Hacker News Reader

Comment by tiahura | Hacker News Reader

Not quite. A federal judge authorized the FBI to act. Not my area of practice, but seems odd - maybe akin to an ex parte tro?

View on HN

I think this is the relevant court record: https://www.justice.gov/opa/press-release/file/1386631/downl...

The mechanism seems to be a search warrant. The FBI applied for a warrant to "search" all compromised Exchange servers in the United States, and to "seize" the illicit malware on those servers by executing a specified series of commands.

A few excerpts from the above link:

"FBI personnel now seek authorization to search the compromised Microsoft Exchange Servers and uninstall the web shells on those servers". (6th page of the PDF)

"This warrant authorizes the United States to seize and copy from Microsoft Exchange Servers located in the United States the web shells identified in Attachment A, and to delete the web shells from those servers." (11th page)

Here's the authorities they cite

> a magistrate judge ... has authority to issue a warrant to use remote access to search electronic storage media and to seize or copy electronically stored information located within or outside that district if ... the media are protected computers that have been damaged without authorization and are located in five or more districts.

> A warrant may be issued for any of the following:

(1) evidence of a crime;

(2) contraband, fruits of crime, or other items illegally possessed;

(3) property designed for use, intended for use, or used in committing a crime; or

(4) a person to be arrested or a person who is unlawfully restrained.

https://www.law.cornell.edu/rules/frcrmp/rule_41

Interesting, I had missed that. The language allowing remote searches when computers "have been damaged without authorization and are located in five or more districts" seems to be recent, added by Congress in a 2016 amendment: https://www.justice.gov/archives/opa/blog/rule-41-changes-en...

Interesting. Fyi I found those quotes by looking up the citations in the application.

Usually warrants have to be pretty specific. This one is, as to the thing that they are searching for. But it isn't, not as to the places to search. Anyways, I doubt the warrant will be challenged, so it works. It's quite the innovation. I... like it, provided they really do only uninstall the malware and close the vulnerability.

It's very specific about the places to search. They are listed in appendix A -- every server that has a web shell installed is enumerated by the URL of the shell.

Ah, got it. Thanks!

Inb4 in a couple years we find out they did just a bit more than expected

The first time they innovate like this, they'll be very careful to do it in a way that seems beyond reproach, probably only uninstall the malware and close the vuln etc.

Once it gets established as a legal thing, they'll keep pushing it...

Is this setting any new precedent for a warrant allowing removal of a file from a server, or is it already common practice when shutting down illicit servers?

can they also copy anything suspicious in "plain view", like whatever is brought by a simple search on the hacked Exchange? That is one huge dragnet. Of course any good citizen wouldn't mind when a law enforcement would come take a look around after the crooks have already broken into the place.

Edit: to the iudqnolq's reply below - warrant doesn't have to explicitly permit it. My understanding [IANAL] is that, at least in the physical world, whatever gets in "plain view" of the officer during any authorized law enforcement activity also becomes a fair game. I.e. they were called for the noise and upon entering see a kilo of heroin laying on the table - the heroin comes into play even though they didn't have a search warrant for it. So i'd expect that the same principle would be applicable in the virtual world too.

No, the warrent does not permit that.

Warrants don't specifically allow for the "plain view exception", do they. Another sibling comment provided a good answer though.

> can they also copy anything suspicious in "plain view", like whatever is brought by a simple search on the hacked Exchange?

If it isn’t passively visible, it is not, by definition, in plain view. If they have to do a search, however simple, beyond what is explicitly authorized in the warrant, to find the information or to find whatever would give them probable cause to believe it is contraband or evidence of crime, they can neither seize it nor get a search/seizure warrant based on their observation of it under the plain view doctrine.

No. "This warrant authorizes the use of remote access techniques to search the electronic storage media identified in Attachment A and to seize and copy from the electronic storage media identified in Attachment A the web shells, used by actors to communicate with and distribute files to victim computers to infect them with malware, as evidence and/or instrumentalities of the computer fraud and conspiracy in violation of Title 18, United States Code, Sections 1030(a)(2) (theft from a protected computer), 1030(a)(5)(A) (damage to a protected computer) and 371 (conspiracy). This authorization includes the use of remote access techniques to access the web shells and issue commands through the web shells to the software running on the electronic storage media to delete the web shells themselves.

This warrant does not authorize the seizure of any tangible property. Except as provided above, this warrant does not authorize the seizure or copying of any content from the electronic storage media identified in Attachment A or the alteration of the functionality of the electronic storage media identified in Attachment A."

https://www.justice.gov/opa/press-release/file/1386631/downl...

Yeah. I don't like the idea that law around search warrants can be used to authorize the government to do things like this. That's not what a search warrant is for. I think the judge was wrong to authorize it, but I don't count on judges to resist law enforcement requests.

If this sort of thing is a good idea, there should really be legislation about it specifically.

Why?

Warrants are issued if there is an evidence of a crime. The existence of these shells is the evidence.

More like – FBI wanted to patch affected servers remotely without getting every owner's consent but weren't sure of legality so they asked a judge to sign off on it.

Whoa. Has this ever been done before?

Asking a judge for a really broad constructive warrant and pretending that the founding fathers anticipated this use case in their aggregate infinite wisdom is very common

The warrant is actually quite specific, down to the exact URL paths of the shells to be searched and removed.

See pages 20 and 21 of https://www.justice.gov/opa/press-release/file/1386631/downl...

How many IPs are they allowed to break into to find the webserver behind those domains?

It's bizarre to think that we should be bound forever more to only do the things that people in 1789 thought appropriate. But it seems to me that they followed the procedure outlined in the 4th amendment; they went to court and got a specific warrant to remove a specific bit of malware from a specified set of servers.

Madison deliberately left many provisions in the Constitution and Bill of Rights open-ended because he wasn't an idiot and knew that the founders could not anticipate everything. Had the FBI acted on its own it would be overreach. They went to court, got a warrant, and did pretty much the minimum required to eliminate the threat.

Good job those aristocrats from 1790's were omnipotent then.

Actually, according to the brief they actually didn’t patch the servers, but only removed the web shell: “This operation was successful in copying and removing those web shells. However, it did not patch any Microsoft Exchange Server zero-day vulnerabilities or search for or remove any additional malware or hacking tools that hacking groups may have placed on victim networks by exploiting the web shells.”

The statement says they were authorized to send commands to vulnerable servers through the exploited services/webshells which removed said webshells from the system.

Reply on news.ycombinator.com