8 ms·

Lawyer representing whistle blowers finds malware on drive supplied by cops

197 points by aestetix 12y ago

hurin 12y ago
"The allegations submitted for review appear to be limited to misdemeanor violations which do not rise to a threshold for assigning a case to the CID Special Investigations Unit," the commander of the CID wrote in a September 29 letter declining the request. I guess felony hacking charges are only for teenagers changing desktop backgrounds.
- rsync 12y ago
  When crimes are committed by law enforcement, the penalties should be higher than for non-LEO.
  - winter_blue 12y ago
    That would be ideal and would hold LEOs to higher standard, but in reality, the exact opposite happens.
    - spiritplumber 12y ago
      I wonder if codifying this in law specifically would counteract what happens in reality (DA's operating by creationist logic when the perp is of Blue ethnicity).
joshuapants 12y ago
Good thing they weren't complacent and they had the drive checked. It's appalling that this came from a police department, but it could happen with any drive someone gives you, accidentally or maliciously. What's the best way to counteract this? Only plug foreign drives into a dedicated computer, probably running Linux, so you can scan it and copy the files you need before letting them touch other machines?
- xai3luGi 12y ago
  Linux isn't necessarily immune to USB malware. There are a lot of drivers for USB devices in Linux and any of them could have a bug. For example people only recently started doing fuzzing on filesystem drivers.
  - nkozyra 12y ago
    Absolutely. You want something ephemeral - meaning software AND hardware you can nuke. And even that isn't 100%. What's demonstrated in this article is extremely inelegant and clumsy. Truly malicious rootkits and the like are a bit more sophisticated.
- analog31 12y ago
  Nowadays I check any drive that's been out of my house, after my spouse brought a virus home from her workplace. A dedicated Linux box, a quick booting distro on a trusted flash drive, or even a Raspberry Pi can be used for this purpose.
  - morganvachon 12y ago
    I would second the Raspberry Pi, it would be more or less immune to malware that targets x86 land, even Linux based malware. Still, I'd not have it connected to the network and I would wipe the Pi's SD card afterward, just to be sure. Scripts can run on any architecture. The Pi doesn't have a BIOS or EFI on board, it uses a special partition on the SD card to POST from, so there's no worry of the device itself being infected.
    - matteotom 12y ago
      In that case, you might be better off using a MIPS based device (old router, maybe?), since ARM is gaining popularity.
      - kbenson 12y ago
        From what I've heard recently, targetting ARM may be problematic because two ARM processors may not support the same features, or function the same way. Then again, maybe there's a low-end subset of ARM instructions that should work an any chip, similar to the instruction set for the i386?
PebblesHD 12y ago
hear fucking hear EDIT: Ahh yes, downvoted for agreeing. Fantastic guys!
- bhayden 12y ago
  To clarify, you probably got downvoted because it doesn't contribute anything. We have upvotes for agreement.
  - PebblesHD 12y ago
    Fair enough, perhaps upvotes should be visible. Thanks
    - bhayden 12y ago
      I think it's a deliberate choice on HN to not have it because it promotes hive-mind behavior/opinions. You can see your own comment's points for kicks though.
      - URSpider94 12y ago
        Comment rankings used to be visible, but were removed. I have a feeling there's a discussion in the archives somewhere about the reasoning.
      - newuser88273 12y ago
        Under that assumption, upvote should not be a way to voice agreement, as that implies that downvote is disagreement. But downvote leads to graying-out and disappearance, which is just perfect to induce the hive mind. And yes, downvoting into oblivion articulate comments not at all devoid of content really has become endemic here, and many (though certainly not all) of those I read anyway were obviously downvoted for disagreement, often political. The result is a strong hive mind at HN. (I've seen seen that opinion on HN voiced outside of HN more than once.)
        12y ago
readams 12y ago
There are quite a few ways that this sort of software could be on the drive without malicious intent by the police department. This article is pretty light on details but it doesn't sound like anyone has actually examined these drives to determine this. Some possibilities: * if the police computer was itself infected and the malware was trying to propagate * The data was copied from a drive or computer that was infected
- TehCorwiz 12y ago
  The article points out that the police claim to have "real-time AV protection." And it would probably have passed through a police computer at least once, I doubt they'd be booting into a seized hard-drive.
  - readams 12y ago
    Those of use in the AV industry know that in practice AV software misses a lot of stuff, and updates need to be deployed properly as well. It's quite possible that AV software was installed but failed to catch this infection.
    - userbinator 12y ago
      False positives are also a problem. In particular, there are stories of "Hello World" programs being detected as malicious.
    - TehCorwiz 12y ago
      What you say is generally true. But we know that the lawyer's AV caught it. I have trouble believing that a law firm has better IT than a police digital forensic group. I guess one way of determining if it would have been caught by outdated or marginal AV software would be to figure out when the variants mentioned in the article were identified and added to most AV DBs. A project for another day perhaps.
- Nikker 12y ago
  If the malware came from the Police computers then wouldn't that likely taint all the data supplied, to well everyone? Every defendant for at least the last year will be taking a shot at this and why not?
anupshinde 12y ago
"Says police department brass tried to infect him, seeks criminal sanctions." First, the lawyer most likely found the malware via an anti-virus software and did not detect a new malware specifically targeted to him. Second, the police probably used the drive at an unsafe machine. Is it only me who finds this illogical nonsense? It sounds like if I get a "real world" infection like xyz flu - I have the right to seek criminal action against the person who got me that infection.
- deleted 12y ago
  [deleted]
- Terr_ 12y ago
  One big difference is that an innocent policeman infected with the flu is not put under the secret mental domination of a criminal puppetmaster. Even if you give the police the benefit of the doubt and assume zero malicious intent, the fact that malware appeared on the drive suggests either: (A) Mishandling of evidence by cycling it through an insecure/unofficial system. (B) Official systems have been pwned, and they are no longer trustworthy!
