Slashdot Mirror

← Back to Stories (view on slashdot.org)

Two Romanians Charged With Hacking Washington DC Police Surveillance Cameras Days Before Trump's Inauguration (bbc.com)

Posted by msmash on from the stranger-things dept.

US prosecutors have charged two Romanians with hacking Washington DC police computers linked to surveillance cameras just days before President Donald Trump's inauguration. From a report on BBC: The pair are being held in Romania, having been arrested at Bucharest Otopeni airport on 15 December. Mihai Alexandru Isvanca, 25, and Eveline Cismaru, 28, allegedly accessed 123 outdoor surveillance cameras as part of a suspected ransomware scheme. Mr Trump was sworn in on 20 January. The US Department of Justice said the case was "of the highest priority" because of the security surrounding the presidential inauguration. The perpetrators intended to use the camera computers to send ransomware to more than 179,600 email addresses and extort money from victims, the justice department said in a statement.

47 comments

  1. Well ... by psergiu · · Score: 1, Funny

    If they would have declared that they really wanted to interfere with the ingauguration, they would have had some sympathizers.
    But as they just wanted to use those cameras for spamming & ramsomware - to Gitmo with them. Daily waterboarding please.
    And they should be joining by whover's responsible of those cameras security holes.

    --
    1% APY, No fees, Online Bank https://captl1.co/2uIErYq Don't let your $$$ sit in a no-interest acct.
    1. Re:Well ... by OzPeter · · Score: 1

      If they would have declared that they really wanted to interfere with the ingauguration, they would have had some sympathizers.
      But as they just wanted to use those cameras for spamming & ramsomware - to Gitmo with them. Daily waterboarding please.
      And they should be joining by whover's responsible of those cameras security holes.

      So torture for the sake of torture then?

      --
      I am Slashdot. Are you Slashdot as well?
    2. Re: Well ... by Anonymous Coward · · Score: 0

      Yes waterboarding creates answers.

      Also we in the newsroom have a hunch these are actually Russian nationalists disguised as gypsies.

      -=BeauHD=-

  2. I knew it! by Anonymous Coward · · Score: 0

    Even when everyone said russians were behind it the real culprits have been always Vampires!

  3. A stern warning to all foreign hackers by Anonymous Coward · · Score: -1

    Trump should send in the armed forces to 'liberate' Rome to retailiate. We need to send a message we will not tolerate Roman hackers and they will be dealt with fury and fire. I am concerned that we have become using these computers for so many tasks in our everyday and people are going to start using them against us. Do we not care?

    1. Re:A stern warning to all foreign hackers by psergiu · · Score: 0

      Yes ! Send those troops to Rome to show those pizza-smelling Italians that the US cares about it's security as much as it cares about learning geography.

      --
      1% APY, No fees, Online Bank https://captl1.co/2uIErYq Don't let your $$$ sit in a no-interest acct.
    2. Re:A stern warning to all foreign hackers by Hal_Porter · · Score: 0

      Aren't you Romanian? Don't correct him!

      --
      echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
    3. Re: A stern warning to all foreign hackers by Anonymous Coward · · Score: 0

      Easy troll is easy. American geography is cliche.

    4. Re:A stern warning to all foreign hackers by ls671 · · Score: 0

      Who are you kidding? Everybody knows Romania is in Italy.

      --
      Everything I write is lies, read between the lines.
  4. How dumb do you have to be to do this? by Hal_Porter · · Score: 0

    They live in a NATO country which presumably has an extradition treaty with the US and think that hacking outdoor cameras in Washington DC on inauguration day won't cause the NSA/CIA etc to trace them and US authorities to sic the local cops on them.

    Then again maybe Club Fed has better food than whatever shithole in Romania they're from.

    --
    echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
    1. Re:How dumb do you have to be to do this? by psergiu · · Score: 1

      Actually, the food in Romania is better :) But only the food.
      And they do diserve whetever's coming to them.

      --
      1% APY, No fees, Online Bank https://captl1.co/2uIErYq Don't let your $$$ sit in a no-interest acct.
    2. Re:How dumb do you have to be to do this? by war4peace · · Score: 2

      You forgot the women, mate.
      And the tsuica. (diacritics won't work)
      And the freedom. Believe it or not, Romania offers more freedom to the Average Joe than the USA does.

      --
      ...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
    3. Re:How dumb do you have to be to do this? by ls671 · · Score: 2

      They might not have realized that they were outdoor cameras in Washington DC, especially if they were building a botnet as suggested in TFS. Those cameras might just have been part of a much larger botnet.

