Brian Krebs Gets SWATted

RedLeg writes "ArsTechnica reports that Brian Krebs, of KrebsOnSecurity.com, formerly of the Washington Post, recently got SWATted. For those not familiar with the term, SWATting is the practice of spoofing a call to emergency responders (911 in the U.S.) to induce an overwhelming and potentially devastating response from law enforcement and/or other first responders to the home or residence of the victim. Brian's first-person account of the incident and what he believes to be related events are chronicled here. Krebs has been prominent in the takedown of several cyber-criminal groups in the past, and has been subject to retaliation. I guess this time he poked the wrong bear."

Comments

Danger.

[Seumas]

This wouldn't be nearly as dangerous if we didn't live in a society where a significant portion of our law-enforcement feel like above-the-law gung-ho cowboys looking to shoot now and ask questions later that respond to "large black ex-military man in a green truck" by shooting asian women in a blue van. Cops are trained to approach every incident as a potentially dangerous or life-threatening one and it's pretty much to the point where citizens need to treat every encounter with the police as a potentially deadly one.

Re:Danger.

[James-NSC]

Thankfully Brian had already contacted his local PD and advised them that this was a distinct possibility so they were prepared for the possibility that it was a hoax when they arrived.

That and Brian is white, so that helps...

Re:Danger.

[SwedishPenguin]

Very true. The UK and Norway have the right idea, firearms should only be present only when the situation specifically calls for it. In Norway the firearms stay locked in the car and approval from a superior officer for them to be used, this seems like a good approach to me, at least in countries not inundated in gun violence.

Re:Danger.

[ohnocitizen]

Depending on the nature of the fake threat, reasonable people might assume the situation specifically does call for firearms. It becomes a question of when - if ever - the police can tell the difference between an imminent threat and a prank.

Re:Danger.

[Maow]

Thankfully Brian had already contacted his local PD and advised them that this was a distinct possibility so they were prepared for the possibility that it was a hoax when they arrived.

That and Brian is white, so that helps...

Furthermore, the police called him before he came out his front door and was confronted by armed police.

However, as he was vacuuming and preparing for a dinner party, he didn't answer the phone but made a mental note to check his voice mail.

The police had to respond and it did seem to end rather quickly. Had he answered the phone things would have gone down at least slightly differently. The police would've had to still check the situation out but perhaps it would've been easier on him.

So, a big "Thank You" to Brian Krebs for his on-going work on computer security issues and a big "fuck you" to whomever called 911 with his phone number faked as the calling number.

Re:Danger.

[SwedishPenguin]

I was mainly suggesting a way around the "shoot first, ask questions later" mentality. If cops are not allowed to use guns in their day-to-day activity, the force likely does not attract gun-nuts and the like. 99.99% of the time, there's no need for the police to be carrying guns around. Again, this may not work in countries like the US, but in most of the western world I believe it would.

Re:Danger.

[SwedishPenguin]

Like I said, in countries *not* inundated in gun violence.. London would be a more apt comparison to Chicago than Oslo though, and they manage without guns in their day-to-day work.

Re:Danger.

[Stormy Dragon]

The overwhelming majority of cops are in no more danger on a given day than any other member of the public. The "we face life or death decisions every minute we're on patrol" bullshit is part of the military occupation mentality that's destroying police crediblity in this country.

And we have no idea how rare bad shoots are, as law enforcement groups routinely prevent any attempts to collect statistics on that subject.

Re:Danger.

[DaHat]

To say that this country is "inundated in gun violence" is like saying Europe is inundated with Germans.

Yes... there are seemingly random occurrences distributed widelythroughout the region... but also massive concentrations in very specific areas are alas, very common... Chicago being one of those such places.

It is interesting when you look at the actual data of gun violence, the majority comes from a handful of areas and tend to involve pretty common aspects of those involved.

Re:Danger.

[girlintraining]

and a big "fuck you" to whomever called 911 with his phone number faked as the calling number.

