Usr6 Posted April 25, 2017 Report Posted April 25, 2017 Judge authorized order allowing US to change data in thousands of infected devices. Mass hacking seems to be all the rage currently. A vigilante hacker apparently slipped secure code into vulnerable cameras and other insecure networked objects in the "Internet of Things" so that bad guys can't corral those devices into an army of zombie computers, like what happened with the record-breaking Mirai denial-of-service botnet. The Homeland Security Department issued alerts with instructions for fending off similar “Brickerbot malware,” so-named because it bricks IoT devices. And perhaps most unusual, the FBI recently obtained a single warrant in Alaska to hack the computers of thousands of victims in a bid to free them from the global botnet, Kelihos. On April 5, Deborah M. Smith, chief magistrate judge of the US District Court in Alaska, greenlighted this first use of a controversial court order. Critics have since likened it to a license for mass hacking. The FBI sought the 30-day warrant to liberate victims through a new procedural rule change that took effect in December amid worries among privacy advocates that the update would open a new door for government abuse. But the first use of the amendments to Rule 41 of the Federal Rules of Criminal Procedure has assuaged fears, at least for the moment, because the feds used their power to kill a botnet. The Electronic Frontier Foundation, for example, commended the feds for asking a judge to review exactly what data the FBI would and would not touch in victimized devices, which were located across the country. It was a "positive step" toward accountability and transparency in FBI computer break-ins, EFF staff attorney Andrew Crocker said. This wasn't the first time the government has gained permission from a federal court to jump in and clean infected computers worldwide. To dismantle Gameover Zeus, once considered the most damaging botnet, the US obtained civil and criminal court orders in federal court in Pittsburgh "authorizing measures to redirect the automated requests by victim computers for additional instructions away from the criminal operators to substitute servers," as well as "to collect dialing, routing, addressing and signaling ("DRAS") information from the infected computers," Justice Department officials said at the time in 2014. For Kelihos, the feds needed stronger legal standing to free hostage computers because of the peer-to-peer nature of the infection, which demanded more "active measures," says John Bambenek, a manager at Fidelis Cybersecurity who's helping with the botnet cleanup. The FBI "had to infect machines," convert them into so-called supernodes that distribute connection lists to other victimized computers, and then "poison" all the computers so they would never again try to communicate with hacker-controlled devices, said Bambenek, who also assisted on the 2014 Gameover Zeus cleansing operation. With the Gameover Zeus botnet, the government wasn't modifying someone else’s computer. It was taking over malicious domains the computers were communicating with, he said. With Kelihos, "we were in essence actually changing data," and the Justice Department reasoned that this required the government to assert Rule 41, according to Bambenek. Often, the feds “use uncertainty as an excuse, or cover, for not getting a warrant," Crocker said. This time, "the government was proceeding with a lot more caution than in some of the other cases." He pointed to the government's warrantless use of secretive cellphone "Stingray" tracking equipment that continued for many years until the Justice Department released a seven-page legal use policy in 2015. But concerns remain that authorities might abuse the rule revisions, which empower judges to grant a single warrant for searching or seizing information on any number of devices, regardless of location. To kill Kelihos The Rule 41 reboot is the judicial branch’s acceptance of the reality that the Internet has no borders, and criminals increasingly are hiding their whereabouts through digital obfuscation. Authorities had complained that legal ambiguity, as well as the process of obtaining multiple warrants to probe far-flung devices, were hampering efforts to dismantle botnets like Gameover Zeus and to unmask child pornography users. (Last month, prosecutors in Washington state dropped all charges against a child porn suspect rather than disclose the pre-Rule 41 inner workings of classified intrusion tools that federal investigators used to hack Playpen, a now-shuttered underage exploitation website.) "The law more generally has not really grappled with government hacking, and this is one of the more explicit references to this kind of activity by the government," Crocker said. The government says the FBI and hired cybersleuths did not view the contents of any of the machines infected by Kelihos, which spammed e-mail inboxes, stole banking credentials, and dispersed malware all over the Web. The government did collect each victim's IP address and "non-content" routing and signaling information so that Internet Service Providers could notify the victims, the Justice Department said. What's more, this month’s court order limits the FBI’s interaction with victimized machines to commands that block an infected computer from performing malicious activities and communicating with other devices in the botnet. In addition, it prohibits the government from seizing contents inside the victim's device and interrupting Internet access. Meanwhile, some criminal defense attorneys say Rule 41 could be enhanced to clearly spell out safeguards for civil liberties during bulk hacks by the government, similar to those imposed for wiretapping in the late 1960s. "Right now for lack of that kind of control, it will be easier to attack these searches” of personal devices as inadmissible during a trial, because lawmakers have not carefully considered privacy protections, said Peter Goldberger, chair of the National Association of Criminal Defense Lawyers Rules of Procedure Committee. The department announced last week that it had fingered Pyotr Levashov as the alleged operator of the Kelihos botnet. The Russian was indicted by a federal grand jury in Bridgeport, Connecticut. Sursa: https://arstechnica.com/tech-policy/2017/04/fbi-allays-some-critics-with-first-use-of-new-mass-hacking-warrant/ 1 1 Quote
