Law Enforcement Are Hacking the Planet (33c3)

33C3 preroll music

Herald: The talk is gonna be called
“Law Enforcement Are Hacking the Planet”

by Joseph Cox. Joseph is an investigative
journalist for Vice’s Motherboard,

covering hackers, data breaches
and digital security. When I went

to check him out and looked at his Twitter
account I discovered I already follow him.

Which is funny, or it was for me
a little anecdote about the modern world.

I recognized his avatar immediately
but not his name.

I guess that's just something
about how we live these days.

So then with no further ado, Joseph,
I’d like to give it over to you.

applause

Joseph Cox: Hello, hello hello.

How would you react if the FBI
came over from the United States,

came into Germany, went to an apartment
in, say, Hamburg, kicked down the door

and then started searching the apartment?

They haven’t been invited
by German law enforcement,

they’re acting on their own accord.
They then seize a load of evidence

and go back to the States.

You might think this isn’t a great thing,
I mean what does the FBI have to do

coming in to another country and then

searching buildings or arresting suspects?

But the searching is essentially
what the FBI is doing, but digitally

with malware and hacking tools. Breaching
into computers in other countries,

extracting evidence from them
and then sending them back to

a government server in Virginia,
or wherever it may be.

To clear, we’re not talking
about a normal intelligence agency here

like the NSA or GCHQ. They’re
gonna hack computers internationally

all the time as part of espionage,
we expect that, maybe that’s a good thing.

Here we’re talking about
an agency that’s predominantly

focused with the law enforcement
hacking to computers in other countries

as part of criminal investigations.

I’m gonna talk about one FBI case in
particular, briefly touch upon another one

and then just explain an operation
that was led by local Australian

law enforcement which hacked
computers in the United States.

At the moment, typically, these sort of
investigations are done to counter

child sexual exploitation
or child abuse on the Darkweb.

Just about me, briefly:
Journalist for Motherboard as mentioned,

which is the Technology and Science
part of Vice. Hackers, cybercrime,

the Darkweb drug trades or
stuff like Silk Road or the usual stuff.

But for the past year I’ve been really
interested in law enforcement’s

international use of malware.
Which brings us to

“Operation Pacifier”.
The FBI is not very good at naming

its child sexual exploitation
investigations.

So in August 2014 a new Darkweb child
abuse site was launched, called “Playpen”.

It was a Tor hidden service,
meaning that the majority of people

who connect to it would do so
over the Tor anonymity network,

masking their real IP address.
But because it ran as a hidden service

the physical location of the server itself
was also protected.

Meaning that the FBI couldn’t just go and
immediately subpoena the hosting company

or seize the server whatever may be,
because they didn’t know where it was.

A few months passed and Playpen is a
really, really big deal. It’s the largest

child pornography site on the Darkweb.
215.000 members,

117.000 posts, and an average
11.000 unique people

were visiting every week.

The FBI was trying to find a way in,
they were acting in an undercover capacity

on the site as law enforcement often do
with these sorts of hidden services.

But at one point a foreign law enforcement
agency, and we don’t know which one,

provided the real IP address
of the Playpen server to the FBI.

It turned out that Playpen’s administrator
who’s now been convicted, Steven Chase,

he’d misconfigured his server
so the real IP address was exposed

in the normal internet.
So in February 2015

the FBI go to the North Carolina
Data Centre, they seize the server

and they take control of Playpen.

Just as a side note:
Steven Chase, the administrator,

he had paid for the hosting via a Paypal
account in his own name.

So it was incredibly easy to convict him.
If you’re gonna run

an illegal Tor hidden service,
don’t use Paypal!

And this is where the hacking comes in.

Even though the FBI is in control of the
site – they can see what people are doing,

what videos they’re watching,
as mentioned – they can’t see

where these people are coming from
and they can’t identify them.

So they need another way,
and what they decided to do

is hack the computers of individual users.

Very, very shortly after the FBI seized
the server they started to run it

from a government facility in Virginia.
So the site is fully functioning,

except one section that encourages people

to produce more child porn. It’s still
a fully functional website, though.

They run that and the FBI deploys what
it calls a “Network Investigative Technique”,

an NIT or nit or what we would probably
just call “a piece of malware”.

In short, and this is a really, really basic
overview the nit just did several things.

First somebody would log in to Playpen
and then go visit a specific

child porn related forum.
The exploit is then automatically

delivered to that computer.
This exploit certainly affected…

and the underlying vulnerability
certainly affected the Tor browser.

We don’t know if it affected Mozilla
Firefox. As many of you will know,

Tor browsers are oftenly based on Firefox,
and they share much of the same code base.

