8 ms·
FBI confirms it issued remote kill command to blow out Volt Typhoon's botnet
- bsimpson 3y agoThe headline makes it sound like they destroyed the equipment somehow. The article makes it sound like a bunch of consumer-grade routers were infected with Chinese malware, and that the FBI hacked into the hacked routers, logged the malware, and removed it.
- nightpool 3y agoIt really doesn't. The use of the word "blow out" might be a little sensationalist but nobody would expect it to mean destroying physical equipment, especially when that equipment is in a botnet (i.e. hacked devices that are presumably legitimately owned by someone)
- pimlottc 3y agoThe Register tends to the hyperbolic, it’s their style
- NoPicklez 3y agoThe article to me makes it sound like they removed the BotNet but didn't destroy the equipment
- deleted 3y ago[deleted]
- mschuster91 3y agoDisrupting the botnet is so far so good... but what actually needs to be done is that the ISPs need to be notified and the affected customers be disconnected from the Internet until they replace the compromised/out-of-life devices. Internet access is a privilege, and being a threat to others in this shared space should lead to said privilege being revoked until the threat is gone.
- kube-system 3y ago> what actually needs to be done is that the ISPs need to be notified and the affected customers be disconnected from the Internet until they replace the compromised/out-of-life devices. Yes, but a lot of the internet is on a shoe-string budget and managed by someone who DGAF, and connected to an ISP who also DGAF.
- mschuster91 3y agoYeah, and these people don't deserve to be on the Internet. We also don't let people run cars with bad exhaust stacks on the road, and if police spot violators, they get issued remediation orders.
- kube-system 3y agoThe world is a big place and a lot of it doesn't work like that. Global emissions enforcement is just about as good as global internet security enforcement. That's why the internet is full of malware and the earth is getting warmer.
- anigbrowl 3y agoMay I recommend 'How to win friends and influence people' instead of such naked user hostility.
- squigz 3y agoBecause it's the customers fault manufacturers sell insecure routers that go out of service 2 years later?
- candiddevmike 3y agoAt some point consumers need to become more computer savvy and responsible netzens.
- sgc 3y ago
- sam1r 3y ago>>> the FBI sent specific KV Botnet commands to compromised routers to collect "non-content information about those nodes. This must’ve been so fun for whomever individual(s) working on this from the FBI.
- 000ooo000 3y agoThis was my takeaway as well. What a cool job. Being government, I wonder if it's a super crusty/stuffy work enviroment with loads of paperwork and little autonomy or if this part of the org has a bit more of a laid back vibe.
- tru3_power 3y agoLol even red teaming has loads of paperwork/crusty stuffy work. You have to have a good paper trail of what you did for repudiation purposes. That’s just how it be.
- dikaio 3y agoNot exactly the same but should be mentioned. Chinese use real people’s personas for upwork, they contact people asking for them to create profiles under their names and get paid a percentage of income generated.
- bsimpson 3y agoI feel like your allegation is missing a subject. You're saying Chinese spies/hackers are duping real people to facilitate this botnet?
- dikaio 3y agoIt’s not an allegation it’s a fact. Also, the point of the subject wasn’t missed this is why I lead with “not exactly the same”. To provide a bit more clarity, these dev teams often request access to the users computer through teamviewer and similar or ask to have a full working device that they can login to as to work from so essentially they’re on the persons network with a device with full access to that network. My statement never suggest anything related to the botnet. Regarding hackers, yes devs of course could be potential hackers, likely.
- bsimpson 3y agoThe legal aspect of this is interesting. It seems like leaving bystanders alone and removing the threat (what the FBI did) is in everyone's best interests. Nobody wants to get dragged to court over an old Linksys. Still, this isn't a foreign warzone. These are devices that were presumably owned by Americans, working out of American homes. I wonder under what legal authority the FBI can hack into and modify American devices. What if they accidentally brick something? What if they find evidence of personal illegal activity?
- nine_k 3y agoI would say that it could be the same framework as for firefighters, or for a bomb squad. They may need to enter private property in order to protect it, or nearby areas, from an imminent threat. As such, they of course don't have a search warrant, but they have a license to locate and disable a source of threat: a fire, a bomb, a piece of highly radioactive material, etc. IANAL, of course.
- bredren 3y agoThey applied for and received a Search Warrant (5018) to cover all activity described in the article: >The FBI will identify a list of U.S.-based routers infected with the malware, as described in Attachment A. >The FBI seeks authorization under Federal Rule of Criminal Procedure 41(b)(6)(B) to remotely search those routers and seize the evidence and instrumentalities of the hackers' criminal offenses, as described in Attachment B. >As part of this search and seizure, the FBI will remove the malware from the infected routers and take limited, reversible steps to prevent re-infection. To GP’s questions, the scenarios would be handled as in any other search warrant. Though I’d presume this is rather unusual and to increase the likelihood of future approval, the agent would try to avoid stumbling into having to decide if some completely unrelated crime needs to be prosecuted. Aside from this, it’s intriguing that they state the changes they planned to make to the routers would be reversible. I wonder how practical this might be if needed, given potential shift in IP. Also, when, if ever the owners will be notified of the activity. This may be covered in one of the filings.
- 3y ago
- mkatx 3y agoOk.. I appreciate how the FBI assisted in cleaning our routers/ip's. But is this story possibly alluding to the fact that the FBI did NOT disclose the potential 0 days used in these attacks in accordance with responsibile disclosures, and instead is likely retaining these zero days for their own use?
- rasz 3y agoBecause those arent 0 days. Those routers/doorbells/fridges will never receive updates. I wonder if the OG Mirai minecraft server wars botnet hackers working for FBI now were part of this task force. Original story https://www.wired.com/story/mirai-botnet-minecraft-scam-brought-down-the-internet/ https://www.wired.com/story/mirai-botnet-minecraft-scam-brou... Fantastic follow up https://www.wired.com/story/mirai-untold-story-three-young-hackers-web-killing-monster/ https://www.wired.com/story/mirai-untold-story-three-young-h...
- mkatx 3y agoThanks for the follow up. Dunno if I missed it in the article, but I did not notice it specifying if the attack was via 0 day or not, that's why I speculated the possibility. Where did you read that they are not 0 days?
- notso411 3y ago[dead]
- tjpnz 3y agoAnd China will continue to face no consequences.