U.S. Says It Removed Malware Worldwide, Pre-Empting Russian Cyberattack

https://www.nytimes.com/2022/04/06/us/politics/us-russia-malware-cyberattacks.html

by jrochkind1 • 4 years ago

45 7 4 years ago

mingyeow• 4 years ago

  The court orders allowed the F.B.I. to go into domestic corporate networks and remove the malware, sometimes without the company’s knowledge.

This is actually extremely freaky.

minota• 4 years ago

Well, how else would they be able to remove malware without explicit access to the existing networks?

krapp• 4 years ago

The only way law enforcement should have access to any civilian network not publicly accessible is with a warrant per the Fourth Amendment. "Secret court orders" to "remove malware" are fascist BS. Who knows what, if anything the US actually removed, or what they added?

Russian botnets and cyberattacks are a legitimate threat to Western countries, especially right now, but a legitimate threat also makes a perfect cover.

ChrisArchitect• 4 years ago

They did what 'secretly' now? Hm. Not alot of details in this article. But eyebrow raises at FBI supposedly going into private networks to 'fix' stuff.

Maybe they just cut a few key networking pipes to stop the connections to Russia?

Not that I'm against them you know, fighting or defending in the cyberwar, but still feels fishy.

heartbreak• 4 years ago

A week ago Kaspersky AV software was labeled a national security threat by the U.S. government, and people here were up in arms. Now folks are already upset that sealed court orders were obtained by U.S. law enforcement before they could protect infrastructure against a direct attack.

Maybe someday the HN comment section will realize that U.S. intelligence is actually competent.

PartiallyTyped• 4 years ago

One would expect that after stuxnet and the whole NSA/Snowden thing that the consensus on the capabilities and competence of the US intelligence services and NSA would be positive.

djrogers• 4 years ago

The article isn’t clear about what actually happened here, but this isn’t all that unheard of (aside from the secret court orders and fbi part). The way this typically works is the good guys co-opt the Command and Control channels and/or servers, and send commands from that C&C to remove/patch/disinfect the malware.

The C&C takeover can happen a number of ways, from DGA reverse engineering (where you register a bunch of domains that the DGA will eventually pick to communicate with, a common way for non-government entities to do it), all the way up to state-level DNS or BGP hijacking.

A lot of malware that’s distributed is pretty flexible, as it is rarely intended for a single purpose. Today data exfiltration is as lucrative in ransom as destructive encryption, and some other way of extorting companies may get popular tomorrow, so the bad guys like to keep their options open. The small bright side to this is that if you can get control of the C&C channels, you can use that flexibility to tell the malware to remove itself. In the past this technique has even been used to patch vulnerabilities…

U.S. Says It Removed Malware Worldwide, Pre-Empting Russian Cyberattack

Related Stories