Of course, this begs the question of why our emergency services and others who's lives depend on the accuracy of this information, do not have the capability to authenticate whether a phone call actually originated from a specific phone, and what its location is. Land lines, cell phones, all of these are required by FCC laws passed over a decade ago now to be accurate enough to tell which side of the road your crashed car is on.

If our infrastructure is so easily compromised by pranksters, then what the hell did we spend all those billions of dollars in "Homeland security" for? I don't know about you but if I get a phone call that says "HOLY FUCK THEY HAVE A DIRTY BOMB IN THE BASEMENT!" ... I wanna know which basement, and who's on the other end of that call, pretty fucking quick and unambiguously.

In other news... If this information isn't completely reliable, then why are we kicking down doors and murdering innocent people in their own homes? "Hello? Why yes, I'd like to order a Murder with cheese please. Yes, with extra SWAT."

Re:Danger.

[Seumas]

Which was one of the most curios parts of the story, because I would expect said warning to be blown off as paranoia and forgotten when it came time to respond. This whole thing could have ended very badly. Even with the most level-headed and respectable cops.

I once called the police, because I had moved into a new home and woke up in the middle of the night to what sounded like someone coming in through a window. I didn't realize the weather had changed and it was windy and noisy up-stairs. While the cops were on their way, I grabbed a bat and went to checkout the whole house. When the cops arrived, they were pretty insistent that I drop that bat immediately (for obvious reasons - I could have been the intruder and be coming back with a bloody bat from bashing the owner's head in, for all they knew).

Of course, I am white, also. So they afforded me the time to react before taking any measures we'd both regret. Or . . . mostly I would regret. :D

Re:Danger.

[Seumas]

Actually, there's a pretty hefty amount of evidence that Brian Krebs is white.

Or do you mean that it helped?

I agree that the person who made that statement is doing so with no foundation in this specific incident, but I do think it's reasonable for someone to make that statement in a broader sense, since there have been plenty of incidents where police over-reacted to unarmed black persons with one or a few dozen bullets (just google "police shoot/kill unarmed black man").

Re:Danger.

[Seumas]

I'd need you to define "rare". Perhaps they are rare in comparison to the number of times a cop has to draw a gun, but you could probably spend the rest of the decade pouring through news stories about young black men being shot a dozen times for drawing a 3Muskateers candy bar out of their pocket. All you need to do is google phrases like "police [shoot|kill] unarmed [black|woman]". Throw in some searches for things like "police use taser on unarmed elderly woman", while you're at it.

How many times is acceptable? Shouldn't abuse be pretty much a zero-tolerance issue? Shouldn't excessive (but not abusive) force be both a rare exception and one that is dealt with much more seriously than it is? There are far more stories of "police shoot unarmed black man" and "police shoot unarmed woman" and "police tased person because he had a smart mouth or they were too lazy to overpower him despite having a dozen officers surrounding him" and 'police tase or pepper spray 84 year old woman" stories than there are stories of police being killed.

I mean, for fuck's sake, how many times did cops unload on innocent citizens in the search for that ex-military guy a few weeks ago? Wasn't it twice? And one of them actually *was* a blue van with asian women driving when the APB was for a muscular black man in a green truck? Not only that but the police SHOT ONE OF THOSE WOMEN IN THE FUCKING ****BACK****?! (source: http://latimesblogs.latimes.com/lanow/2013/02/ex-cop-manhunt-newspaper-delivery-women-shot.html ).

Nobody could seriously assert that all cops are corrupted or mentally imbalanced or anything of the sort. That's not what I'm saying. I'm saying what seems pretty obvious from our culture and the news that has covered it for decades -- cops *are* quick to shoot, often shoot without justification, often without thorough investivation, and often without proper persecution. As a whole, they should be taken as a danger to society. Yes, they exist to protect (or, at least, clean up after someone's done some evil shit too you before they got there), but it'd be insane not to treat every encounter with one as one in which you could potentially be shot.

Also, yes they face potentially dangerous situations every day. And they're trained to handle those, so that they don't shoot unarmed and/or innocent people not posing an immediate threat.

Re:Danger.

