> Earlier this year, the Mirai defendants worked with FBI agents in Alaska to counter a new evolution of DDoS, known as Memcache
what the heck?
> The Mirai court documents outline how Dalton, Jha, and White jumped into action in March as the attacks propagated online, working alongside the FBI and the security industry to identify vulnerable servers.
And scanning every IP for a port is how you trigger automatic abuse reports to whoever owns the IP block, and failure to respond to said abuse reports (and, more importantly, ceasing said abusive behavior) leads to eventually the attacker (the aforementioned government office) having their Internet service ended due to ToS violations.
Not only that, I suspect some ISPs now run 11211 honeypots to capture networks that source such attacks, so eventually the FBI would end up in common RBLs due to their abusive behavior.
In short, I suspect this entire article is bullshit. It is on Wired, after all.
There are many, many institutions preforming global IPv4 scans daily and many tools that allow you to do it[0][1][2]. The trick is to "Be a good citizen", work with a scan friendly host, signal your benevolence, and limit the rate at which you scan. Also smart to black-list DoD networks. If you don't believe me setup a honey pot and open up a popular udp amplification port. Haven't done so myself but I would expect many instances of scanning would be seen everyday.
It's rare that abuse reports are handled quickly, and obviously the FBI is using non-attributable ranges for this kind of stuff. The article has a lot of misnomers but the core reporting seems correct. I would be shocked if the FBI (or Cyber Command or whoever) weren't doing port scanning to help secure the Internet by finding vulnerable servers and services.
(I'm sure NSA is, too, but obviously with different objectives.)
I think I agree. It's better to not be proactive, especially since port scanning is a natural way to perform diagnostics. I would wait for others tell me there's a problem, I wouldn't put money toward sniffing out problems as an ISP.
So, I also have an evolution way of DDoS, known as TCP/IP!
It sounds like a "The hacker known as 4 Chan" joke.
Honestly, that Wired magazine which has inspired the DotCom bubble, is long gone. Nowadays, it's basically a waste of time to read, except for occasional good articles.
> Honestly, that Wired magazine which has inspired the DotCom bubble, is long gone. Nowadays, it's basically a waste of time to read, except for occasional good articles.
Some of the articles have some pretty nice illustration at least.
Scanning every ip is relatively easy, as long as you stick to ipv4. It was done a number of years ago by some grey/black hats. See: http://census2012.sourceforge.net/paper.html
And yeah, the explanation of memcache as a type of DDoS is laughable, but it sounds like it was just used for amplification like I think DNS and NTP have been in the past.
> Then I want share, because I can’t get on the stage without talking a little bit about the problem we call Going Dark, which is encryption. And then I’d like to take your questions. And I’m hoping you’re going to think up a question that has nothing to do with Secretary Clinton’s e-mails.
Dear Lord... "going dark" like when people go to their banks website?
So much ignorance about this. The FBI needs its evidence to be admissible. I'm sure the FBI has no trouble accessing phones with warrantless surveillance when they need to for national security, but they need surveillance to be legal when it's used as evidence in a judicial context
No, this was for a locked iPhone. They were after encrypted data-at-rest. Warantless surveillamce would not apply, as they had a warrant - I believe - seeing as they went after the iCloud data and said it was not helpful (No backup stored there).
Additionally, an OIG report seems to suggest they did not attempt their usual avenue for acquiring access tools in order to get in, instead trying to force a legal precedent.
Because of the President constantly attacking and attempting to sabotage the agency, including firing its head for transparently political reasons.
If I were in law enforcement, I'd certainly think twice about taking a position there. I'd be asking myself "what if I get drawn into Trump drama? Would that be good for my career?"
I don't mean to overstate things—I'm sure the FBI is mostly composed of talented professionals. But I'd be amazed if the recent drama had no effect on their ability to recruit.
He's being charged for activity completely unrelated to the WannaCry outbreak and which occurred years before it. He's likely fully legit now, but no one can alter the past and no one is above the law.
He stopped the outbreak entirely by accident. For all he knew, registering the domain name being queried by WannaCry could have caused the malware to start deleting all the data with no chance for recovery. Even if he did know that he was going to stop the outbreak, it doesn't excuse the fact that he helped create tools that he knew were going to be used for illegal activities.
From reading the article it seems like their co-operation has largely been snitching on their friends in the DDOS community and a crypto-currency analysis app.
Undoubtedly, but it's also probably a combination. They seem talented and probably could have provided significant technical expertise.
The Bitcoin network analyzer sounds a bit odd since you'd think the FBI already has a team dedicated to cryptocurrency investigations, but who knows. Maybe what they developed was really just that good, perhaps from their past experience tracking competitors and adversaries through the blockchain.
That’s probably a factor, but the culture of entrenched government bureaucracy and pay far below what can be gained in the private sector can’t be helping either. Plus, a lot of hackers are fairly ideologically opposed to “big government” in a kind of kneejerk fashion.
Anyone have a link to the .txt interview were the Mirai creator claimed they made their creation to escape "a shitty eastern European country" and their main customers were "Top 5 Minecraft servers"?
They got caught so they should be thrown in Jail. They probably made a lot of Bitcoin from operating their botnet.
I hate how the government keeps giving criminals free passes. Being a criminal has never been more profitable than it is today. Maybe all honest software devs should consider a career change.
Most ex-hackers are millionaires now. What kind of message is that?
Krebs is a super impressive guy in my opinion, and him being able to do something is not where my bar for easy starts. His investigative abilities and network of sources I think is unrivaled in his domain.
Unrivaled among journalists when it comes to cybercrime investigations, absolutely. He's good at what he does and also has access to a lot of tools and helpful contributors. But if you follow the steps, which he lays out very clearly, it's pretty apparent that identifying the perpetrators wasn't rocket science, and that it probably wasn't very hard for the FBI.
Reading the fine print on their site it says offer only valid in the U.S. and would be delivered with in 4 weeks. Are you a U.S. resident or could that be an issue? Hope you get it
Support says "The yubikey is also sent outside the US. Yours was ordered September 19 and should take 6-8 weeks to arrive", so I guess the notice on the page isn't correct. Yay!
It looks really shady. They never tell you how much shipping costs on their web site (to Europe), and then you're taken to Paypal where it clearly shows "10 dollars" (nothing else) and a blue "Pay" button.
After clicking "Pay" you're getting an email that 40 dollars have been sent to Condé Nast.
That borders on fraud. Let's see what customer support has to say about it.
I remember a reprint of a MAD Magazine issue from the 1960s or 1970s that was making fun of magazines' extravagant promotions to boost their circulation. The cartoon showed a magazine publisher personally visiting a non-renewing subscriber and offering him a serious of inducements to renew, culminating in the offer of the publisher's daughter's hand in marriage if the subscriber would agree to continue his subscription for another year.
In the punchline, the publisher said something to the effect of "and that's how we keep our subscription figures climbing!".
Wow for $10 I can get a printed edition shipped internationally for one year and the key... that's.... something. Probably first time I will subscribe to an online magazine.
what the heck?
> The Mirai court documents outline how Dalton, Jha, and White jumped into action in March as the attacks propagated online, working alongside the FBI and the security industry to identify vulnerable servers.
As in, scan every IP for port 11211?