FBI confirms it issued remote kill command to blow out Volt Typhoon's botnet

https://www.theregister.com/2024/01/31/volt_typhoon_botnet/

by galaxyLogic • 2 years ago

117 69 2 years ago

bsimpson4• 2 years ago

The headline makes it sound like they destroyed the equipment somehow.

The article makes it sound like a bunch of consumer-grade routers were infected with Chinese malware, and that the FBI hacked into the hacked routers, logged the malware, and removed it.

nightpool• 2 years ago

It really doesn't. The use of the word "blow out" might be a little sensationalist but nobody would expect it to mean destroying physical equipment, especially when that equipment is in a botnet (i.e. hacked devices that are presumably legitimately owned by someone)

pimlottc• 2 years ago

The Register tends to the hyperbolic, it’s their style

NoPicklez• 2 years ago

The article to me makes it sound like they removed the BotNet but didn't destroy the equipment

mschuster914• 2 years ago

Disrupting the botnet is so far so good... but what actually needs to be done is that the ISPs need to be notified and the affected customers be disconnected from the Internet until they replace the compromised/out-of-life devices.

Internet access is a privilege, and being a threat to others in this shared space should lead to said privilege being revoked until the threat is gone.

squigz• 2 years ago

Because it's the customers fault manufacturers sell insecure routers that go out of service 2 years later?

candiddevmike• 2 years ago

At some point consumers need to become more computer savvy and responsible netzens.

function_seven2• 2 years ago

No, but those devices are their responsibility.

Car analogies are always fun, so here's one: The catalytic converter on my car is sawzalled off in the middle of the night. I drive around with the missing cat for a couple months. Then I fail a smog check, or get a ticket for loud exhaust. Is it my fault the cat was stolen? No, but I still have a responsibility to everyone else to not pollute (fumes or noise).

If the ISP supplies the router, then of course they should correct it. But if the subscriber brings their own equipment, then they take on the responsibility of maintaining it. Including replacement if it turns out not to be fit for purpose.

kube-system2• 2 years ago

what actually needs to be done is that the ISPs need to be notified and the affected customers be disconnected from the Internet until they replace the compromised/out-of-life devices.

Yes, but a lot of the internet is on a shoe-string budget and managed by someone who DGAF, and connected to an ISP who also DGAF.

mschuster914• 2 years ago

Yeah, and these people don't deserve to be on the Internet. We also don't let people run cars with bad exhaust stacks on the road, and if police spot violators, they get issued remediation orders.

costco2• 2 years ago

What if a hospital was disconnected from the Internet because it has some insecure IoT device in it? The truth is that this "enforcement action" will make absolutely 0 difference because these devices were just used as proxies to launch attacks. There are a million other people offering this as a service.

And it was a botnet with "hundreds of devices." That is literally nothing. People who want to live in this world where abuse emails are king and a bunch of Spamhaus type people lord over the Internet always weird me out.

2OEH8eoCRo0• 2 years ago

Hundreds is plenty if your objective isn't DDoS.

https://www.justice.gov/opa/pr/us-government-disrupts-botnet...

China’s hackers are targeting American civilian critical infrastructure, pre-positioning to cause real-world harm to American citizens and communities in the event of conflict

mschuster914• 2 years ago

What if a hospital was disconnected from the Internet because it has some insecure IoT device in it?

Give them a remediation time of 24 hours. If that doesn't help, cut them off anyway, as that's the only thing that will force management to give their IT people actual staff and budget. Hospital IT is almost always a shitshow and that won't change until external pressure forces management's hand.

mindslight• 2 years ago

This is a terrible narrative, essentially grease on the path of destroying the permissionless Internet in favor of an environment where every communication is tracked and "accountable". The basic reality is that Internet traffic should be considered hostile noise and Internet nodes need to be resistant to that. That's the crux of the seminal end to end principle and cross-jurisdiction operation (the whole "Inter" part).

Furthermore, taking it at face value, why shouldn't this condemnation apply to the FBI first ? They've got compromised devices with the out of life software that's causing a bigger problem. So by applying that standard, they should be taken offline first. Which I'd say highlights a deep problematic assumption in reaching for the blame game, whereby some nodes start to be considered "more equal" than others.

ahmeneeroe-v22• 2 years ago

As a society we've settled on collective security (army/navy/police) to address outside physical threats. I believe that as our institutions mature we will take analogous steps towards addressing internet/computer security. It seems more obvious to me than making unsophisticated users responsible for their own individual security against highly sophisticated and well-resourced adversaries.

molsongolden• 2 years ago

“Cybersecurity today is like if we’d asked London building owners to install their own anti-aircraft guns during the Blitz.”