[Seumas]

Oh, I should have also included that whole thing at an Oakland BART station just a few years ago, where a handful of cops had an unarmed man subdued and face-down on the concrete, when one of the cops stands up, steps back, pulls out his gun, and fatally shoots the guy while the other cops are holding him down.

http://en.wikipedia.org/wiki/BART_Police_shooting_of_Oscar_Grant

https://www.youtube.com/watch?v=FJGo2xfKnd0

You can take each of these as insignificant anecdotal pieces, but when you start to compile the list, you start to realize that you are just one bad or off day away from a cop putting an end to you. Sometimes a good cop making a mistake or a bad cop losing his shit. And there are also plenty of examples of cops breaking down the wrong doors during SWAT busts, sometimes resulting in the innocent occupants inside being killed. We're not talking hoaxes, here. We're talking police fuck-ups, because they smashed down the wrong front door.

Just google "swat enters wrong home" for all those stories.

I'd say these incidents are hardly "rare".

Re:Danger.

[im_thatoneguy]

To your point: you're far more likely to die as a commercial fisherman, roofer or electrician than a cop.

Re:Danger.

[im_thatoneguy]

It's illegal to own firearms in Chicago, so it should be a peaceful utopia (right)?

If you can drive 5 minutes out of town, a ban is essentially symbolic. That being said, those states with more gun control laws generally have fewer deaths. Hawaii for instance has very little gun violence and has some of the most strict gun laws. Hawaii is an interesting case since import/export laws are actually relatively easy to enforce seeing as it has no landlocked neighbors.

Re:Danger.

[Immerman]

Seems like a non-issue to me. Much like email it's relatively easy to spoof the origin of a communication you originate; however, while that can be used for harassment purposes such as in this (potentially to much worse effect - I doubt things would have gone nearly so smoothly had the victim lived in a bad part of town) it doesn't really compromise the integrity of legitimate identification - your phone will still identify itself properly. Interfering with that is likely considerably more difficult.

As for the billions spent in Homeland Security, you don't actually think that ever had anything to do with actual security do you? Once they reinforced and locked the aircraft cockpit doors pretty much everything else was power grabs, cronyism, and wasteful, incompetent security theater - because no politician want to be the one that does nothing in the face of an attack just because of a trifling little detail like there's nothing meaningful that can actually be done.

Re:Danger.

[Nyder]

Very true. The UK and Norway have the right idea, firearms should only be present only when the situation specifically calls for it. In Norway the firearms stay locked in the car and approval from a superior officer for them to be used, this seems like a good approach to me, at least in countries not inundated in gun violence.

Ya, it sucks, I live in the United States and the only guns I have ever seen pulled on someone was by cops. We do need to do something about the gun violence here, these cops are out of control!!!

Seriously, in the 40+ years I've been alive, I have only seen cops pull guns on people (people without guns, I might add), never the other way around.

We do have a problem, but it's not what people think.

Re:Danger.

[mabhatter654]

Woah there buddy!

Watch where you swing that common sense... It could hurt somebody.

Re:Danger.

[Mr. Slippery]

That being said, those states with more gun control laws generally have fewer deaths. Hawaii for instance has very little gun violence and has some of the most strict gun laws.

Idaho's murder rate is lower than Hawaii's (200.9 per 100,000 vs 287.2 for 2011); its gun laws are so weak that the Brady campaign gives Idaho 2/100. (For those outside the U.S., the "Brady Campaign to Prevent Gun Violence" is a leading advocate for the criminalization of gun ownership; in their scale, a higher number means more legal obstacles to exercising the right of self-defense.) Mississippi has a murder rate close to Hawaii's, 269.8; it gets 4 on the Brady's scorecard.

Illinois gets 25 from Brady, and a murder rate of 429.3.

Brady's favorite state is CA, with 81 points; homicide rate 411.1. Texas gets a 4 from Brady, and has almost the same murder rate as California, 408.5.

The Bradys don't rank DC, but we know it has some of the strictest gun laws in the country; it has a murder rate of 1,202.1. (The cynic in me thinks this is why Brady doesn't rate it...) The lowest murder rate is Maine, 123.2, a whole order of magnitude less than D.C.'s rate; its permissive gun laws get a 7 on Brady's scale.