- FireBeyond 12y ago
  No, an independent forensic expert who received the drive found the malware. And the malware was inside a folder that had been created on the drive called "Bates Court Order". Meaning that the drive wasn't infected already, but somehow -after- the folder copying all the documents for discovery onto there, these several different pieces of malware all decided the best place to load themselves onto this drive was in this particular folder.
username223 12y ago
"Never attribute to malice that which is adequately explained by stupidity." My guess is that one of the police computers is infected, but it shouldn't be too hard to install this malware on a VM and see where it phones home.
- adventured 12y ago
  It's a worthless phrase unless you have some understanding of the likelihood of malice based on whom you're dealing with. If you're dealing with malicious people, then that phrase completely loses its already low value.
rpo3po 12y ago
At this point, there is absolutely no evidence, beyond the defense attorney's claim, that the malicious software neither existed prior to him handing it over to the police department, nor that it was installed after the fact, by the defense attorney. It is just as likely that, in either of those possibilities, this is a self-inflicted attempt by the defense attorney to discredit the police. Arstechnica, and every comment that I've read, both there and here on YC, reach conclusions based on a potentially, and just-as-likely-false, premise: that the act of the software installation occurred as a result of some action or inaction of the police. False premise = potentially false conclusion. Brains, people, brains. Use them, please.
- hurin 12y ago
  Maybe the Arstechnica article is biased towards the defense attorney's side of the story - but I definitely don't see the primary issue here as being law enforcement officers installed said software (as you pointed out, this is yet an unproven hypothesis - though quite a likely one perhaps). At least for me the substantiated and proven issue is that the CID Special Investigations Unit refused to investigate whether such a thing occurred. > Brains, people, brains. Use them, please. Adding insults to your comment does not make for a better discussion.
  - rpo3po 12y ago
    Is it an insult or a plea for reasoning? No, I have a Bachelor's degree in CJ, but outside of that, if the primary issue is the determination to pursue charges, then what happens if there are no actions which precipitate charges?
    - rpo3po 12y ago
      And, potentially biased, from the Arstechnica side?? That's an understatement, to say the least. I can say, with a fair amount of certainty, that nearly every, if not every writer on the Arstechnica payroll, is absolutely biased toward the defense side, in this case, and just about every other one. Scrape their site and return the pro-law enforcement vs negative-law enforcement articles, and there will absolutely be an enormous bias present.
jqm 12y ago
I'm having a hard time picturing a local police department in Arkansas having the technical skills needed to make use of this malware. But maybe they paid someone. Or it's a false flag. Who knows.
- bob-2 12y ago
  That's assuming they're working alone for their own intent. Given how federal government agencies are responding to FOIA requests to local police departments regarding stingray operations, it wouldn't be completely ridiculous to consider they had help/orders from federal agents. That's just speculation, but it's possible.
beedogs 12y ago
It's no surprise that cops are criminals. They're the only taxpayer-funded gang.
joshuak 12y ago
It seems from what I've read that this event goes to `chain of custody`, and by nicicacity invalidates ALL digital evidence for EVERY case handled by this police office unless provenance can be reliably established beyond all doubt, and that provenance can be proven not to effect 'original' copies in this or other cases. It is a catastrophic failure of procedure, that invalidates this, and possibly all copies of this evidence causing it to be judged inadmissible. From wikipedia[1]: When evidence can be used in court to convict persons of crimes, it must be handled in a scrupulously careful manner to prevent tampering or contamination. The idea behind recording the chain of custody is to establish that the alleged evidence is in fact related to the alleged crime, rather than having, for example, been “planted” fraudulently to make someone appear guilty. Regarding other comments in this thread about law enforcement being held to a higher standard, they would be. The higher standard is that when they fail to follow proper procedure like this, the effect is the evidence (and often the entire case) is summerly dismissed, and the defendant cannot be tried again for the same crime. the entire US legal system has this built in bias. Whereas a defendant in a similar position of supplying discovery documents would not be held to the same standard risking summery judgement, and might be able to provide replacement copies for discovery, and continue with the definse more or less normally. 1: http://en.wikipedia.org/wiki/Chain_of_custody http://en.wikipedia.org/wiki/Chain_of_custody
calgoo 12y ago
"the district doesn't have the technical resources to conduct such a probe" I love how they dont have resources for this, but if the plaintiff happens to speak some International language for which they dont have a translator, they fly one in from wherever they are available and pay them huge amounts of money for maybe 2 hours of work (I know its a but more complicated then that, but its still resources), but you cant dedicate a few thousands to verify the how the stuff got on to the hard drive. [1] Corrected spelling etc: Need more coffee
- mapt 12y ago
  So... The FBI might have such resources? A whole department of dirty cops attempting to obstruct justice using cybercrime (their remit) being... a big target. Police officers take oaths to protect the public on behalf of the US federal & state governments, and to uphold the Constitution. Breaking these oaths and abusing the power they are granted for personal gain or to cover up things that occurred on duty is, to be blunt, treason. It's easy to be a bad police officer who deserves to be fired for egregious negligence or excessive force or poor performance, but premeditated attempts to protect their own from the justice system represent the worst sort of insurrection this country can realistically face. I don't see why a terrorist or a Soviet spy should receive one sentence, and an officer running a corrupt police department should receive another: They are all trying to overthrow our functioning government. Did that happen here? I don't have any idea. But when internal affairs ceases to act aggressively to investigate this sort of thing, it casts the entire department's fidelity into doubt.