      --
      Everything I write is lies, read between the lines.
    4. Re:How dumb do you have to be to do this? by Hal_Porter · · Score: 1

      Yes but given that

      1) Washington, DC is politically sensitive location at the best of times
      2) Inauguration Day was coming up which means extreme security and
      3) The FBI/CIA/NSA etc were under enormous political pressure to find 'Russian hackers'

      would it not have been prudent to exclude any IP address that geolocates there for a couple of months? Especially if you're doing it from Eastern Europe?

      If you look at what happened it seemed like the Europol, the UK and the Netherlands all helped out with the investigation I.e. these idiots activated the very effective part of law enforcement that deals with threats to national security, which presumably woke up when politicians started talking about Russian hackers and did its damnedest to catch some.

      http://www.bbc.co.uk/news/worl...

      The EU police agency Europol says three other suspects were also arrested in Romania this month in a linked investigation into ransomware. The UK's National Crime Agency was involved in that investigation.

      The three are suspected of infecting computers with CTB-Locker (Curve-Tor-Bitcoin Locker) malware.

      A Europol statement says Romanian police were tipped off in early 2017 by the Dutch High Tech Crime Unit and other authorities about a group of Romanians sending spam messages.

      The spam emails had attachments made to look as if they had come from well-known companies in Italy, the Netherlands and UK. Once opened on a Windows system, those malicious attachments encrypted computer files.

      It's completely different to the WannaCry attack where no one got caught and North Korea got blamed.

      https://en.wikipedia.org/wiki/...

      The WannaCry ransomware attack was a May 2017 worldwide cyberattack by the WannaCry ransomware cryptoworm, which targeted computers running the Microsoft Windows operating system by encrypting data and demanding ransom payments in the Bitcoin cryptocurrency. It propagated through EternalBlue, an exploit in older Windows systems released by The Shadow Brokers a few months prior to the attack. While Microsoft had released patches previously to close the exploit, much of WannaCry's spread was from organizations that had not applied these, or were using older Windows systems that were past their end-of-life. WannaCry also took advantage of installing backdoors onto infected systems.

      The attack was stopped within a few days of its discovery due to emergency patches released by Microsoft, and the discovery of a kill switch that prevented infected computers from spreading WannaCry further. The attack was estimated to have affected more than 300,000 computers across 150 countries, with total damages ranging from hundreds of millions to billions of dollars. Security experts believed from preliminary evaluation of the worm that the attack originated from North Korea or agencies working for the country.

      In December 2017, the United States, United Kingdom and Australia formally asserted that North Korea was behind the attack.

      Mind you WannaCry probably helped wake up international law enforcement too. I.e. it's another reason these guys got caught effectively.

      --
      echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
    5. Re:How dumb do you have to be to do this? by wolfie_cr · · Score: 1

      women for sure 100% yes about freedom...yeah dragnea likes that freedom quite a bit (I am not romanian but I love the country )

    6. Re:How dumb do you have to be to do this? by Anonymous Coward · · Score: 0

      would it not have been prudent to exclude any IP address that geolocates there for a couple of months? Especially if you're doing it from Eastern Europe?

      Those cameras get their connectivity over an MPLS network that terminates at a contracting company in Maryland, and use IPs registered as such with ARIN.

      Even if you had the goal of excluding IPs registered to places in Washington, you would need to be aware of the fact not all Internet devices in Washington have IPs registered to anything within Washington.

      Especially being from Europe I would expect this knowledge to not be known at all. Most Americans don't even know.

      That said, I too doubt they bothered to exclude anything from their lists.
      With the fact they are ransomware authors in any case, I don't have any sympathy for their current plight.

    7. Re:How dumb do you have to be to do this? by Hal_Porter · · Score: 1

      Well to be honest if I were in the ransomware business I'd probably have not targeted the US at any time. Then again the UK's not that much safer given NSA/GCHQ collaboration, and the WannaCry people did target that.

      Maybe they really were North Koreans and knew they'll never set foot in a country that will extradite them.

      I wonder if NSA/GCHQ have thought about some sort of firewall on NK's internet access? Or, given that they must use a foreign ISP to get to the wider Internet and that ISP could probably be persuaded to disconnect them if they're breaking the terms of service by sending ransomware.

      Then again they probably connect via a Chinese ISP in a way that the Chinese government can claim it doesn't know anything about.

