4 ms·

Interesting summary from inside the article: "Just a week ago, our field offices in Charlotte, Indianapolis, Jacksonville, Los Angeles, and Cleveland worked wi

Interesting summary from inside the article: "Just a week ago, our field offices in Charlotte, Indianapolis, Jacksonville, Los Angeles, and Cleveland worked with the Defense Criminal Investigative Service and U.S. Secret Service—along with international partners from Denmark, France, Germany, and the Netherlands—to conduct a technical operation against four groups who offer malware as a service, in the first such operation ever conducted. That operation, Endgame, defeated multiple malware variants, took down more than 100 servers, and dismantled the infrastructure for four key pieces of global malware, which had been responsible for hundreds of millions of dollars in damages and had even compromised the critical-care online system a hospital needed to keep patients alive. "

deleted 2y ago
[deleted]
ttyyzz 2y ago
Yes, it also states: "[...] We should also remember that 85-90% of the most powerful cyber-threat intelligence lies in the hands of those other than the United States government, which brings me to a final point about partnerships: Not one of our past—or future—disruptions is possible without exceptional partnerships [...]." I didn't expect so much honesty, I would have expected "We and only we are the greatest and best".
- bloqs 2y ago
  I think this is not correct and perhaps a deliberate downplay. The US Govt theoretically and in many cases provably has backdoors in the very fabric of the internet itself, and has tendrils in products of many of the companies and entities responsible for everything from transistor to application. It is however, in the US govts interest to not present this, so as not to encourage people away from US tech.
  - qb1 2y ago
    You way over estimate the US gov. Those backdoors and tendrils exist because of individuals and groups that developed the features. This isn’t the Smoking Man. The partnerships delivered the boots on the ground resources to detain, arrest, and prosecute the criminals.
  - sigmoid10 2y ago
    This is different because it's not about espionage. The NSA can do tons of stuff that normal police forces can only dream about. But the NSA doesn't have to worry about courts or juries or even evidence. It's a totally different game when you want to crack down on criminals using the law vs dropping bombs on terrorists and military targets.
    - nextaccountic 2y ago
      There's this thing called parallel construction It works like this: NSA brings the illegal evidence, and agencies like FBI and DEA launders it, building a fake case that omits the illegal evidence but includes other evidence that were obtained from it, rewriting history to make it seem like the investigation never ever used illegal means. It's like git rebase, but for criminal investigations. https://en.wikipedia.org/wiki/Parallel_construction#By_the_United_States_Drug_Enforcement_Administration https://en.wikipedia.org/wiki/Parallel_construction#By_the_U...
      - _djo_ 2y ago
        While parallel construction is usually dodgy as hell, it still requires that there be sufficient evidence obtainable through legal means to build a case. It's kind of like a journalist getting information off the record from a source. They can't use that for a story, and the only way they can write about it is if they can find enough on the record or on background sourcing or data to be able to back it up.
- oliv__ 2y ago
  They didn't say they weren't the best, they only said that the intelligence lied in other hands.
- VoodooJuJu 2y ago
  The only way I can see one expecting "We and only we are the greatest and best" sentiment is if one has been marinating in the "America Bad" online misinformation trend.
- shapefrog 2y ago
  They are (subtly) saying cyber criminals are all from / in other countries.
cvoss 2y ago
At first I was puzzled to see the Secret Service was involved. I have just learned that the Secret Service's other (and original) mission is to protect the security of the US financial system. When they were founded in 1865 (ironically, the day Lincoln was assassinated) their job was stopping counterfeiters. Protection of high profile officials came later, beginning in 1901. [0] [0] https://en.m.wikipedia.org/wiki/United_States_Secret_Service https://en.m.wikipedia.org/wiki/United_States_Secret_Service
nonrandomstring 2y ago
Maybe it's buried in the details and I missed it, but this is not the first time the FBI cracked a ransomware operation, but the real story is they got the keys and in the past they've just published them. ("FBI urges ransomware victims to reach out"). This is how you do law enforcement. Win hearts and minds with practical redress. Otherwise you're just cutting heads of a hydra - which is what silly plans for social media client-side scanning will only ever be able to do. So the last time, I ended up researching it for a Cybershow episode (sorry dang :) and got down dark rabbit holes like these ones [0,1] and realised just how hard this is. It's not just infiltration, it's very stealthy, careful, long-term work. Getting right into the heart of the beast and getting all the stuff, off an airgapped machine! Imagine discovering a severe exploit with massive lateral impact and needing to do a delicate, intricate coordinated disclosure so that nobody gets tipped-off... and then cutting it at the root and bagging all the loot, That's gotta feel good. [0] https://www.wired.com/story/764-com-child-predator-network/ https://www.wired.com/story/764-com-child-predator-network/ [1] https://www.wired.com/story/tracers-in-the-dark-welcome-to-video-crypto-anonymity-myth/ https://www.wired.com/story/tracers-in-the-dark-welcome-to-v...
londons_explore 2y ago
> took down more than 100 servers Future malware will protect against this by making such takedowns too painful by reconfiguring victims systems to depend on the malware c&c server. Ie. transfer vital user data to the c&c server, such as disk encryption keys, then serve it back to the victims whenever needed. If the FBI takes down the c&c servers, suddenly all the victims suffer outages and data loss.
- kachnuv_ocasek 2y ago
  But why would FBI take the servers down then?

