Hacker News Reader

Comment by morpheuskafka | Hacker News Reader

I can't believe all they were doing was validating the email, if that's true. Virtually every town, city, borough, county, etc. across the country has a police/sheriff's department, sometimes as small as a few people. Even a few private companies have them.

Sure the NYPD, FBI, etc. are going to (theoretically) have top security, but if any LEO anywhere in the country is good enough, just hack some podunk PD that exists solely to generate ticket revenue and has no IT department, no 2FA, no security training.

View on HN

I can't really fault the tech companies for this, it's not a great place to be in and there isn't an obvious solution.

The bad actors are explicitly exploiting an emergency provision intended for quick information return to prevent serious harm/death using verified police accounts they've compromised.

You either end up with the headline we have here or "Apple's failure to comply with an emergency request led to the death of X"

I don't know what the right policy is, but this is just a tradeoff without an easy answer.

I don't know, maybe look up the police department's number online and call them back? If we can do it when the "bank" calls us and asks for private information, maybe these guys could do the same.

I can't really fault the tech companies for this, it's not a great place to be in and there isn't an obvious solution.

For all of the box ticking, theatrical diligence and audit-preparedness work I’ve had assigned to me in my Devops career, and bespoke security “services” and “products” out there that merely exist to enable more box ticking in the name of “security and compliance”, I think maybe we should start.

Sadly, the "common sense" solution would be a single email provider -- something provided by the federal government. Alas, sense isn't common in the US: it's up to every state (and, it would appear, county, city, university, etc) to decide.

One obvious thing I'd do if Officer Bob from the Podunk PD asked me for anything, is say "let me call you back", find the published phone number of the Podunk PD, call it, and ask for Officer Bob. I'd of course tell him I was about to do that, so he could arrange to receive a call from the PD front desk, or at least have them confirm that they had just talked to him. So the crooks would have to intercept that front desk number too, if they wanted to fake it. That would at least slow them down a little more, I hope.

Social engineering this is trival. Lookup for a phone will likely be on their website.

The threat actor could compromise the website just as they did for the email, Or create a legitimate looking fake one, not every department has one or is indexed well

Tech support staff handling these requests cannot possibly know the thousands of police departments sites to know if the site is legitimate.

There is simply no single national authoritative source for validation ( international is even more complex with different laws and languages)

Back in the day you could get national phone directories on cd-rom. So the crooks would have had to compromise the phone book or the cd. Idk if those cd's still exist.

Yes, the police web site is another point of vulnerability. But with any luck you can reliably find the area code for Podunk, then call directory assistance in that area code to ask for the police department number. So the crooks would have to compromise that too.

Creating a national db of validated police department phone numbers seems like the easiest problem to solve in this chain of issues. What’s on the EDR form?

It will have to be international, and law enforcement is loosely police. Even in the U.S. there are tones of depts which are law enforcement and not police .

Tech support staff handling these requests cannot possibly know the thousands of police departments sites to know if the site is legitimate.

You know who probably would be in a better position to know? Your corporate counsel. Chances are pretty high they not only know who to contact, they probably have additional contacts that your 'tech support' staff do not in the nearby agencies and beyond, not to mention having the actual knowledge on the response mechanisms that said agency requires for compliance with requests for corporate data.

Which forces me to ask this question: I understand that as technologists we probably have an abundance of confidence in the knowledge and skills we possess in our domain, so why are tech support staff even 'handling' legal requests at all?

The only "handling" they should be doing is "handing" whatever evidence or materials that have been requested directly to the company's legal counsel, who should have been the party liaising with the 'requestor'.

You expect any company to have on payroll corporate counsel 24/7 for emergency requests in like 200 jurisdictions ? .

Also in my experience counsel who practice civil and corporate law have very little experience with law enforcement. Companies don't generally keep lawyers who practice criminal law inhouse .

You expect any company to have on payroll corporate counsel 24/7 for emergency requests in like 200 jurisdictions ?

To an extent, yes as a matter of fact, or at minimum a Registered Agent. Because in almost all of those 200 Jurisdictions, for a majority of business types (including Corporations) a Registered Agent is required by law for exactly this purpose: to receive and help your company properly respond to legal requests.

https://www.upcounsel.com/registered-agent

Similarly, an Authorized Agent for your business is empowered to respond to such inquiries

https://www.upcounsel.com/authorized-agent

That would be if you have actual physical presence in those countries. If you are online that is not feasible.

Also having an general counsel for your place of business, is not same as having an firm 24/7 on call.

I concur. You will note that I said “for a majority of”, not “all”. Even online businesses still, if they intend to register as a business entity and enjoy all that comes with registering a business, like business tax ID or EIN, they must register with a jurisdiction. Also note where I said having an attorney “or at minimum a Registered Agent”

So I’m not sure what is being rebutted here.

Pretty much what they did.

https://krebsonsecurity.com/2022/03/hackers-gaining-power-of... ( https://news.ycombinator.com/item?id=30842757 )

> Providers have a streamlined process where they publish the fax or contact information for police to get emergency access to data. But there’s no real mechanism defined by most Internet service providers or tech companies to test the validity of a search warrant or subpoena. And so as long as it looks right, they’ll comply

Nevermind the risk that it’s actually a cop sending these requests for their own personal reasons. It’s far from unheard of for cops to abuse these systems to harass former partners and personal rivals; the courts are supposed to provide oversight to prevent these abuses.

You're absolutely right. Here's one high-profile example:

https://www.thedailybeast.com/feds-say-bounty-hunter-matthew...

Reply on news.ycombinator.com