      --
      echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
    8. Re:How dumb do you have to be to do this? by war4peace · · Score: 1

      That's why I was talking about the freedom the Average Joe has - which is the freedom to do things Average Joes do - aka "not politics".
      Like being able to drink in a bar all night long, rather than have a curfew at 2 AM.

      --
      ...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
    9. Re:How dumb do you have to be to do this? by AHuxley · · Score: 1

      With NATO distracted by looking for Russian bear in forests, people think the security services in NATO cant still collect it all domestically.

      --
      Domestic spying is now "Benign Information Gathering"
  5. Heroes. by Anonymous Coward · · Score: -1

    Whatever the purpose of their hack, glad that it interfered with the inauguration and likely helped protesters avoid prosecution. I'll drink to them tonight.

    1. Re: Heroes. by Anonymous Coward · · Score: 1

      I bet you've been drinking every night since the 20th January.

    2. Re:Heroes. by Anonymous Coward · · Score: 0

      Uh what? Protesting is entirely legal. It might have prevented some hooligans from being prosecuted but it probably increased the chances of actual protesters (and journalists, etc) being prosecuted as it wasn't as easy to prove they weren't doing what police claimed they were doing.

    3. Re:Heroes. by Hal_Porter · · Score: 1

      Whatever the purpose of their hack, glad that it interfered with the inauguration and likely helped protesters avoid prosecution. I'll drink to them tonight.

      The black block rioted in full view of the TV cameras. Many trash cans were grievously assaulted.

      https://www.youtube.com/watch?...

      Unfortunately these were government trashcans and you don't need to assault very many of them to be over the $5000 limit you need to get a felony riot conviction in DC. Even inciting other people to do more than $5000 property damage is enough

      https://beta.code.dccouncil.us...

      (d) If in the course and as a result of a riot a person suffers serious bodily harm or there is property damage in excess of $5,000, every person who willfully incited or urged others to engage in the riot shall be punished by imprisonment for not more than 10 years or a fine of not more than the amount set forth in Section 22-3571.01, or both.

      So some of them are going to get ten years for felony rioting, sometime in 2018. They fought the trash cans, and the trash cans won.

      https://www.washingtonpost.com...

      Jury selection began Wednesday for the cases of the first defendants to face trial in the Inauguration Day riots in downtown Washington, with the judge quickly asking prospective jurors about their views.

      "What I am asking you is whether anything you may have heard about that day would keep you from fairly and impartially deciding this case? What are your feelings about the president and Inauguration Day, and will those feelings keep you from fairly and impartially deciding on a case and viewing evidence?" D.C. Superior Court Judge Lynn Leibovitz asked the 70 panelists.

      The six defendants, whose trial could begin as soon as Monday, are charged with felony rioting in the Jan. 20 disruption that left several businesses vandalized and resulted in thousands of dollars in damage.

      In all, prosecutors charged 212 people in connection with the riots. So far, 20 have pleaded guilty and prosecutors dropped cases against another 20. Trials for the others, in groups of five or more, are set to occur almost monthly through mid-2018.

      Prosecutors allege that a group called Disrupt J20 helped plan protests that pulled in participants from across the country. They said some rioters used "black bloc" tactics - wearing all black and hiding their faces with masks and goggles so it would be harder to identify them.

      The first defendants to face trial are Michelle Macchio, 26, of Naples, Fla.; Jennifer Armento, 38, of Philadelphia; Christina Simmons, 20, of Cockeysville, Md.; Alexei Wood, 37, of San Antonio; Oliver Harris, 28, of Philadelphia; and Brittne Lawson, 27, of Pittsburgh.

      The trial is expected to last through mid-December.

      The six defendants face felony counts of inciting a riot and destruction of property, charges that carry a maximum penalty of 10 years each.

      Interesting how most of them seem to come from red states - Florida, Philadelphia, Texas were all Red. Maryland was blue.

      https://en.wikipedia.org/wiki/...

      I think a lot of antifa/far left types are rebelling against their Republican voting parents, who I'm sure will be very sad when they end up with ten years in prison. It's a shame really, I bet their Mummies and Daddies are lovely people.