197 points by aestetix 12y ago

hurin 12y ago

"The allegations submitted for review appear to be limited to misdemeanor violations which do not rise to a threshold for assigning a case to the CID Special Investigations Unit," the commander of the CID wrote in a September 29 letter declining the request. I guess felony hacking charges are only for teenagers changing desktop backgrounds.

rsync 12y ago
When crimes are committed by law enforcement, the penalties should be higher than for non-LEO.
- winter_blue 12y ago
  That would be ideal and would hold LEOs to higher standard, but in reality, the exact opposite happens.
  - spiritplumber 12y ago
    I wonder if codifying this in law specifically would counteract what happens in reality (DA's operating by creationist logic when the perp is of Blue ethnicity).

joshuapants 12y ago

Good thing they weren't complacent and they had the drive checked. It's appalling that this came from a police department, but it could happen with any drive someone gives you, accidentally or maliciously. What's the best way to counteract this? Only plug foreign drives into a dedicated computer, probably running Linux, so you can scan it and copy the files you need before letting them touch other machines?

xai3luGi 12y ago
Linux isn't necessarily immune to USB malware. There are a lot of drivers for USB devices in Linux and any of them could have a bug. For example people only recently started doing fuzzing on filesystem drivers.
- nkozyra 12y ago
  Absolutely. You want something ephemeral - meaning software AND hardware you can nuke. And even that isn't 100%. What's demonstrated in this article is extremely inelegant and clumsy. Truly malicious rootkits and the like are a bit more sophisticated.
analog31 12y ago
Nowadays I check any drive that's been out of my house, after my spouse brought a virus home from her workplace. A dedicated Linux box, a quick booting distro on a trusted flash drive, or even a Raspberry Pi can be used for this purpose.
- morganvachon 12y ago
  I would second the Raspberry Pi, it would be more or less immune to malware that targets x86 land, even Linux based malware. Still, I'd not have it connected to the network and I would wipe the Pi's SD card afterward, just to be sure. Scripts can run on any architecture. The Pi doesn't have a BIOS or EFI on board, it uses a special partition on the SD card to POST from, so there's no worry of the device itself being infected.
  - matteotom 12y ago
    In that case, you might be better off using a MIPS based device (old router, maybe?), since ARM is gaining popularity.
    - kbenson 12y ago
      From what I've heard recently, targetting ARM may be problematic because two ARM processors may not support the same features, or function the same way. Then again, maybe there's a low-end subset of ARM instructions that should work an any chip, similar to the instruction set for the i386?