Across U.S. states, gun control laws seem to have no correlation with murder rates. The same applies internationally and across our own history -- the U.S. homicide rate has fallen 50% since the early 90s, the decline starting before the Brady bill and the "assault weapons" ban and continuing after the ban expired, while more and more states liberalized CCW laws and the number of guns in private hands increased.

Re:Danger.

[b4dc0d3r]

Aecurity and authentication were not built in to POTS protocols. That answers your question. They were not designed to handle geolocation nor identity.

The caller ID system relies on either the caller, or a database provided by the caller's provider. Once you transfer from one provider to another, typical in any long-distance call, the second provider has no way to track the caller beyond what the first provider claims. I found this article enlightening, although slightly off topic it is fundamentally about caller ID spoofing.

http://telemarketerspam.wordpress.com/2012/10/08/pacific-telecoms-robo-call-revenue-sharing-scheme-revealed/

Now you're going to ask why we can't fix it? Because it's not worth the amount of money it would take to re-configure the entire phone infrastructure. The companies that would pay the most would benefit the least. Individuals would not sign up in large enough numbers, and so we are stuck.

Yes we have the technology, but not the will. US Congress has made it illegal to send false info, but has not found a way to ensure companies follow the law. As common carriers, they can set up a scam-friendly block and blame the customers for all mischief. The only way to positively identify the people behind the calls is to hand over your credit card information, let a bogus charge hit, and spent a few years fighting back.

Re:Danger.

[rcamans]

Ranking states for Brady and violence is meaningless, as data show. Only ranking high violence areas versus low violence areas gives meaningful data. So ranking Chicago, DC, Detroit, and other large cities with high crime rates against large cities with low crime rates is an interesting comparison. London, as well as England and Great Britain, have high violent crime rates and strong gun laws. Are there large cities in the US with low crime rates? There are in Europe: Zurich, Bern, and Geneva, Switzerland, for example. If you do that in the US, you get confused, because Houston has a high violent crime rate, for example. It just is not obvious.

Re:Danger.

[Anonymous Coward]

the guy that got shot was a life long career criminal, who was the son of a murderer, who was out at 1 AM harassing, intimidating, and fighting with people while high and drunk, with his "crew" of lowlife punks.

He deliberately put himself in a bad situation by his poor behavior and lifestyle choices. It was unfortunate that some newbie rentacop with little experience and an itchy trigger finger killed him, but this guy would never have even been facing the other end of a gun if he had behaved like a normal, decent, law-abiding citizen instead of a thug buffoon.

Here's a window into the mind of a conservative who enables or participates in police crime.

The shooting victim is defined as part of the 'bad' tribe. In this case, his parents are unacceptable in the eyes of the 'good' tribe (right-wing conservatives). He was out on the street late at night (somehow unacceptable to conservatives). Allegedly partakes in drugs and alcohol (punishable by death in the minds of some conservatives).

This 'bad' tribe MADE WAR ON OUR TRIBE by being out late at night. KILL THE OUTSIDER! KILL THE BAD DRUG CRIMINAL MAN! Reasonable punishment for crimes doesn't factor into it. Rehabilitation of socially damaging behavior doesn't factor into it. He's a BAD MAN. SHOOT HIM!

Re:Danger.

[crtreece]

the U.S. homicide rate has fallen 50% since the early 90s, the decline starting before the Brady bill and the "assault weapons" ban and continuing after the ban expired, while more and more states liberalized CCW laws and the number of guns in private hands increased.

There seems to be growing evidence that the increase in crime in the 70s ,and eventual decrease in the 90s, is related to environmental lead pollution from the rise and fall of the use of lead in gasoline

Re:Danger.

[Wow8agger]

This stuff makes me feel crappy to write, but I actually went and looked at the CDC numbers:

All data comes from the 2010 CDC data and the 2010 US Census.