But we don’t actually know
much about the vulnerability

or the exploit at all.
All that we know is that they used

a non publicly known vulnerability.

And then when the exploit is delivered the
rest of the code causes the target machine

to phone home outside of the Tor network
to a government server, and now the FBI

has a real IP address.

Armed with that the FBI just goes to the
ISP, Comcast, Verizon, gets a name,

subscriber details and address,
kicks down a door, arrests the person

– if there’s enough evidence – and
presumably, and in many many of the cases

if not all of them, find a lot of child
porn on the suspect’s machine.

But that’s not everything
the FBI collected with a nit,

it also got the username,
the host name, the MAC address.

And it also generated a unique code
per unique infection, I think

that you could then use to correlate
activity on the site with an IP address.

And just remember this whole time
the FBI could see what people

were doing on the site, so “user Jimmy
went onto this section of the site

and looked at this thread,
now we have his IP address,

we can link it to that”.

So the FBI deploys its malware,

for 13 days it runs the site.
Over that amount of time,

100.000 users log into Playpen,
which as you’ll notice

is a lot more than 11.000, which
was apparently the average login rate.

For some reason the site became a lot more
popular when the FBI was running it.

You can hear whatever you want from that. (?)

So in the U.S. the FBI gets around 1300
IP addresses of U.S. users of the site.

Europol say they generated 3229 cases

– I haven’t highlighted it, but it’s
in the middle column at the bottom –

and 34 of those were in Denmark.
This is a presentation I just found online

when I found out it was called
“Pacifier”.

I searched that, filetype:pdf and
someone from law enforcement had

left this online, so that was convenient.
laughter

Austria, staying with this
part of the world,

I think this is a letter from an MP
to a group of politicians

just talking about the country’s
child porn investigations

and it mentions Operation Pacifier
and 50 IP addresses so the FBI hacked

at least 50 computers in Austria.
Latin America as well.

Again, this is another presentation
that I found online,

law enforcement are really, really sloppy

with just leaving all this stuff
online, which is great.

And you can just see Operation Pacifier
there. As for Chile it was

local media reports that just said
‘Pacifier’, ‘Playpen’, ‘child porn arrests’

so it was pretty easy to infer that
computers were hacked there as well.

Australia – this is part of a
freedom of information request

I made with the Australian federal police,
asking for documents and communications

about Operation Pacifier. This isn’t
actually the result of the request

this is them saying “Hey, we have
too much stuff on Operation Pacifier,

so we can’t give it to you” which
obviously already gave me

enough information to confirm that
Pacifier hit Australia as well.

Anyway, you get the idea. I’m not
just gonna list all these countries

apart from them. The U.K. and Turkey
were probably hacked as well.

But it turns out the FBI hacked computers
in many, many more countries.

And this just came out
end of last month, I think.

In total the FBI hacked
8.700 computers in 120 countries.

8.700 in 120 countries with one warrant.

And arguably that warrant was illegal.

But we have to back up a little bit,
just to see what that is.

Right, okay.
So the U.S. has something called Rule 41,

which dictates when a judge
can authorize searches

including remote searches, so hacking.

A judge can only authorize a search
within his or her own district.

So if the judge is in the
western district of Washington,

he or she can only sign a warrant
that’s gonna search stuff

within that district. With a few
exceptions. I think, terrorism,

and if there’s a tracking device
and then the person moves out of state

it’s still okay.
In the case of Playpen,

Judge Theresa Buchanan
was in the Eastern district of Virginia,

as you can see at the top.
Clearly, the vast majority of computers

were not in the Eastern
district of Virginia.

The search warrant application which is
that document that the FBI presents

to a judge, and say “Here’s our reasons,
please sign our search warrant!”,

it said that what was gonna be searched
was computers logging into Playpen,

wherever located. It’s pretty
debatable how explicit that is.

I mean, the FBI did not write “Hey we’re
gonna hack into computers no matter

what state they’re in, what country
they’re in, anything like that, and

we’re gonna hack into them”. The word
‘hack’ is obviously never ever used in the

search warrant application.
So with that in mind it’s kind of unclear

if Judge Theresa Buchanan would have
actually understood that she was signing

a global hacking warrant. And this isn’t
castaging the judge, at all. It’s more

that these warrants applications aren’t
very explicit. And it’s still unclear

because Judge Buchanan won’t respond
to my requests for comment.

So wherever operation Pacifier violated
rule 41 has probably been the central

component of all the legal cases that came
out after the FBI started dusting people.