PebblesHD 12y ago

hear fucking hear EDIT: Ahh yes, downvoted for agreeing. Fantastic guys!

bhayden 12y ago
To clarify, you probably got downvoted because it doesn't contribute anything. We have upvotes for agreement.
- PebblesHD 12y ago
  Fair enough, perhaps upvotes should be visible. Thanks
  - bhayden 12y ago
    I think it's a deliberate choice on HN to not have it because it promotes hive-mind behavior/opinions. You can see your own comment's points for kicks though.
    - URSpider94 12y ago
      Comment rankings used to be visible, but were removed. I have a feeling there's a discussion in the archives somewhere about the reasoning.
    - newuser88273 12y ago
      Under that assumption, upvote should not be a way to voice agreement, as that implies that downvote is disagreement. But downvote leads to graying-out and disappearance, which is just perfect to induce the hive mind. And yes, downvoting into oblivion articulate comments not at all devoid of content really has become endemic here, and many (though certainly not all) of those I read anyway were obviously downvoted for disagreement, often political. The result is a strong hive mind at HN. (I've seen seen that opinion on HN voiced outside of HN more than once.)
      - 12y ago

readams 12y ago

There are quite a few ways that this sort of software could be on the drive without malicious intent by the police department. This article is pretty light on details but it doesn't sound like anyone has actually examined these drives to determine this. Some possibilities: * if the police computer was itself infected and the malware was trying to propagate * The data was copied from a drive or computer that was infected

TehCorwiz 12y ago
The article points out that the police claim to have "real-time AV protection." And it would probably have passed through a police computer at least once, I doubt they'd be booting into a seized hard-drive.
- readams 12y ago
  Those of use in the AV industry know that in practice AV software misses a lot of stuff, and updates need to be deployed properly as well. It's quite possible that AV software was installed but failed to catch this infection.
  - userbinator 12y ago
    False positives are also a problem. In particular, there are stories of "Hello World" programs being detected as malicious.
  - TehCorwiz 12y ago
    What you say is generally true. But we know that the lawyer's AV caught it. I have trouble believing that a law firm has better IT than a police digital forensic group. I guess one way of determining if it would have been caught by outdated or marginal AV software would be to figure out when the variants mentioned in the article were identified and added to most AV DBs. A project for another day perhaps.
Nikker 12y ago
If the malware came from the Police computers then wouldn't that likely taint all the data supplied, to well everyone? Every defendant for at least the last year will be taking a shot at this and why not?

anupshinde 12y ago

"Says police department brass tried to infect him, seeks criminal sanctions." First, the lawyer most likely found the malware via an anti-virus software and did not detect a new malware specifically targeted to him. Second, the police probably used the drive at an unsafe machine. Is it only me who finds this illogical nonsense? It sounds like if I get a "real world" infection like xyz flu - I have the right to seek criminal action against the person who got me that infection.

deleted 12y ago
[deleted]
Terr_ 12y ago
One big difference is that an innocent policeman infected with the flu is not put under the secret mental domination of a criminal puppetmaster. Even if you give the police the benefit of the doubt and assume zero malicious intent, the fact that malware appeared on the drive suggests either: (A) Mishandling of evidence by cycling it through an insecure/unofficial system. (B) Official systems have been pwned, and they are no longer trustworthy!
FireBeyond 12y ago
No, an independent forensic expert who received the drive found the malware. And the malware was inside a folder that had been created on the drive called "Bates Court Order". Meaning that the drive wasn't infected already, but somehow -after- the folder copying all the documents for discovery onto there, these several different pieces of malware all decided the best place to load themselves onto this drive was in this particular folder.

username223 12y ago

"Never attribute to malice that which is adequately explained by stupidity." My guess is that one of the police computers is infected, but it shouldn't be too hard to install this malware on a VM and see where it phones home.

adventured 12y ago
It's a worthless phrase unless you have some understanding of the likelihood of malice based on whom you're dealing with. If you're dealing with malicious people, then that phrase completely loses its already low value.

