Slashdot Mirror
Security Researcher and Alleged Spam Operator To Square Off In Court In Ugly Lawsuit (bleepingcomputer.com)
An anonymous reader writes: River City Media, the company accused of running a huge spam operation, has filed a lawsuit against the security researcher and the journalist who exposed their activities. In a ludicrous lawsuit complaint, the company claims the security researcher didn't just stumble upon its unprotected Rsync server, but "perpetrated a coordinated, months-long cyberattack," during which it skirted firewall rules to access its server, used a VPN to disguise his identity, deleted critical files, and published his findings to make a name for himself as an elite security researcher. The company claims the researcher accessed Dropbox and HipChat logs, and even its PayPal account, from where it used funds to purchase various domains. The only evidence the company has is that the person who purchased the domains used a ProtonMail email, just like the researcher, who also uses a ProtonMail email. Remind you, this is the same security researcher, Chris Vickery, who discovered a Reuters database of supposed terrorism suspects, national voter databases for various U.S. states and Mexico, and various other companies.
https://en.wikipedia.org/wiki/... Tim S.
Defender's lawyers send over 1 billion boxes of documents after prosecution requested related materials.
Whoohoo first ever
Will like to see what happens with this case.
Well, some firewall rules cannot be skirted. For instance, DENY ALL TRAFFIC TO PORT 22.
We'd be up in arms if it was the FBI breaking into the systems to gather evidence of illegal activity with out a writ or warrant. Without the backing of the law the 'hacker' is and should be guilty of digital crimes, but that doesn't abrogate the guilt of the spammer, who should be relegated to a special hell for spammers and phishers. Private entities can get away with things law enforcement can't.
errr....umm...*whooosh* *whoosh* Is this thing on ?
I find no fault with the security researcher and journalist for exposing a spam operation, even if it meant some hacking. However, I'm concerned that, when security researchers engage in activities that are viewed as ethically questionable, they degrade the credibility of security professionals in the eyes of the public. When we tell people they need to take precautions against a certain type of vulnerability, avoid certain software products, and take other steps to be secure, we need the public to take us seriously. When the public sees security researchers engaging in activities like hacking or publishing the source to backdoored ransomware, it makes it look like the researchers are also criminals. We need to be beyond reproach if we want the public to heed our security warnings, especially in an era where apps leak data and IoT is incredibly vulnerable. I'm just concerned that this doesn't help our cause.
Then Chris Vickery not only will be able to defend himself, but may be able to countersue under New Jersey's anti-SLAPP laws (SLAPP = Strategic Lawsuits Against Public Participation - exactly what this suit seems to be). The penalties can be quite substantial, $280K in a recent case. Not only that, but there is another New Jersey law that allows a judge to dismiss a case with prejudice within 45 days of the SLAPP filing. This is all cogent, because RCM is a New Jersey corporation.
Furthermore, there is a shareholder group engaged in a proxy battle right now, saying that they see this as a desperate attempt to distract shareholders from corporate mismanagement. So this may not even get filed, depending on how the existing shareholders see this action>
Teach me how to be a hacker. Even if it takes a whole hour.
It looks like a beautiful lawsuit to me. It should be much more entertaining than most of 'em.
Aka I FUCKING TOLD YOU SO.
Newest update: On May 1st 2017, under pressure from the Vault 7 leak, Intel released a "Critical" security bulletin INTEL-SA-00075, admitting Intel Core CPU from 1st gen to 7th gen (2006-2017) all share the same critical vulnerability.
The goal of this report is to make the existence of Intel CPU backdoors a common knowledge and provide information on backdoor removal.
What we know about Intel CPU backdoors so far:
TL;DR version
Your Intel CPU and Chipset is running a backdoor as we speak.
The backdoor hardware is inside the CPU/Bridge and the backdoor firmware (Intel Management Engine) is in the chipset flash memory.
30C3 Intel ME live hack:
@21m43s, keystrokes leaked from Intel ME above the OS, wireshark failed to detect packets.
[Video Link] 30C3: Persistent, Stealthy, Remote-controlled Dedicated Hardware Malware
[Quotes] Vortrag:
"DAGGER exploits Intel's Manageability Engine (ME), that executes firmware code such as Intel's Active Management Technology (iAMT), as well as its OOB network channel."
"the ME provides a perfect environment for undetectable sensitive data leakage on behalf of the attacker. Our presentation consists of three parts. The first part addresses how to find valuable data in the main memory of the host. The second part exploits the ME's OOB network channel to exfiltrate captured data to an external platform and to inject new attack code to target other interesting data structures available in the host runtime memory. The last part deals with the implementation of a covert network channel based on JitterBug."
"We have recently improved DAGGER's capabilites to include support for 64-bit operating systems and a stealthy update mechanism to download new attack code."
"To be more precise, we show how to conduct a DMA attack using Intel's Manageability Engine (ME)."
"We can permanently monitor the keyboard buffer on both operating system targets."
Backdoor removal:
The backdoor firmware can be removed by following this guide using the me_cleaner script.
Removal requires a Raspberry Pi (with GPIO pins) and a SOIC clip.
Decoding Intel backdoors:
The situation is out of control and the Libreboot/Coreboot community is looking for BIOS/Firmware experts to help with the Intel ME decoding effort.
If you are skilled in these areas, download Intel ME firmwares from this collection and have a go at them, beware Intel is using a lot of counter measures to prevent their backdoors from being decoded (explained below).
Useful links:
The Intel ME subsystem can take over your machine, can't be audited
REcon 2014 - Intel Management Engine Secrets
Untrusting the CPU (33c3)
Towards (reasonably) trustworthy x86 laptops
30C3 To Protect And Infect - The militarization of the Internet
30c3: To Protect And Infect Part 2 - Mass Surveillance Tools & Software
1. Introduction, what is Intel ME
Yep, that goes both ways. If you have the documents, you can see and prove what was said. When you're right, that's a win.
The big bonus of having documents is that when you have them, most conflicts can be resolved at the "minor misunderstanding" stage, well before it becomes a law suit. Somebody says "I told you X". You reply "oh, I'm sorry, I thought you said 'not X' in your email on January 3rd. Did I misunderstand? Let's discuss changing that. I guess I misunderstood your email, copied below."
Is there a GoFundMe for this guy's legal expenses in defending himself?
knowing the persons involved through an relationship with the data centers targeted there is no way what transpired was above board in terms of "reporting" purely for the sake of journalism.
on the same note; it's a spam sending company - right next to sexual abuse of minors that's about as hated as you can get in society.
here's the rub: the ends don't always justify the means and vickery was most likely used for a mouthpiece, eagerly, to tread where an actual hacker had penetrated and rooted deeply (nuts in their guts deeply) without knowing what he was getting involved in. he was most likely just thrilled that such a greatly righteous breach can gift wrapped with a bow without questioning it.
i'd like to mention too that i think vickery does important work. extremely important work when you think of the scope he's been able to disclose vulnerabilities in.
just be sure that being a good reporter and social warrior for the betterment of mankind doesn't end up associating you too closely with the type of criminal you're attempting to snare.
In the meantime my Junk E-mail folder has dropped from 100-150 spams/day to just 3-5 spams/day. No, River City isn't a spammer at all, are they?
Judges love criticising people for their lack of common sense, now lets see how their common sense works out.
Calling Chris Vickery a security researcher is like calling someone who can put batteries in a TV remote an electrical engineer. Mackeeper is about the only group that would hire him. He does nothing more than scan for open ports and connect to unprotected services. He basically just an overhyped script kiddie. If he had any real skill he would be working for someone other than Mackeeper.