Just a quote from a friend.

stonemetal12• 2 years ago

For most non-tech people the only router in the house is the one the ISP provided, forcing ISPs to punish their customers for the ISPs misdeeds is odd.

dylan604• 2 years ago

This used to happen back in dial-up days and malware using the home connection as and SMTP SPAM attack. The ISP would prevent you from getting online. Eventually, they just blocked that port from all home users. Since the modem connected directly, there weren't really firewalls yet. It was the stone ages, but people definitely had their accounts blocked for having an infected machine

rolph• 2 years ago

the option to refuse or indefinately defer, any or all upgrades or updates, should be preserved, until there is some basis to believe, there will be no loss or ransom of function bundled in.

willmadden• 2 years ago

Internet access is not a "privilege". It is a service people purchase.

fullspectrumdev• 2 years ago

The routers being exploited are, in many cases, supplied and managed by the ISP lol

willcipriano• 2 years ago

A year after this is implemented: "internet access is a privilege, we cant have people speading dangerous ideas!"

How about you start your own internet for fragile systems that can't handle the real internet? Then you can be a dictator and require remote attestation or whatever.

sam1r• 2 years ago

>> the FBI sent specific KV Botnet commands to compromised routers to collect "non-content information about those nodes.

This must’ve been so fun for whomever individual(s) working on this from the FBI.

000ooo000• 2 years ago

This was my takeaway as well. What a cool job. Being government, I wonder if it's a super crusty/stuffy work enviroment with loads of paperwork and little autonomy or if this part of the org has a bit more of a laid back vibe.

tru3_power• 2 years ago

Lol even red teaming has loads of paperwork/crusty stuffy work. You have to have a good paper trail of what you did for repudiation purposes. That’s just how it be.

dikaio2• 2 years ago

Not exactly the same but should be mentioned. Chinese use real people’s personas for upwork, they contact people asking for them to create profiles under their names and get paid a percentage of income generated.

bsimpson4• 2 years ago

I feel like your allegation is missing a subject.

You're saying Chinese spies/hackers are duping real people to facilitate this botnet?

dikaio2• 2 years ago

It’s not an allegation it’s a fact. Also, the point of the subject wasn’t missed this is why I lead with “not exactly the same”. To provide a bit more clarity, these dev teams often request access to the users computer through teamviewer and similar or ask to have a full working device that they can login to as to work from so essentially they’re on the persons network with a device with full access to that network. My statement never suggest anything related to the botnet. Regarding hackers, yes devs of course could be potential hackers, likely.

bsimpson4• 2 years ago

The legal aspect of this is interesting.

It seems like leaving bystanders alone and removing the threat (what the FBI did) is in everyone's best interests. Nobody wants to get dragged to court over an old Linksys.

Still, this isn't a foreign warzone. These are devices that were presumably owned by Americans, working out of American homes. I wonder under what legal authority the FBI can hack into and modify American devices. What if they accidentally brick something? What if they find evidence of personal illegal activity?

nine_k• 2 years ago

I would say that it could be the same framework as for firefighters, or for a bomb squad. They may need to enter private property in order to protect it, or nearby areas, from an imminent threat.

As such, they of course don't have a search warrant, but they have a license to locate and disable a source of threat: a fire, a bomb, a piece of highly radioactive material, etc.

IANAL, of course.

bredren• 2 years ago

They applied for and received a Search Warrant (5018) to cover all activity described in the article:

The FBI will identify a list of U.S.-based routers infected with the malware, as described in Attachment A.
The FBI seeks authorization under Federal Rule of Criminal Procedure 41(b)(6)(B) to remotely search those routers and seize the evidence and instrumentalities of the hackers' criminal offenses, as described in Attachment B.
As part of this search and seizure, the FBI will remove the malware from the infected routers and take limited, reversible steps to prevent re-infection.

To GP’s questions, the scenarios would be handled as in any other search warrant. Though I’d presume this is rather unusual and to increase the likelihood of future approval, the agent would try to avoid stumbling into having to decide if some completely unrelated crime needs to be prosecuted.

Aside from this, it’s intriguing that they state the changes they planned to make to the routers would be reversible.

I wonder how practical this might be if needed, given potential shift in IP. Also, when, if ever the owners will be notified of the activity. This may be covered in one of the filings.

BytesAndGears• 2 years ago

I don’t usually love parallels from digital to physical worlds, especially with regards to laws, since there is a lot of nuance that gets lost.

