4 ms·

Well warrants let them bypass physical security why would digital security be exempt?

by asdfaoeu 12y ago

canjobear 12y ago
The claim is that they did this before getting a warrant.
- deleted 12y ago
  [deleted]
- mpyne 12y ago
  Which they could easily claim as being incidental to gathering the evidence needed to obtain the probable cause that is mandatory for a warrant. CFAA talks about "unauthorized access", not about any "unwanted" interaction with a computer. Though I think FBI will simply claims that the steps used at that stage of the investigation were implicitly permitted by the fact that it was conducted for a lawful government purpose (there's some fancy legal term for this, but I forget what it is), and wasn't otherwise forbidden to the government since it didn't involve a search or seizure. If accepted, that would mean that J. Random Hacker doesn't get to mess around with websites just because the FBI got to, even in situations short of CFAA violations.
  - maxerickson 12y ago
    I can't imagine there was anything between the FBI and site that established a context for them to be attempting to access a user on the system that they had not created. So I hope they are relying on some investigative authority and not some hairsplitting definition of unauthorized. edit: I guess they could have been providing incorrect passwords for an account that they created. I agree that is easier to call unwanted.
    - mpyne 12y ago
      Reading the Krebs story on this same topic (http://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-leaky-captcha/ http://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-leak...), it occurs to me that FBI may not have needed to try to authenticate at all. Basically all the analyst said he did was to load the SR website far enough until the captcha popped up, and notice in the wireshark (or equivalent) logs that a non-Tor IP address was reached from the SR website. If the analyst tooled around on the website after that, then even if the court were to call foul on that subsequent access, the public IP address wasn't derived from tooling around so it (and the evidence derived from that) wouldn't be at risk either.
      - tP5n 12y ago
        this seems plausible, yet there must've been thousands of attempts of people doing sql injections/looking at their logs? if i remember correctly an error page leaked an ip in 2012/2013. someone had to realize the captcha was leaking at some point? consider me confused ;)

Well warrants let them bypass physical security why would digital security be exempt?

canjobear 12y ago

The claim is that they did this before getting a warrant.

deleted 12y ago
[deleted]
mpyne 12y ago
Which they could easily claim as being incidental to gathering the evidence needed to obtain the probable cause that is mandatory for a warrant. CFAA talks about "unauthorized access", not about any "unwanted" interaction with a computer. Though I think FBI will simply claims that the steps used at that stage of the investigation were implicitly permitted by the fact that it was conducted for a lawful government purpose (there's some fancy legal term for this, but I forget what it is), and wasn't otherwise forbidden to the government since it didn't involve a search or seizure. If accepted, that would mean that J. Random Hacker doesn't get to mess around with websites just because the FBI got to, even in situations short of CFAA violations.
- maxerickson 12y ago
  I can't imagine there was anything between the FBI and site that established a context for them to be attempting to access a user on the system that they had not created. So I hope they are relying on some investigative authority and not some hairsplitting definition of unauthorized. edit: I guess they could have been providing incorrect passwords for an account that they created. I agree that is easier to call unwanted.
  - mpyne 12y ago
    Reading the Krebs story on this same topic (http://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-leaky-captcha/ http://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-leak...), it occurs to me that FBI may not have needed to try to authenticate at all. Basically all the analyst said he did was to load the SR website far enough until the captcha popped up, and notice in the wireshark (or equivalent) logs that a non-Tor IP address was reached from the SR website. If the analyst tooled around on the website after that, then even if the court were to call foul on that subsequent access, the public IP address wasn't derived from tooling around so it (and the evidence derived from that) wouldn't be at risk either.
    - tP5n 12y ago
      this seems plausible, yet there must've been thousands of attempts of people doing sql injections/looking at their logs? if i remember correctly an error page leaked an ip in 2012/2013. someone had to realize the captcha was leaking at some point? consider me confused ;)