Defense lawyers have brought it up, saying
“Hey, this judge did not have authority,

you now need to throw out all the
evidence against my client”.

According to the most recent figures, and
this might be very, very slightly out-of-date

21 decisions have found the operation
did violate rule 41. Out of those,

judges in four cases have thrown out all
evidence obtained by the FBI’s malware.

So that obviously includes the main bit
of evidence which to the IP address

but then also everything that came after
that. I mean the only reason the FBI

found child porn on people’s devices is
because the IP address led them there.

So all of that child porn is also struck
from the record as well.

And those people are essentially free,
by DOJ appeals which are ongoing.

Whether people based outside the United
States will have a similar sort of defense

is kind of unclear at the moment. The
IP address could fall under something

like the Third-Party Doctrine, whereas in:
if there’s a German suspect,

and they tried to challenge the legality
of the search the German police may say:

“Hey, look, we didn’t do the hacking,
we just got given this IP address

by third party”. And then the defense
might not have much like to stand on.

But I do know of one lawyer in a country
outside the U.S. who is going to challenge

the legality of that hacking operation.
I can’t really say where he is right now

because I think that’s still sourcing out (?)
but that’s gonna be really, really interesting

when that happens, hopefully in the new
year. So forget everything I just told you

about Rule 41 because it doesn’t matter
any more. Earlier this month changes

to Rule 41 came into place. Meaning that
judges now can authorize searches

outside of their district. So if the Playpen
warrant was signed today it probably

would not violate Rule 41, and the FBI
wouldn’t have done anything wrong.

Or the DOJ wouldn’t have done anything
wrong. And I just wanna emphasize that

these changes to Rule 41 came about
in part, specifically because of

the problem that anonymity networks and
Tor present to law enforcement.

It’s not like Operation Pacifier was over
here, FBI doing its thing, and the DOJ

was sorting out these Rule 41 changes. The
changes have come specifically in response

to criminal investigations
on the so-called “Darkweb”.

And that’s just this Department quote
here: “We believe technology should

not create a law-less zone merely because
a procedure rule has not kept up

with the times”. Their argument is that
the Rule 41 is basically an antique,

and they need to change the rules to keep
up with criminals that are using stuff

like Tor or VPNs. So that was Pacifier.

That’s the largest law enforcement hacking
operation to date that we know about.

Just very, very briefly I’m gonna talk
about another FBI one where they likely

hacked into computers abroad. This one
is called “Torpedo” which is even worse

than Operation Pacifier when it comes
to child porn names.

In 2012 or 2013 the FBI take over
Freedom Hosting which is

sort of a turnkey hosting provider.
You sign up to the service

that hosts your Darkweb site. It doesn’t
matter if it’s legal or not, whatever.

The FBI sees it, they deploy an NIT
again, a piece of malware.

And this time the FBI trying (?) identify
users of 23 different child pornography sites.

In the warrant application there’s
a section specifically about

a Hungarian language site.
I mean even the FBI officer

– I think it’s the FBI writing it – says:
“Oh, if you put this into Google Translate

it means this, it’s Hungarian, blablabla”.
As I mentioned in the Playpen example

the FBI did not know where the computers
that they were going to hack

were located. This is an interesting case
because I’m going to guess

that a lot of the users of a Hungarian
language site are probably in Hungary.

So the FBI might have had some idea
that they were gonna hack computers there.

Did the FBI warn Hungarian law
enforcement? Did they get permission

of the Hungarian authorities to hack
computers in their country?

We don’t know yet.
And I somehow doubt it.

And then just finally it’s – excuse me –
it’s not just the FBI

that’s using hacking tools
to target suspects overseas.

A local Australian police department,
Queensland Police,

has a specialized task force
for child sexual exploitation,

Taskforce Argos.

And they were the ones that led this
operation. There wasn’t any sort of

an official statement from Queensland
Police saying: “Hey look, we unmasked

all of these criminals in the U.S.”.
It was only by piecing together

pretty spread-out (?) U.S. court documents
that I could map the contours of this

hacking operation that everyone
kind of wants to keep quiet about.

So in 2014 Taskforce Argos take over
another Darkweb child porn site

called ‘The Love Zone’. They run it – not
for 13 days like the FBI but for 6 months,

posing as the site’s administrator
who they’d already arrested.

According to one document – not this one –
the Australians obtained at least

30 IP addresses of U.S. based
users of the site. I don’t know

about other countries yet, it’s only
through these U.S. court documents

that we’ve been able to figure this out.
And the way they did it was

pretty different to the FBI. What they
would do is they would send a link

to a suspect, for a video file.
The suspect would click the link,

they will get a warning, saying: “Warning,
you’re opening a file on an external site,

do you want to continue?” Something to
that effect. If the person ignored

the warning and clicked “Yes”
a video of real child pornography

played on the supect’s machine,
and then that video phoned home

to an Australian server. I mean, you can
debate whether this is hacking or not.