rpo3po 12y ago

At this point, there is absolutely no evidence, beyond the defense attorney's claim, that the malicious software neither existed prior to him handing it over to the police department, nor that it was installed after the fact, by the defense attorney. It is just as likely that, in either of those possibilities, this is a self-inflicted attempt by the defense attorney to discredit the police. Arstechnica, and every comment that I've read, both there and here on YC, reach conclusions based on a potentially, and just-as-likely-false, premise: that the act of the software installation occurred as a result of some action or inaction of the police. False premise = potentially false conclusion. Brains, people, brains. Use them, please.

hurin 12y ago
Maybe the Arstechnica article is biased towards the defense attorney's side of the story - but I definitely don't see the primary issue here as being law enforcement officers installed said software (as you pointed out, this is yet an unproven hypothesis - though quite a likely one perhaps). At least for me the substantiated and proven issue is that the CID Special Investigations Unit refused to investigate whether such a thing occurred. > Brains, people, brains. Use them, please. Adding insults to your comment does not make for a better discussion.
- rpo3po 12y ago
  Is it an insult or a plea for reasoning? No, I have a Bachelor's degree in CJ, but outside of that, if the primary issue is the determination to pursue charges, then what happens if there are no actions which precipitate charges?
  - rpo3po 12y ago
    And, potentially biased, from the Arstechnica side?? That's an understatement, to say the least. I can say, with a fair amount of certainty, that nearly every, if not every writer on the Arstechnica payroll, is absolutely biased toward the defense side, in this case, and just about every other one. Scrape their site and return the pro-law enforcement vs negative-law enforcement articles, and there will absolutely be an enormous bias present.

jqm 12y ago

I'm having a hard time picturing a local police department in Arkansas having the technical skills needed to make use of this malware. But maybe they paid someone. Or it's a false flag. Who knows.

bob-2 12y ago
That's assuming they're working alone for their own intent. Given how federal government agencies are responding to FOIA requests to local police departments regarding stingray operations, it wouldn't be completely ridiculous to consider they had help/orders from federal agents. That's just speculation, but it's possible.

beedogs 12y ago

It's no surprise that cops are criminals. They're the only taxpayer-funded gang.

joshuak 12y ago

It seems from what I've read that this event goes to `chain of custody`, and by nicicacity invalidates ALL digital evidence for EVERY case handled by this police office unless provenance can be reliably established beyond all doubt, and that provenance can be proven not to effect 'original' copies in this or other cases. It is a catastrophic failure of procedure, that invalidates this, and possibly all copies of this evidence causing it to be judged inadmissible. From wikipedia[1]: When evidence can be used in court to convict persons of crimes, it must be handled in a scrupulously careful manner to prevent tampering or contamination. The idea behind recording the chain of custody is to establish that the alleged evidence is in fact related to the alleged crime, rather than having, for example, been “planted” fraudulently to make someone appear guilty. Regarding other comments in this thread about law enforcement being held to a higher standard, they would be. The higher standard is that when they fail to follow proper procedure like this, the effect is the evidence (and often the entire case) is summerly dismissed, and the defendant cannot be tried again for the same crime. the entire US legal system has this built in bias. Whereas a defendant in a similar position of supplying discovery documents would not be held to the same standard risking summery judgement, and might be able to provide replacement copies for discovery, and continue with the definse more or less normally. 1: http://en.wikipedia.org/wiki/Chain_of_custody http://en.wikipedia.org/wiki/Chain_of_custody

calgoo 12y ago

"the district doesn't have the technical resources to conduct such a probe" I love how they dont have resources for this, but if the plaintiff happens to speak some International language for which they dont have a translator, they fly one in from wherever they are available and pay them huge amounts of money for maybe 2 hours of work (I know its a but more complicated then that, but its still resources), but you cant dedicate a few thousands to verify the how the stuff got on to the hard drive. [1] Corrected spelling etc: Need more coffee

mapt 12y ago
So... The FBI might have such resources? A whole department of dirty cops attempting to obstruct justice using cybercrime (their remit) being... a big target. Police officers take oaths to protect the public on behalf of the US federal & state governments, and to uphold the Constitution. Breaking these oaths and abusing the power they are granted for personal gain or to cover up things that occurred on duty is, to be blunt, treason. It's easy to be a bad police officer who deserves to be fired for egregious negligence or excessive force or poor performance, but premeditated attempts to protect their own from the justice system represent the worst sort of insurrection this country can realistically face. I don't see why a terrorist or a Soviet spy should receive one sentence, and an officer running a corrupt police department should receive another: They are all trying to overthrow our functioning government. Did that happen here? I don't have any idea. But when internal affairs ceases to act aggressively to investigate this sort of thing, it casts the entire department's fidelity into doubt.