The Mirai Botnet Architects Are Now Fighting Crime with the FBI | Hacker News Reader

The Mirai Botnet Architects Are Now Fighting Crime with the FBI

wired.com

124 pointskposehn70 comments

> Earlier this year, the Mirai defendants worked with FBI agents in Alaska to counter a new evolution of DDoS, known as Memcache

what the heck?

> The Mirai court documents outline how Dalton, Jha, and White jumped into action in March as the attacks propagated online, working alongside the FBI and the security industry to identify vulnerable servers.

As in, scan every IP for port 11211?

Yep probably. The FBI does not attract top talent these days.

Is that true? What else can you relate about the FBI's talent pool?

https://www.fbi.gov/news/speeches/the-fbis-approach-to-the-c...

> Then I want share, because I can’t get on the stage without talking a little bit about the problem we call Going Dark, which is encryption. And then I’d like to take your questions. And I’m hoping you’re going to think up a question that has nothing to do with Secretary Clinton’s e-mails.

Dear Lord... "going dark" like when people go to their banks website?

What about the whole "we cant unlock an iphone, make us a tool to unlock all iphones" or could they and lied about it.

It always looked to me like they just wanted the tool, and the whole “can’t unlock” was just an excuse.

So much ignorance about this. The FBI needs its evidence to be admissible. I'm sure the FBI has no trouble accessing phones with warrantless surveillance when they need to for national security, but they need surveillance to be legal when it's used as evidence in a judicial context

No, this was for a locked iPhone. They were after encrypted data-at-rest. Warantless surveillamce would not apply, as they had a warrant - I believe - seeing as they went after the iCloud data and said it was not helpful (No backup stored there).

Additionally, an OIG report seems to suggest they did not attempt their usual avenue for acquiring access tools in order to get in, instead trying to force a legal precedent.

Of course it’s true. How could the FBI possibly attract top talent beyond a few altruistic outliers?

Why would they have any more problem buying talent than anyone else?

Because of the President constantly attacking and attempting to sabotage the agency, including firing its head for transparently political reasons.

If I were in law enforcement, I'd certainly think twice about taking a position there. I'd be asking myself "what if I get drawn into Trump drama? Would that be good for my career?"

I don't mean to overstate things—I'm sure the FBI is mostly composed of talented professionals. But I'd be amazed if the recent drama had no effect on their ability to recruit.

They have an incredible brand. Way more people grow up wanting to be FBI agents than 99% of all other professions.

>The FBI does not attract top talent these days.

They don't attract it. They arrest it. The benefit is that prospective employee can't refuse the offer.

You don't need to attract top talent when they come to you via court order, I suppose…

And scanning every IP for a port is how you trigger automatic abuse reports to whoever owns the IP block, and failure to respond to said abuse reports (and, more importantly, ceasing said abusive behavior) leads to eventually the attacker (the aforementioned government office) having their Internet service ended due to ToS violations.

Not only that, I suspect some ISPs now run 11211 honeypots to capture networks that source such attacks, so eventually the FBI would end up in common RBLs due to their abusive behavior.

In short, I suspect this entire article is bullshit. It is on Wired, after all.

you massively overestimate what any ISP is going to do. it's nothing. they're not running honey pots, they don't care.

I think I agree. It's better to not be proactive, especially since port scanning is a natural way to perform diagnostics. I would wait for others tell me there's a problem, I wouldn't put money toward sniffing out problems as an ISP.

It's rare that abuse reports are handled quickly, and obviously the FBI is using non-attributable ranges for this kind of stuff. The article has a lot of misnomers but the core reporting seems correct. I would be shocked if the FBI (or Cyber Command or whoever) weren't doing port scanning to help secure the Internet by finding vulnerable servers and services.

(I'm sure NSA is, too, but obviously with different objectives.)