I mean the FBI weren’t clearly delivering
a Tor browser exploit with malware etc.

Is this hacking? I would say so. If we
think the phishing for Government e-mails

is hacking – sure. But that’s kind of the
trivial debate, anyway. The real debate

is: was this a search in illegal sense of
the word? Did the Australians obtain

information from a private place, namely
a private computer, in a private residence,

and did they get a search warrant to do
that? And again, we don’t know,

because they wont't talk to me.

So clearly, that was all about child abuse
and child pornography investigations.

Insofar this sort of international hacking,
as far as we know, as far as I know,

has only been used for those sorts of
investigations. But as for the future

with Rule 41, the changes there, we could
presumably see it to go to other types

of investigations, maybe Darkweb drug
markets. Plenty of these markets have

dedicated vendor-only sections that you
can only login to if you are a drug dealer

on the site. I mean here, this isn’t from
NIT or a malware investigation.

This is when Carnegie Mellon University
attacked the Tor network, obtained

IP addresses, and then gave those – well,
was subpoenaed for those and gave them

to the FBI. But the key part is that in
this search warrant it’s saying: “Hey look,

there’s probable cause because this
suspect was logging in to the

drug dealer-only section of Silk Road 2.0
so we have reason to raid his house”.

I can easily see this sort of section
being in a malware warrant or an NIT

warrant, as well. And then I suppose the
other more obvious example

– if that hasn’t happened already –
is putting a piece of malware to hack

suspects internationally on a Jihadi
forum. Maybe in administrator or moderator

sections, so you know you’re gonna be
targeting high-ranking members of the forum.

I mean I personally don’t know if that
would be the FBI or another agency

doing that. But that’s clearly somewhere
where malware can be useful

in international context. But apart from
predicting where this might go, I mean,

clearly this is gonna continue, just a few
weeks ago there was a Firefox zeroday

out in the wild. Me and my colleague
Lorenzo tracked it back to a specific

child porn site in the Darkweb where
that 0-day had been deployed.

So this is an active thing.
This is still going on.

And that’s it. But… just a last thing
if you have any documents, data,

information, tips on FBI malware,
law enforcement malware, who is using it,

who is buying it, how they’re using it –
these are my various contact channels.

Thanks a lot!
applause

ongoing applause

Herald: Thank you, Joseph.
Thank you.

Any questions from the audience?

Oh, we got one on [microphone] 4.

Question: Thanks for the talk.
Really nice. Quick question,

you’ve presented
some pretty illegal things.

On both sides.
On child pornography,

and all of those things.
And on the law enforcer’s side.

Now my question is, did you intentionally
mention those really illegal aspects

like child pornography to justify the
actions of the FBI in any way?

Joseph: You mean, did I specifically
speak about child pornography

to justify the FBI’s actions?
Question: Yes.

Joseph: No. This is just… I mean child
pornography and child sexual exploitation

is where law enforcement are using the
really cool stuff. This is where they’re

using their Tor Browser exploits. This is
where they’re using their Firefox zerodays.

And I’m just attracted to where the cops
are doing interesting things.

So, if it was on drug markets I’d cover
that as well. But at the moment,

at least to my knowledge, it’s just
localized to the child pornography

investigations. Presumably, because law
enforcement feel like not many people

are going to argue with them with maybe
doing illegal search for child porn

because everybody finds that crime
abhorrent. But, no, that’s just

how it is at the moment.

Question: Okay, let me rephrase that.
Do you feel it’s justified for them

to use exploits?

Joseph: Do I feel it’s justified for
them to use exploits? I don’t think

it’s anything intrinsically wrong
with law enforcement hacking.

But even though child pornography is
an absolutely disgusting crime

and I can’t find it, obviously, any way
to justify it I also want law enforcement

to follow the law.
And to respect the law as well.

applause

Question: Thank you.
ongoing applause

Herald: Any other questions?
Anybody from IRC?

The (?) on 5, go ahead.

Question: Well, I wanted to ask probably
the same question whether it’s dubious

from the moral point of view?
And you already answered it.

You don’t see it dubious as I understand,
right? As the legislation can be questioned,

and should be rearranged there is not much
ethical discussion whether this should be

done or not. But while you were at the
topic for a while: do you have any other

proposals how to resolve this issue,
maybe? Technically,

from the technical point of view.