deleted 2y ago

[deleted]

ttyyzz 2y ago

Yes, it also states: "[...] We should also remember that 85-90% of the most powerful cyber-threat intelligence lies in the hands of those other than the United States government, which brings me to a final point about partnerships: Not one of our past—or future—disruptions is possible without exceptional partnerships [...]." I didn't expect so much honesty, I would have expected "We and only we are the greatest and best".

bloqs 2y ago
I think this is not correct and perhaps a deliberate downplay. The US Govt theoretically and in many cases provably has backdoors in the very fabric of the internet itself, and has tendrils in products of many of the companies and entities responsible for everything from transistor to application. It is however, in the US govts interest to not present this, so as not to encourage people away from US tech.
- qb1 2y ago
  You way over estimate the US gov. Those backdoors and tendrils exist because of individuals and groups that developed the features. This isn’t the Smoking Man. The partnerships delivered the boots on the ground resources to detain, arrest, and prosecute the criminals.
- sigmoid10 2y ago
  This is different because it's not about espionage. The NSA can do tons of stuff that normal police forces can only dream about. But the NSA doesn't have to worry about courts or juries or even evidence. It's a totally different game when you want to crack down on criminals using the law vs dropping bombs on terrorists and military targets.
  - nextaccountic 2y ago
    There's this thing called parallel construction It works like this: NSA brings the illegal evidence, and agencies like FBI and DEA launders it, building a fake case that omits the illegal evidence but includes other evidence that were obtained from it, rewriting history to make it seem like the investigation never ever used illegal means. It's like git rebase, but for criminal investigations. https://en.wikipedia.org/wiki/Parallel_construction#By_the_United_States_Drug_Enforcement_Administration https://en.wikipedia.org/wiki/Parallel_construction#By_the_U...
    - _djo_ 2y ago
      While parallel construction is usually dodgy as hell, it still requires that there be sufficient evidence obtainable through legal means to build a case. It's kind of like a journalist getting information off the record from a source. They can't use that for a story, and the only way they can write about it is if they can find enough on the record or on background sourcing or data to be able to back it up.
oliv__ 2y ago
They didn't say they weren't the best, they only said that the intelligence lied in other hands.
VoodooJuJu 2y ago
The only way I can see one expecting "We and only we are the greatest and best" sentiment is if one has been marinating in the "America Bad" online misinformation trend.
shapefrog 2y ago
They are (subtly) saying cyber criminals are all from / in other countries.

cvoss 2y ago

At first I was puzzled to see the Secret Service was involved. I have just learned that the Secret Service's other (and original) mission is to protect the security of the US financial system. When they were founded in 1865 (ironically, the day Lincoln was assassinated) their job was stopping counterfeiters. Protection of high profile officials came later, beginning in 1901. [0] [0] https://en.m.wikipedia.org/wiki/United_States_Secret_Service https://en.m.wikipedia.org/wiki/United_States_Secret_Service

nonrandomstring 2y ago

Maybe it's buried in the details and I missed it, but this is not the first time the FBI cracked a ransomware operation, but the real story is they got the keys and in the past they've just published them. ("FBI urges ransomware victims to reach out"). This is how you do law enforcement. Win hearts and minds with practical redress. Otherwise you're just cutting heads of a hydra - which is what silly plans for social media client-side scanning will only ever be able to do. So the last time, I ended up researching it for a Cybershow episode (sorry dang :) and got down dark rabbit holes like these ones [0,1] and realised just how hard this is. It's not just infiltration, it's very stealthy, careful, long-term work. Getting right into the heart of the beast and getting all the stuff, off an airgapped machine! Imagine discovering a severe exploit with massive lateral impact and needing to do a delicate, intricate coordinated disclosure so that nobody gets tipped-off... and then cutting it at the root and bagging all the loot, That's gotta feel good. [0] https://www.wired.com/story/764-com-child-predator-network/ https://www.wired.com/story/764-com-child-predator-network/ [1] https://www.wired.com/story/tracers-in-the-dark-welcome-to-video-crypto-anonymity-myth/ https://www.wired.com/story/tracers-in-the-dark-welcome-to-v...

londons_explore 2y ago

> took down more than 100 servers Future malware will protect against this by making such takedowns too painful by reconfiguring victims systems to depend on the malware c&c server. Ie. transfer vital user data to the c&c server, such as disk encryption keys, then serve it back to the victims whenever needed. If the FBI takes down the c&c servers, suddenly all the victims suffer outages and data loss.

kachnuv_ocasek 2y ago
But why would FBI take the servers down then?