Hacker News Reader

Comment by rahimnathwani | Hacker News Reader

"KT said fake EDRs don’t have to come from police departments based in the United States, and that some people in the community of those sending fake EDRs are hacking into police department emails by first compromising the agency’s website. From there, they can drop a backdoor “shell” on the server to secure permanent access, and then create new email accounts within the hacked organization."

This sounds extremely unlikely.

Maybe in 1999 someone would have hosted their mail server on the same server as their web site. But today?

View on HN

From: https://twitter.com/briankrebs/status/1508819347963363329

Some backstory that's not in the piece. I originally started reporting this about six months ago, when an anonymous tip suggested people were creating fake police department .org domains and sending requests from there. Spent ridiculous amt of time chasing that to no end.

As part of that research I looked at all new police dept domains in the last year. Found so many I was sure were fake. They were all real. Some were half-done. Some completely wide open, security-wise. It was depressing to learn after that there are > 18k police depts nationwide.

18k police departments is mind blowing. I looked it up because I wasn’t sure it was plausible, but a Department of Justice publication confirmed [0]. Meanwhile the UK has 48 police forces [1].

330,000,000 / 18,000 = 18,500 Americans per police force

67,000,000 / 48 = 1,396,000 Brits per police force

Not sure what to make of that.

[0] https://bjs.ojp.gov/content/pub/pdf/nsleed.pdf [1] https://www.police.uk/pu/contact-the-police/uk-police-forces...

Yeah, it sounds pretty bad, but at least it's somewhat decentralized so that power is diffuse. One way to make it worse would be to connect all those agencies to a central aggregator that acts on their behalf. I'm surprised to see so many comments in this thread advocating for exactly that kind of centralization of power.

>One way to make it worse would be to connect all those agencies to a central aggregator that acts on their behalf. I'm surprised to see so many comments in this thread advocating for exactly that kind of centralization of power.

So here in the UK, Special Branch are the intermediate between the security services and police forces, but dont be fooled into thinking UK police forces are independent, there are official channels which is what gets reported and the public are allowed to know about and then there are unofficial channels, in financial stock trading, this could be likened to Dark Pools.

Individual UK police forces were created through acts of Parliament, and after an act was passed making UK policing universal, each force was monitored by the central "Inspectorate of Constabulary." Parliament passed two more acts; "The Police Act of 1946" merging towns with counties reducing the number of forces to 117, and the "1964 Police Act" reducing forces to 67.

The US just blanket legalized every local paramilitary. Any random-ass local law could give you the right to create your own personal police force.

-----

> It's easier than you think to create your own police department in the United States.

> Yosef Maiwandi formed the San Gabriel Valley Transit Authority -- a tiny, privately run nonprofit organization that provides bus rides to disabled people and senior citizens. It operates out of an auto repair shop. Then, because the law seems to allow transit companies to form their own police departments, he formed the San Gabriel Valley Transit Authority Police Department. As a thank you, he made Stefan Eriksson a deputy police commissioner of the San Gabriel Transit Authority Police's anti-terrorism division, and gave him business cards.

https://www.schneier.com/blog/archives/2006/03/police_depart...

Very different population sizes and land mass. The US is way more spread out than in the UK (730 per sq mile in the UK vs. 93 per sq mile in the US.)

In the US the Top 100 cities (each will have at least one police department) have just 20% of the population.

You have a police department for almost every state, county, city, and town in America. And, the US has about 3000 counties and 19,000 towns (with about 14,000 being 5,000 or fewer people.)

> But today?

Today they use the same crappy hosting company as in 1999, that does the same thing it's always done, just only slightly newer hardware. Especially on a municipal level, there still is not much of a standard when it comes to such things.

Hmm... it seems trivial to do a lookup of the A records for @ and www, and see if there's any overlap with the MX records.

If so, then it was likely set up a long time ago and not maintained well.

The average police officer doesn't even know the law very well. I'd be shocked if the average police dept had someone technically competent enough to speak to network security concerns: that's not their job.

Right, but setting up a web site and email server on the same host (even poorly, in a just-about-works state) requires more expertise to set up than getting a web site and email set up on GoDaddy or whatever.

I wouldn’t put it past them. But hacking an admin portal would probably suffice.

Reply on news.ycombinator.com