There are many, many institutions preforming global IPv4 scans daily and many tools that allow you to do it[0][1][2]. The trick is to "Be a good citizen", work with a scan friendly host, signal your benevolence, and limit the rate at which you scan. Also smart to black-list DoD networks. If you don't believe me setup a honey pot and open up a popular udp amplification port. Haven't done so myself but I would expect many instances of scanning would be seen everyday.

[0]:https://zmap.io/ [1]:https://github.com/robertdavidgraham/masscan [2]:https://memcachedscan.shadowserver.org/

> a new evolution of DDoS, known as Memcache

I almost literally LMAOed.

So, I also have an evolution way of DDoS, known as TCP/IP!

It sounds like a "The hacker known as 4 Chan" joke.

Honestly, that Wired magazine which has inspired the DotCom bubble, is long gone. Nowadays, it's basically a waste of time to read, except for occasional good articles.

> Honestly, that Wired magazine which has inspired the DotCom bubble, is long gone. Nowadays, it's basically a waste of time to read, except for occasional good articles.

Some of the articles have some pretty nice illustration at least.

I still remember it. I have the first few years of issues stashed away somewhere.

With it being so reviled, how does it even survive? last resort airplane reading?

Scanning every ip is relatively easy, as long as you stick to ipv4. It was done a number of years ago by some grey/black hats. See: http://census2012.sourceforge.net/paper.html

And yeah, the explanation of memcache as a type of DDoS is laughable, but it sounds like it was just used for amplification like I think DNS and NTP have been in the past.

And meanwhile the bloke who stopped the WannaCry outbreak is holed up waiting for a court date..

He stopped the outbreak entirely by accident. For all he knew, registering the domain name being queried by WannaCry could have caused the malware to start deleting all the data with no chance for recovery. Even if he did know that he was going to stop the outbreak, it doesn't excuse the fact that he helped create tools that he knew were going to be used for illegal activities.

He's being charged for activity completely unrelated to the WannaCry outbreak and which occurred years before it. He's likely fully legit now, but no one can alter the past and no one is above the law.

Something weird to me about the FBI not having good enough technical abilities that the cooperation of these three had such an effect.

Maybe it's more cultural than technical.

They are probably just snitching on other people. And this press release was part of a deal they managed to negotiate to make them look good.

That is, sadly, how collaboration with law enforcement usually goes.

Undoubtedly, but it's also probably a combination. They seem talented and probably could have provided significant technical expertise.

The Bitcoin network analyzer sounds a bit odd since you'd think the FBI already has a team dedicated to cryptocurrency investigations, but who knows. Maybe what they developed was really just that good, perhaps from their past experience tracking competitors and adversaries through the blockchain.

I believe employees are drug tested, which discounts a large portion of the community.

That’s probably a factor, but the culture of entrenched government bureaucracy and pay far below what can be gained in the private sector can’t be helping either. Plus, a lot of hackers are fairly ideologically opposed to “big government” in a kind of kneejerk fashion.

From reading the article it seems like their co-operation has largely been snitching on their friends in the DDOS community and a crypto-currency analysis app.

Create a botnet that takes down portions of the Internet and you too can put "Internship at the FBI" on your resume.

If you are morally ambiguous enough to become a snitch.

I think creating the botnet already put them in that category.

Anyone have a link to the .txt interview were the Mirai creator claimed they made their creation to escape "a shitty eastern European country" and their main customers were "Top 5 Minecraft servers"?

They got caught so they should be thrown in Jail. They probably made a lot of Bitcoin from operating their botnet.

I hate how the government keeps giving criminals free passes. Being a criminal has never been more profitable than it is today. Maybe all honest software devs should consider a career change.

Most ex-hackers are millionaires now. What kind of message is that?

> Most ex-hackers are millionaires now.

Big ol' [citation needed] on that claim, please.

How did they link the three of them to creating it?

It wasn't that hard. Krebs found their leader before the FBI arrested them (though he was on the FBI's radar for a while).

https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-m...

