The FBI invades corporate computers to remove malicious passwords. Smart cyber defense or government domination?
Recent FBI cybersecurity moves bring new space inside the government, inside private computers. AP Photo / Cliff Owen The FBI currently has the right to access private computers without the knowledge or consent of their owners, and to delete the software. It’s part of the government’s attempt to curb ongoing attacks on corporate networks running Microsoft Exchange, և it’s an unprecedented intrusion that raises legal questions about how far the government can go. On April 9, a U.S. court in southern Texas upheld a search warrant that allowed the U.S. Department of Justice to carry out the operation. The program, which is deleted by the FBI, is a malicious password set by hackers to control the victim’s computer. The hackers used the password to access a large number of private e-mails and launch ransomware attacks. The authority that the Ministry of Justice had hoped for, the way the FBI operated, was a precedent. They also raise questions about the jurisdiction of the courts to regulate cyber security without the consent of the owners of the targeted computers. As a cybersecurity scientist, I have studied this type of cybersecurity, calling it active defense, and how the public and private sectors have relied on each other for cyber security for years. Public-private partnerships are important in managing the broad spectrum of cyber threats facing the United States, but they pose challenges, including determining how far the government can go for national security. This balancing act can also be overseen by Congress և courts. Exchange Server Hacking At least since January 2021, hacking groups have been using zero-day speculation on Microsoft Exchange, that is, previously unknown vulnerabilities, to access email accounts. Hackers have used this access to embed web cases, software that allows them to remotely manage compromised systems and networks. Tens of thousands of email users and organizations have been affected. The result has been a series of hacking attacks that decrypt victims’ files and hold ransom keys. On March 2, 2021, Microsoft announced that a hacker group code named Hafnium was using multiple zero-day exploits to install web caches with unique filenames. This makes it difficult for administrators to remove malicious code, even with corrections released by Microsoft գործիք Cyber Security’s tools to help victims. Cybersecurity company FireEye responds to cyber-attack resources, including some of Microsoft Exchange’s most widely used corporate email software. AP Photo / Nathan Ellgren The FBI accesses hundreds of mail servers on corporate networks. The search authorization allows the FBI to access web cases, enter a previously discovered password in the web case, make a copy for evidence, and then delete the web cases. However, the FBI was not authorized to remove any other malicious software that hackers could install during the breach or otherwise access server content. What makes this case unique is both the FBI’s scope of action to remove web cases and the unprecedented intrusion into private computers without the owners’ consent. The FBI took action without consent due to the urgency of the threat posed by the large number of vulnerable systems in all US networks. The action demonstrates the Department of Justice’s commitment to using “all of our legal remedies,” said Assistant Attorney General John von Demers in a statement. The total number of companies at risk remains murky as the figure changes in court documents, but it could be up to 68,000 Exchange servers, which could affect millions of email users. New malware attacks on Microsoft Exchange servers continue to occur և The FBI continues to take court action to remove malicious passwords. Active Defense The transition to a more active US cybersecurity strategy began during the Obama administration, with the creation of the US Cyber Command in 2010. At the time, the emphasis was on preventing denial, which means that computers are harder to crack. This includes using layered protection, also known as deep protection, to make network intrusion more difficult, expensive and time consuming. The alternative is to go after hackers, which is a strategy called “protecting”. The US government has been developing defenses since 2018, as evidenced by US actions against Russian groups in the 2018 և 2020 election cycles, in which US Cyber Command officials identified and disrupted Russian online campaigns. The Biden administration has continued this trend, combined with new sanctions against Russia in response to the SolarWinds spy campaign. The attack, which the US government blames on Russian intelligence hackers, used vulnerable trading software to infiltrate US government facilities. This new action by the FBI also prompts the active defense envelope, in this case, to clear the way for internal breaches, even without the knowledge or consent of the affected organizations. Law ները Courts The Law on Computer Fraud’s Abuse generally considers it illegal to access a computer without permission. This law, however, does not apply to the government. The FBI has the power to remove malicious passwords from private computers without permission under Rule 41 of the 2016 Federal Rules of Criminal Procedure. This review is partly designed to make it easier for the US government to combat the bottleneck network and to assist in other cybercrime investigations in situations where the whereabouts of the perpetrators remain unknown. It allows the FBI to access computers outside of a search command. This action builds on the precedent և capacity of the courts, the de facto cyber security regulators, that may authorize the Department of Justice to clear large-scale malicious code detected by Exchange hackers. For example, in 2017, the FBI used the extended Rule 41 to crack down on a global botnet that collected information about victims and used their computers to send spam emails. Due to the current activities of the FBI, any legal issues remain unresolved. One is the issue of responsibility. What if, for example, private computers were damaged by the FBI in the process of removing the malicious code? How to balance private property rights against national security needs is another matter. It is clear, however, that under these powers, the FBI could break into computers at will without the need for a special search command. [Get our best science, health and technology stories. Sign up for The Conversation’s science newsletter.] National Security ավոր Private Sector Rob Oys, NSA Director of Cyber Security, said cybersecurity is national security. This statement may seem indisputable. But it does mean a sea change in government responsibility for cybersecurity, which is largely left to the private sector. Most of the potential infrastructure in the United States, including computer networks, is privately owned. However, companies do not always make the necessary investments to protect their customers. This raises the question of whether there has been a market failure in cybersecurity when economic incentives are insufficient for cyber security adequacy. As a result of the FBI’s actions, the Biden administration may indirectly acknowledge such a market failure. This article is republished by Con Conversation, a non-commercial news site dedicated to sharing the ideas of academic experts. It was written by Scott Shackleford, Indiana University. Read more. North Korea has targeted cyber security researchers using a mixture of hacking and espionage. Breaking SolarWinds was all inevitable. Why national cybersecurity is an “evil” issue, what can be done about it Scott Scott Shackelford is Hewlett’s chief investigator. The Foundation, Indiana Economic Development Corporation, and Microsoft Corporation, which support both the Ostrom Cyber Security and Internet Governance Seminar Program and Indiana University Cyber Security Clinic.