4 ms·

There are quite a few ways that this sort of software could be on the drive without malicious intent by the police department. This article is pretty light on

by readams 12y ago

There are quite a few ways that this sort of software could be on the drive without malicious intent by the police department. This article is pretty light on details but it doesn't sound like anyone has actually examined these drives to determine this. Some possibilities: * if the police computer was itself infected and the malware was trying to propagate * The data was copied from a drive or computer that was infected

TehCorwiz 12y ago
The article points out that the police claim to have "real-time AV protection." And it would probably have passed through a police computer at least once, I doubt they'd be booting into a seized hard-drive.
- readams 12y ago
  Those of use in the AV industry know that in practice AV software misses a lot of stuff, and updates need to be deployed properly as well. It's quite possible that AV software was installed but failed to catch this infection.
  - userbinator 12y ago
    False positives are also a problem. In particular, there are stories of "Hello World" programs being detected as malicious.
  - TehCorwiz 12y ago
    What you say is generally true. But we know that the lawyer's AV caught it. I have trouble believing that a law firm has better IT than a police digital forensic group. I guess one way of determining if it would have been caught by outdated or marginal AV software would be to figure out when the variants mentioned in the article were identified and added to most AV DBs. A project for another day perhaps.
Nikker 12y ago
If the malware came from the Police computers then wouldn't that likely taint all the data supplied, to well everyone? Every defendant for at least the last year will be taking a shot at this and why not?
- fiatmoney 12y ago
  Ding ding. There's really only 4 possibilities, and they're all significant. 1) PD is responsible, and intentionally infecting defense attorneys with malware. Major obstruction of justice. 2) PD is responsible, and has been hacked. At a minimum, all their computer evidence is tainted; who knows if someone has been using their access for ill as well. Access to police DBs is useful for all sorts of nefarious purposes. 3) Defense attorney has faked the whole thing. Noteworthy in its own right; defense attorneys are pretty used to losing as a matter of necessity so for one to go on some kind of intentional crusade against the local PD, especially in such a public and falsifiable way... No judge will sign off on criminal sanctions here without a thorough investigation, so this is extremely unlikely barring a psychotic break (which does happen now again, it's a high-stress job). 4) Defense attorney has been hacked. Who hacked him? Have any of his clients been affected? Is someone, perhaps a technically sophisticated someone, targeting defense attorneys?
  - stavrianos 12y ago
    That fourth one is the killer. Regardless of its truth or falsehood, it gives everyone an out because none of the interesting consequences of the first three have to happen. Perhaps the proper move would have been to surveil the malware without revealing that you know of it. Could prove/falsify #4, or implicate PD conclusively if #1.
pizza234 12y ago
Seems like a few people here didn't read the article in full: "Additionally, the placement of these trojans, all in the same sub-folder" All in the same directory! Whoever it was, he certainly was even tidy. Besides, we're talking about evidence here. Even if it was "just" the case of police computers infected with... three (three!) backdoors, that would be extremely serious.

by readams 12y ago

TehCorwiz 12y ago

The article points out that the police claim to have "real-time AV protection." And it would probably have passed through a police computer at least once, I doubt they'd be booting into a seized hard-drive.

readams 12y ago
Those of use in the AV industry know that in practice AV software misses a lot of stuff, and updates need to be deployed properly as well. It's quite possible that AV software was installed but failed to catch this infection.
- userbinator 12y ago
  False positives are also a problem. In particular, there are stories of "Hello World" programs being detected as malicious.
- TehCorwiz 12y ago
  What you say is generally true. But we know that the lawyer's AV caught it. I have trouble believing that a law firm has better IT than a police digital forensic group. I guess one way of determining if it would have been caught by outdated or marginal AV software would be to figure out when the variants mentioned in the article were identified and added to most AV DBs. A project for another day perhaps.

Nikker 12y ago

If the malware came from the Police computers then wouldn't that likely taint all the data supplied, to well everyone? Every defendant for at least the last year will be taking a shot at this and why not?

fiatmoney 12y ago
Ding ding. There's really only 4 possibilities, and they're all significant. 1) PD is responsible, and intentionally infecting defense attorneys with malware. Major obstruction of justice. 2) PD is responsible, and has been hacked. At a minimum, all their computer evidence is tainted; who knows if someone has been using their access for ill as well. Access to police DBs is useful for all sorts of nefarious purposes. 3) Defense attorney has faked the whole thing. Noteworthy in its own right; defense attorneys are pretty used to losing as a matter of necessity so for one to go on some kind of intentional crusade against the local PD, especially in such a public and falsifiable way... No judge will sign off on criminal sanctions here without a thorough investigation, so this is extremely unlikely barring a psychotic break (which does happen now again, it's a high-stress job). 4) Defense attorney has been hacked. Who hacked him? Have any of his clients been affected? Is someone, perhaps a technically sophisticated someone, targeting defense attorneys?
- stavrianos 12y ago
  That fourth one is the killer. Regardless of its truth or falsehood, it gives everyone an out because none of the interesting consequences of the first three have to happen. Perhaps the proper move would have been to surveil the malware without revealing that you know of it. Could prove/falsify #4, or implicate PD conclusively if #1.

pizza234 12y ago

Seems like a few people here didn't read the article in full: "Additionally, the placement of these trojans, all in the same sub-folder" All in the same directory! Whoever it was, he certainly was even tidy. Besides, we're talking about evidence here. Even if it was "just" the case of police computers infected with... three (three!) backdoors, that would be extremely serious.