      --
      echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
    4. Re:Heroes. by thedavidcathey · · Score: 2

      From the article, it looks like it didn't have any impact on the cameras or inauguration security. It was just infected with a mail-bot that sent ransomware spam, much like thousands of other computers. Although, even the article is written poorly. One part says it's "computers linked to surveillance cameras" and another part says "accessed 123 outdoor surveillance cameras". The first one is probably correct - they got their ransomware mailbot installed on some Windows computers used to access the cameras, and it was sending out ransomware. The fact that they were used to access cameras isn't relevant. However, I think the fact that these are police computers, and police were likely doing other things on them (browsing, email) that got them infected, probably is relevant.

    5. Re:Heroes. by Anonymous Coward · · Score: 0

      LOL. Sorry, but when your evidence includes James O'Keefe produced material, and you're not prosecuting said convicted criminal, you have as bad a credibility problem as certain Alabama loser.

      Don't worry, you have this genius to make you look better.

    6. Re:Heroes. by Hal_Porter · · Score: 1

      What on Earth do James O'Keefe and Roy Moore have to do with this?

      It's not like anyone is disputing the fact that Black Bloc rioted on inauguration day.

      E.g.
      https://duckduckgo.com/?q=dc+i...

      --
      echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
    7. Re:Heroes. by Anonymous Coward · · Score: 0

      What on Earth do James O'Keefe and Roy Moore have to do with this?

      You could have read the links. Well, maybe not, aren't you sworn only to let yourself see that which comes from authorized and approved channels?

      Wouldn't want you to break your solemn oath.

      It's not like anyone is disputing the fact that Black Bloc rioted on inauguration day.

      It's not like anyone believed you when you were crowing the truckers either.

    8. Re:Heroes. by Hal_Porter · · Score: 1

      I did read the links. O'Keefe does hidden camera investigations. The fact he did one into AntiFa isn't the only evidence against them. And the charges against O'Keefe are politically motivated bullshit - his sin was exposing the lies and bias of leftist media organisations and NGOs.

      --
      echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
    9. Re:Heroes. by Anonymous Coward · · Score: 0

      I did read the links. O'Keefe does hidden camera investigations. The fact he did one into AntiFa isn't the only evidence against them. And the charges against O'Keefe are politically motivated bullshit - his sin was exposing the lies and bias of leftist media organisations and NGOs.

      Nope. His sin was being a lying bullshit spewer, which lead to him becoming a criminal, your sin, of course, was to believe him. Repetitively.

      Any prosecutor dumb enough to allow such a taint into a trial, well, no wonder incompetence is rampant.

      But hey, keep relying on them, it's a big sign that you've got less than nothing.

  6. Windows computers, not cameras by Anonymous Coward · · Score: 0

    Security needs randomness. Running your security on internet connected Windows computers is not very random.

  7. Vindication!! by OzPeter · · Score: 2, Informative

    They hacked the cameras to show that the number of people in the crowd was much less than the great number who actually attended!

    --
    I am Slashdot. Are you Slashdot as well?
    1. Re:Vindication!! by greenwow · · Score: 1

      The media's pictures from weird angles and from 2+ miles away from the stage did just fine at that. They didn't need any help.

    2. Re:Vindication!! by OzPeter · · Score: 0

      The media's pictures from weird angles and from 2+ miles away from the stage did just fine at that. They didn't need any help.

      Way to ruin a joke with facts there.

      --
      I am Slashdot. Are you Slashdot as well?
    3. Re:Vindication!! by Whibla · · Score: 1

      With somebody modding you (parent) informative, rather than funny, I can't help thinking that it's time we all started filling in some of our foxholes, rather than burying ourselves any deeper.

    4. Re:Vindication!! by OzPeter · · Score: 1

      With somebody modding you (parent) informative, rather than funny, I can't help thinking that it's time we all started filling in some of our foxholes, rather than burying ourselves any deeper.

      I'm as bemused as you. I even hit +4 informative at one point

      --
      I am Slashdot. Are you Slashdot as well?
  8. Tired Dupe on a Tard Site by Anonymous Coward · · Score: 0

    Seriously editors, this is a duplicate. I know most of you aspire to go "work" at Buzzfeed and Gawker, but even they don't publish duplicates all the time.

  9. ....and? by Anonymous Coward · · Score: 0

    How did they use that access?

    1. Re:....and? by ls671 · · Score: 1

      It's in TFS, the cameras were apparently part of a botnet. They might have gotten access to them with automated scripts and they might not even have realized that the cameras were outdoor in Washington DC as far as I can tell for now.

