you establish that a particular PGP key is being used by an authorized party in an official capacity for a valid purpose? If you said S/MIME, that'd actually make sense with the X.509 authority system, but PGP with its WoT is just entirely the wrong tool here.
- midtake 3y agoFair. For what it's worth I thought that PGP's trust system could operate in a similar manner to the X.509 authority system.
- deleted 3y ago[deleted]
- ycombinatrix 3y agoPGP has an archaic trust system that likely wouldn't have helped in this case.
- eqvinox 3y ago> We contacted Verizon about the incident today and will update this article if we get a response. A Verizon spokesperson told 404 Media that the company is cooperating with law enforcement on this matter. Someone at Verizon should maaaayyyybe have sliiiiiightly adapted that boilerplate response in this particular instance ;D (Also, yes, no laughing matter really, but still very funny.) -- FWIW I moonlight at a small community ISP and we've had to deal with the legal system twice. When we first got a request, we scratched our heads trying to figure out how to authenticate it. Our procedure became to discard all contact information from the warrant, find fresh contact from some trustworthy source (ended up being the official state webpage in both of our cases), and call them to verify. … maybe Verizon should adopt that procedure, sounds like it would've caught this instance: > The Cary Police Department confirmed that no officer named Steven Cooper is employed by their agency, […]
- twright0 3y agoIssuing a fake search warrant is presumably a crime, so they would/should be cooperating with law enforcement about it.
- dundarious 3y agoFake law enforcement, or real law enforcement? That is the intended joke.
- toasted-subs 3y agoAnd I get weird looks for not wanting to give away personal information.
- 1-6 3y agoAt this point, all the world’s systems are by far incapable of staving off social engineering scams.
- forthwall 3y agoOutside of the insanity of the original story; I am most surprised of this tidbit > Glauner and the victim met in August or September 2023 on hamster.com, a porn website with dating features, and "had an online romantic relationship," the affidavit said. The victim ended the relationship, but Glauner "continued to contact or try to contact" her, the document said. I had no idea porn site dating features were not scams/phishint attempts themselves
- SandraBucky 3y agoSome OF content creators use these platforms to advertise their material.
- InCityDreams 3y agoDarn, now i have to search for "OF".
- lionkor 3y agoonly fans
- demarq 3y agobackdoors know not their guests
- xyst 3y agoI vaguely recall something like this depicted in a TV show called Mr. Robot. He was hired to find person of interest through a cell number. Impersonated or intercepted NYPD fax line? Forged some document that NYPD uses to obtain data from carriers. Sent the forged fax and just waited for a response. Definitely more elegant than sending forged doc from a protonmail address. But nevertheless the same method. edit: found it. https://youtu.be/AdHE5Nss4HI?si=b4Et34pHKx8p1uP9 https://youtu.be/AdHE5Nss4HI?si=b4Et34pHKx8p1uP9 Looks like he just used some public WiFi to remain anonymous and forged NYPD fax number to make it more legit haha. Have to rewatch this show.
- 2-718-281-828 3y agowhen i had to liquidate my mother's life i found it sometimes rather scary how much harm you can potentially cause by forging two simple pieces of paper featuring signatures noone can verify and some stamp (death and heirship certs) often just a scan or photography by email or being nice on the phone is all that it takes to do pretty much anything. only few things like closing bank accounts sometimes require personal presence and authentication by id. you just need to know what some piece of paper looks like and the world lies at your feet.
- unforgivenpasta 3y agoIt is! This video is a bit old now but it's still so unbelievable how easy it was for the speaker to "kill" people (in Australia) https://www.youtube.com/watch?v=9FdHq3WfJgs https://www.youtube.com/watch?v=9FdHq3WfJgs
- the_common_man 3y agoThe incompetence is astounding
- treffer 3y agoIt is very common that these things get faked. Especially combined with: urgency (matter of life & death), referenceng laws/penalty if not handled (quickly), reference to kaws/penalties if disclosed. Now some poor lawyer has to figure out what to do. Now just heavily increase what you I.agine the scale to be. Those revealed cases are just the tip of the iceberg. As much as I would like to blame Verizon or any other entity: I think the key point is that the way these warrants get handled is totally unsuitable for the internet age. Forgery is usually a crime. So sending a warrant (via paper mail) through a country is sorta safe as you can start chasing the criminals, especially through return addresses. This all changes on the internet. Someone in a different country or a mostly anonymous person can forge and send these warrents at close to zero costs. Enough police stations got hacked to get realistic templates (and sometimes even direct e-mail access). The whole cost/benefit/risk relation shifted in favor of the attacker. And it doesn't help that most countries want to fast-track these requests even more.
- DrNosferatu 3y agoDoesn’t a company the size of Verizon have specific procedures to reply to law enforcement requests?
- naikrovek 3y agoI wonder if those court orders go to an outsourced team. the lack of an eye for such details used to make me immediately think an overworked team in India or the Philippines was responsible, but now I'm not so sure.
- crotchfire 3y ago> Glauner and the victim met in August or September 2023 on xhamster.com, a porn website with dating features wat. on multiple levels. wat. wat. wat.
- mensetmanusman 3y agoIt's going to be an interesting future where AI will let criminals have incredible skill faking all aspects of scams like this. the forms, the fake law school, the fake school website, the fake law website, fake reviews, etc. It will take more and more resources to verify minor things.x