There were a total of 31,632 Firearms related deaths in the US in 2010

Unintentional 606 0.2/100k
Suicide 19,392 6.3/100k
Homicide 11,078 3.6/100k
Undetermined 252 0.1/100k
Legal intervention/war 344 0.1/100k

Intentional self-harm (suicide) by discharge of firearms (Total 19,392)
White (Including Hispanics) 17,909
Black 1,079

Assault (homicide) by discharge of firearms (11,078)
White (Including Hispanics) 4,647
Black 6,151

Firearm Homicides per 100,000
White (Including Hispanic) 2.9
Non-Hispanic Whites 1.9
Black 14.6 (Black males are 27.6?!)
Asian 1.0

The overall US Suicide rate is 12.0/100k, which is less than France, and about the same as the nordic nations and the UK, which all have pretty stringent firearms laws. This makes me think that firearms just happen to be the method of choice in the US, but that these were people that were probably going to kill themselves anyway (Japan, which has *extremely* stringent gun laws has a suicide rate of 21/100k). Interestingly enough though, I heard a story on NPR yesterday that said that people are 85% successful at suicide with guns, but only 2% with other methods, so I might be wrong.

On the other hand, in 2010 Blacks only made up 12.6% of the population, but accounted for 55.5% of all the firearms related homicides. What the hell?! When you've got 1/8th (really 1/16th because it's almost all men) of your population accounting for over half of your gun related homicides, you don't have a gun problem, you have a social problem. I'm not saying blacks are more likely to murder people with guns, I am saying that unfortunately there is a culture in the black community that glamorizes gun violence. It's not necessarily a wealth thing, because you don't see it among poor asians or hispanics.

"I guess this time he poked the wrong bear"

[Anonymous Coward]

Does reporting about criminal groups really count as poking the wrong bear? Or do you think he deserves everything he gets?

WTF?

[The Grim Reefer]

SWATting is the practice of spoofing a call to emergency responders (911 in the U.S.) to induce an overwhelming and potentially devastating response from law enforcement and/or other first responders to the home or residence of the victim.

Seriously, what the fuck is wrong with people? I'm not sure what is worse; that someone came up with doing this, the fact that this happens enough that there's a term for it, or the caviler way the summary reports it. "I guess this time he poked the wrong bear."

Re:WTF?

[Anonymous Coward]

You forgot the most important WTF of all, I think: WTFF is going on when law enforcement are such gung-ho maniacs that they're usuable as a weapon in this way in the first place??

Re:Ars Technica under DOS attack?

[Anonymous Coward]

This morning, Dan Goodin, a good friend and colleague at Ars Technica, published a story about my ordeal after a late night phone interview. This morning, Ars Technica found itself on the receiving end of a nearly identical attack that was launched against my site on Thursday. Turns out, the records at booter.tw show clearly that a customer named Starfall using that same Gmail address also paid for an attack on Arstechnica.com, beginning at approximately 11:54 a.m. ET. A snippet of the logs from booter.tw showing the attack on Ars Technica.com (a.k.a. ‘http://50.31.151.33‘ in the logs) is here.

According to Eric Bangeman, Ars Technica’s managing editor, their site was indeed attacked starting earlier this morning with a denial-of-service flood that briefly knocked the site offline.

“We’ve been up and down all morning, and the [content management system] was basically inaccessible for 2 hours,” Bangeman said, adding that he wasn’t aware of an attack of similar size that knocked the site offline. “If it did, it wasn’t enough to be registering in my memory, and I’ve been around for 10 years.”

Classic example of the importance of anonymity

[Anonymous Coward]

For those that say "anonymity on the Internet is not important", look no further than this story for proof that you're wrong.

Sometimes good guys should be both permitted and encouraged to guard their anonymity and privacy online. It is not just for those doing wrong.

How do they get away with this?

[tsotha]

I want to know how people can call 911 and report something like this without being discovered. Every 911 call is traced immediately, and mobile calls automatically get GPS fixed. Are they using a stolen mobile from a car or something like that?

Re:Ars Technica under DOS attack?

[Kaenneth]

I was worried that EA was doing it in response to the bad reviews SimCity was getting.

A popular product with always-online DRM could create a heck of a botnet.