      --
      Everything I write is lies, read between the lines.
    2. Re:....and? by AHuxley · · Score: 1

      Re "use that access?" in some fictional way?
      If someone was thinking of a fictional movie script and what to do with control of CCTV looking at and into every US gov, court building?
      Get CCTV from all US federal, city and court buildings 24/7.
      The face, face of passenger licence plate of every DoJ, other federal agency, state/city police officer, city investigation, court worker, state/federal funded task force member, police informant, undercover police office.

      Police and security will do field interview if they see DSLR near their building.
      They just don't think all the city, private sector CCTV could be used to track all law enforcement officials because that software and hardware is so gov/mil restricted.
      Bonus if can get voice print and cell phone details too :)
      That would make a great fictional movie plot. Building security always watch for stranger with DSLR not what all the CCTV can see. CCTV is always used by good people.

      --
      Domestic spying is now "Benign Information Gathering"
  10. Days more like month by Anonymous Coward · · Score: 0

    Days is days weeks are weeks and a month whole month before is not days

    Arrested Dec 15 became president Jan 20

    Get your story str8

  11. The Roman Empire ! by Anonymous Coward · · Score: 0

    Live And Kicking !

    Now we know it is not the east Romans ("Russians"), it is the WEST ROMAN CONSPIRACY !

    Who notifies Hillary ?

  12. Meh by Anonymous Coward · · Score: 0

    NSA-GCHQ could have found and shut down many more botnets IF THEY WANTED.

    But they are most of the time after something else: Juicy communications of the world's politicians and top military leaders. Why should they care too much about taxpayer's computer security ?

    1. Re:Meh by Hal_Porter · · Score: 1

      I think WannaCry freaked them out. It only hit XP but it hit the NHS hard

      https://en.wikipedia.org/wiki/...

      One of the largest agencies struck by the attack was the National Health Service hospitals in England and Scotland,[87][88] and up to 70,000 devices â" including computers, MRI scanners, blood-storage refrigerators and theatre equipment â" may have been affected.[89] On 12 May, some NHS services had to turn away non-critical emergencies, and some ambulances were diverted.[90][91] In 2016, thousands of computers in 42 separate NHS trusts in England were reported to be still running Windows XP.[35] NHS hospitals in Wales and Northern Ireland were unaffected by the attack.[92][90]

      The US seems to have been rather unaffected - presumably Microsoft bullied most organisations into either upgrading from XP or paying for security patches. FedEx seems to be the only thing hit.

      https://en.wikipedia.org/wiki/...

      Then again the NSA developed the exploit it used

      https://en.wikipedia.org/wiki/...

      So perhaps they made sure US stuff was patched.

      Still how many times have you gone into some dodgy organisation like the NHS or FedEx which would cause deaths if it shut down and seen machines running very old versions of Windows? And of course it's not out of the question for the people who did WannaCry to buy some zero days for newer versions of Windows on the black market or even discover them themselves. After all if you watch the CCC videos there are clearly loads of possibilities out there.

      If WannaCry had been able to target more modern versions of Windows with a zero day, the results would have been much worse.

      So I reckon the NSA and GCHQ are paying attention now.

      Basically open societies have loads of insecure computers. People in a closed society have lots of time to find backdoors. Living in a closed society doesn't make you dumb and smart people in one would know some sort of cyberweapon to strike down enemies of the regime is the way to a privileged life.

      --
      echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
  13. Horrible US Security by Anonymous Coward · · Score: 0

    If you think about this, it just shows how horribly incompetent at least large segments of the US security apparatus are.

    By 2017 one should know about "cyber threats". The cameras should be firmly locked behind some sort of Private Network/VPN/Firewalls.

    Just think what Foreign Intelligence can do by accessing cameras in a capital city. If these Romanian hackers got into it, you betcha the FSB or the North Koreans do it before the breakfast break. And then they can nicely aid their operatives in the city; remotely assisted by a crypted smartphone comms link.

    Sometimes I believe that is actually what the authorities want. They want to be able to access ANY DEVICE, ANYWHERE over the network. Maybe they have a gent's agreement to use each other's cameras when they feel a need for it.

  14. 9-11 was a Jew job by Anonymous Coward · · Score: 0

    ae911truth dot org

  15. So let me guess by Plumpaquatsch · · Score: 1

    Next claim by Trumpists will be that those hackers faked all the photos that made it look like there weren't 2 million people at the inauguration.

    --
    Of course news about a fake are Fake News.
  16. Crowd Size by Anonymous Coward · · Score: 0

    They heard he was going to have the biggest crowd ever, and wanted to check it out (but not enough to hop a plane)