But, with that said… If I own a property that I don’t use, and people start making and selling drugs there, without me knowing… to what degree am I liable?

And what do the police/FBI do in that situation?

I would be totally fine with them entering the property, dealing with the specific threat, not looking at more than they need to for that investigation, and letting me know what happened.

It seems like the exact same thing. These people were allowing illegal activity on their property (devices), unknowingly. So the police come in and deal with the threat, only look at what they need for the specific investigation, and let people know afterwards.

username135• 2 years ago

Makes a lot of sense to me

bell-cot• 2 years ago

"Before the takedown could be conducted legally, FBI agents had to receive authority—technically for what’s called a seizure of infected routers or "target devices"—from a federal judge. An initial affidavit seeking authority was filed in US federal court in Houston in December. Subsequent requests have been filed since ..."

- https://arstechnica.com/security/2024/01/chinese-malware-rem...

That story notes that the FBI's actions also prevented re-infection...at least until the routers are rebooted.

redserk• 2 years ago

I have a mild rant on the notion of legal authority.

I think it should come down to intent. If this is an action purely done for the benefit of end-users with an honest-to-goodness attempt at no snooping around, I fail to see this as a problem. This is an example of government doing it's job to protect it's citizens.

I'd like to see this go a step further. I'd love to get an email or phone call saying that they noticed my router was part of a botnet, they remoted in to fix the issue, and (if applicable) run a software update to permanently apply the fix.

It concerns me that we possess so much skepticism around the idea that government _can_ act benevolently. This is extremely harmful as it prevents us from putting forth any meaningful guardrails around these kinds of activities.

We defer too much to the false idea that we're protected from tyranny by refusing to acknowledge we can have a government work for us.

chmod775• 2 years ago

You're attacking a strawman. Nobody "refuses to acknowledge" any of that.

To many, missing out on the upsides is simply preferable, because they consider those powers falling into the hands of a bad government an unacceptable risk. They recognize that taking power away from the government is infinitely harder than not bequeathing power in the first place and also that they might not trust next year's government - even if they trust the current bunch.

Personally I'd prefer there be so many limitations, checks, and balances, that no trust in my government is necessary at all, but as a German I'm strongly biased.

qingcharles2• 2 years ago

This is called "the ends justify the means" in legal terms. It is used (illegally) regularly in criminal cases and 99% of the time the government gets away with it.

It is technically frowned upon though for the possibility of it running away with itself -- where is the line drawn once you say the line we have (laws) can be crossed.

GoblinSlayer• 2 years ago

You say it as if p2p works. It doesn't. Everything is behind NAT and you can't just go connect there by yourself.

lupire• 2 years ago

The FBI has the legal authority, under judicial supervision, to break and enter, search and seize, and shoot to kill. Destruction of property is less lethal.

qingcharles2• 2 years ago

The FBI has done it before -- with the Playpen malware it installed on PCs using a Firefox exploit:

https://www.eff.org/pages/playpen-cases-frequently-asked-que...

It was challenged in court, but the courts did a bunch of hand-waving and said it all sounds constitutional. You find that a lot of the time with criminal cases involving bad people, the courts will often find a way to let things slide using the "ends justify the means" tactic.

halJordan• 2 years ago

This is certainly not the same thing as your case study. You can be just anti-govt. That's ok. But you can't do these sweeping conflations to hoodwink people yourself. If you can criticize them for "hand-waving" then do not lower yourself to that level.

mkatx3• 2 years ago

Ok.. I appreciate how the FBI assisted in cleaning our routers/ip's.

But is this story possibly alluding to the fact that the FBI did NOT disclose the potential 0 days used in these attacks in accordance with responsibile disclosures, and instead is likely retaining these zero days for their own use?

rasz2• 2 years ago

Because those arent 0 days. Those routers/doorbells/fridges will never receive updates.

I wonder if the OG Mirai minecraft server wars botnet hackers working for FBI now were part of this task force.

Original story https://www.wired.com/story/mirai-botnet-minecraft-scam-brou...

Fantastic follow up https://www.wired.com/story/mirai-untold-story-three-young-h...

mkatx3• 2 years ago

Thanks for the follow up. Dunno if I missed it in the article, but I did not notice it specifying if the attack was via 0 day or not, that's why I speculated the possibility.

Where did you read that they are not 0 days?

tjpnz• 2 years ago

And China will continue to face no consequences.

FBI confirms it issued remote kill command to blow out Volt Typhoon's botnet

Related Stories