Krebs is a super impressive guy in my opinion, and him being able to do something is not where my bar for easy starts. His investigative abilities and network of sources I think is unrivaled in his domain.

Unrivaled among journalists when it comes to cybercrime investigations, absolutely. He's good at what he does and also has access to a lot of tools and helpful contributors. But if you follow the steps, which he lays out very clearly, it's pretty apparent that identifying the perpetrators wasn't rocket science, and that it probably wasn't very hard for the FBI.

Oh you're right! I had forgotten about this.

Always knew the FBI was pitching for the other team...

> Get unlimited access + a free YubiKey. Subscribe

What's this?

> Subscribe today to get unlimited access to WIRED and get a free, exclusive WIRED YubiKey 4.

> 1 year for $10

Can I get like 300 subscriptions to Wired?

It's a U2F key, not a Y4.

Definitely looks like a Y4 https://subscribe.wired.com/subscribe/wired

More significantly, it claims to be one.

Wait, whoah, they're giving away Y4s? I thought (clearly) they were U2F keys. Well, I guess I was wrong.

I thought the same, but according to Yubico themselves[0], it’s a Yubikey 4 with some branding. Unless that was a previous campaign?

[0] https://www.yubico.com/2018/02/wired-ars-technica-experts-ch...

^^ this is wrong

$5 my dude: https://subscribe.wired.com/subscribe/wired/116304

I subscribed about two months ago after seeing this on /r/sysadmin. I got my first issue, but I still haven't got my Yubikey :(

I have a feeling that they might be waiting on a huge order of the branded Yubikeys to arrive.

Reading the fine print on their site it says offer only valid in the U.S. and would be delivered with in 4 weeks. Are you a U.S. resident or could that be an issue? Hope you get it

There's an international form and the deal still applies! It's just $10 instead of 5

(scratch that, they make it $20 CAD after everything...)

https://subscribe.wired.com/subscribe/wired

International shipping bumps this up to 40 USD, which is a ridiculous shipping fee for a letter.

"You will receive your exclusive YubiKey within 4 weeks after being charged. Offer valid in U.S. only." :(

That’s odd. My invoice shows that I get one here in Canada and says 6-8 weeks both on the confirmation screen and the email copy.

I’ve been reading Wired articles for years for free so I don’t mind signing up for a year regardless.

I guess I’ll find out and can report back for anybody who wants to know for sure haha.

Support says "The yubikey is also sent outside the US. Yours was ordered September 19 and should take 6-8 weeks to arrive", so I guess the notice on the page isn't correct. Yay!

I just subscribed because of this!

And yeah probably. Per my post-subscription notice:

6-8 weeks

Always wondered how magazines could afford to pay for this?

I remember a reprint of a MAD Magazine issue from the 1960s or 1970s that was making fun of magazines' extravagant promotions to boost their circulation. The cartoon showed a magazine publisher personally visiting a non-renewing subscriber and offering him a serious of inducements to renew, culminating in the offer of the publisher's daughter's hand in marriage if the subscriber would agree to continue his subscription for another year.

In the punchline, the publisher said something to the effect of "and that's how we keep our subscription figures climbing!".

The auto-renewal. Most people will forget about the renewal, then renew after a year at full rates.

Isn't the easy solution to this to immediately cancel auto renewal right after subscribing?

Ad revenue. You are the product not the customer, same in print as online ;)

Wow for $10 I can get a printed edition shipped internationally for one year and the key... that's.... something. Probably first time I will subscribe to an online magazine.

You can buy it as a gift... to 300 of your close friends who are incidentally named like you and live in your house.

It looks really shady. They never tell you how much shipping costs on their web site (to Europe), and then you're taken to Paypal where it clearly shows "10 dollars" (nothing else) and a blue "Pay" button.

After clicking "Pay" you're getting an email that 40 dollars have been sent to Condé Nast.

That borders on fraud. Let's see what customer support has to say about it.

Reply on news.ycombinator.com