Joseph: Sure. So I mean, just before
I answer that I just wanna make clear

that I’m, like a journalist,
not an activist or a technologist.

I don’t think it will be right for me to
say this is how we should combat this.

I’m just saying, hey, that’s what
the FBI did. That sort of thing.

But to answer the question, I think
Mozilla and Tor have been working

on a way to stop this sort of
de-anonymization attack, that,

when the FBI would hit a computer with
their exploits and then the NIT code

would deploy, that’s not enough. I really
can’t remember the technical details

off the top (?) in my head, but there is an
article online that I wrote.

But then they would have
to break out of the sandbox as well.

But more to answer your question
generally: there are technological solutions

that people are making here. And they
could be live pretty soon. But then

what is the FBI gonna do after that?
They’re not gonna stop making malware.

They’re gonna… they’ll deploy a nit that
will then rummage through your computer

and find incriminating documents and then
phone home. If they can’t get your real

IP address they’re gonna
get evidence somehow.

Herald: No.1 was up next.

Question: Hi Joseph. In your background
research on law enforcement

using technology like this to target child
porn sites. So you profiled the FBI

on how they may have (?)(?) around
some of the letter of the law

in order to get done the job they needed
to get done. Are the other law enforcement

agencies you found that are kind of like
a gold standard in their approach

to solving this problem that abide
by the rules, and maybe

solve this problem in a different way?

Joseph: When you say… so the question
was, are there other law enforcement

agencies who may be better or the same
sort of standard (?) as the FBI this problem.

When you say “this problem” you mean
“combating child porn on the Darkweb”?

Question: Yeah, clearly something needs to
be done about these sites. And there’s

a limited number of options available.
So the FBI is kind of busted out (?)

in trying every single piece of technology
they can to solve it. But are there others

that maybe take a more restraint approach
but still solve the problem?

Joseph: When it specifically comes
to malware I haven’t seen much

in the wild or publicly but in the U.K.
GCHQ, the country’s

signals intelligence agency has said,
or a report said, it is using

bulk interception, so GCHQ’s mass
surveillance capabilities, to do

traffic correlation attacks, and they
can then unmask Darkweb users

and hidden service IP addresses.
That’s not malware but that is

an extreme use of technological
capability, I guess.

And yeah, we could definitely see
more of that. I think in the report

the Home Office said the GCHQ had got
something like 50 individuals

in the past 18 months through bulk traffic
analysis. That’s not malware,

but yeah, that’s where stuff could go,
definitely.

Question: Cool. Thanks.

Herald: I give you one last question,
it will be number 4, over here.

Question: Hi, I was wondering, because you
mentioned bulk analysis which I considered

to be significantly worse than targeted
analysis, in the way that it violates

everybody’s liberties rather than specific
individuals who are definitely engaging

in criminal activity.

So why is it you feel that there’s
some kind of violation,

like these people they need to find
these criminals, and the jurisdiction

needs to be significantly wider,
and I understand that it’s terrible

that they’re hacking us. But at the same
time they need to be caught. So how

can they make legislation that’s
able to find these people legally

when it’s outside of their jurisdiction,
and they might be targeting people,

if they’re doing a dragnet on a website,
like you’re example. And they’re gonna be

hacking people that are not in their
country. They can’t limit it to the people

that are in that country. And only hack
those people. It’s technically impossible.

So what’s the solution for this?

Joseph: I mean, some senators in the US
did propose a Stop Mass Hacking Act

which would have blocked the Rule 41
changes. It was unsuccessful, and

in part – this is just my personal
opinion – I think it’s because they

didn’t present a viable alternative.
I mean, as you say, these people

need to be caught, I mean, that sort of
thing, but when these senators said:

“Yeah, we need to stop all this global
hacking” there was no alternative presented,

so we don’t know, basically.
As for legislative changes

I think it’s more… it’s less the
“Hey, here’s a concrete law or rule

that we need to fix right now”, it’s more
like there’s a looming issue of

“What happens when the FBI hacks a child
pornographer in Russia, or one who happens

to be a politician in another country?”
Are they still gonna go, and then go

to local law enforcement, “Hey, we got
this IP address of one of your senior

politicians who happens to be looking at
child porn”. I mean what are the ramifications

of that gonna be? But to answer your
question: we don’t really know.

It’s more of just this looming issue that
law enforcements are firing malware

and asking questions later.

Herald: Thank you so much. If you got
a round of applause for Joseph Cox!

applause

postroll music

Subtitles created by c3subtitles.de
in the year 2017. Join, and help us!