Slashdot Mirror

← Back to Stories (view on slashdot.org)

DOJ Requests More Power To Hack Remote Computers

Posted by Soulskill on from the you-can-trust-us dept.

An anonymous reader writes "The U.S. Department of Justice says it needs greater authority to hack remote computers in the course of an investigation. The agency reasons that criminal operations involving computers are become more complicated, and argues that its own capabilities need to scale up to match them. An ACLU attorney said, 'By expanding federal law enforcement's power to secretly exploit "zero-day"' vulnerabilities in software and Internet platforms, the proposal threatens to weaken Internet security for all of us.' This is particularly relevant in the wake of Heartbleed — it's been unclear whether the U.S. government knew about it before everyone else did. This request suggests that the DOJ, at least, did not abuse it — but it sure looks like they would've wanted to. You can read their request starting on page 499 of this committee meeting schedule."

3 of 76 comments (clear)

  1. Do you really want to do that? by Opportunist · · Score: 5, Interesting

    You might not want to use something like this, at least you do not want to use it against criminals who themselves have a background in IT and especially IT security. Else you might be in for a nasty surprise, namely that they're employing a tripwire system that waits for someone trying to hack them as an early warning system.

    In other words, your attempt to hack the criminals doubles as a "the feds are coming" flare.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    1. Re:Do you really want to do that? by Anonymous Coward · · Score: 3, Interesting

      Even the clueless criminals, once they see the Feds are wanting to hack into their systems will start getting their friends who know what they are doing and updating things.

      It isn't hard to run the second set of books on an offline computer with a F/OSS operating system, an office suite that doesn't need activation, and USB flash drives for moving data. With a VM server like KVM, VirtualBox, or VMWare workstation, any programs that need Windows can run on a hacked copy.

      Network-wise, there are plenty of VPN services in countries not friendly to the US, but will be happy to take money from people in the country.

      So, long term, asking for hacking rights might be good for low hanging fruit (the guy in the parent's basement with the pot plant or two), but after a few seizures, the difficulty will increase since the bad guys will just use time tested methods of couriers and dead drops. A 128 GB MicroSD card can hold a lot of data. Using a diskless Linux distribution like Knoppix or Tails isn't that tough, so a computer used by a smart crook can have a Windows OS on there with a lot of decoy files... but the real stuff and the actual sets of books would be accessed via a bootable CD and a USB flash drive with a hidden, encrypted partition.

      One can point to how people are dealing with the border laptop seizures. Even people who have no reason to worry are now concerned about that. If that same fear/worry gets to common criminals, the police work will have to be done endpoint to endpoint physically, and criminals have taken countermeasures for this for thousands of years.

    2. Re:Do you really want to do that? by mlts · · Score: 3, Interesting

      If a criminal runs their books offline with no net connection, using a USB flash drive for physical transportation or moving encrypted data to an online PC, tripwire may not be needed.

      It wouldn't take much to scare criminals into moving their unencrypted stuff offline, then the DOJ has hosed themselves since all the juicy stuff they wanted easier access to is now inaccessible unless physical attacks are used.