Warrants for Cleaning Malware in Kelihos
[no description provided]This is an thought-provoking story:
And perhaps most unusual, the FBI recently obtained a single warrant in Alaska to hack the computers of thousands of victims in a bid to free them from the global botnet, Kelihos.
On April 5, Deborah M. Smith, chief magistrate judge of the US District Court in Alaska, greenlighted this first use of a controversial court order. Critics have since likened it to a license for mass hacking. ("FBI allays some critics with first use of new mass-hacking warrant," Aliya Sternstein, Ars Technica)
One of the issues in handling malware at scale is that the law prohibits unauthorized access to computers. And that's not a bad principle, but it certainly makes it challenging to go and clean up infections at scale.
So the FBI getting a warrant to authorize that may be an interesting approach, with many cautions about the very real history of politicized spying, of COINTEL, of keeping the use of 0days secret. But I don't want to focus on those here. What I want to focus on is what did a judge actually authorize in this case. Is this a warrant for mass hacking? It doesn't appear to be, but it does raise issues of what's authorized, how those things were presented to the judge, and points to future questions about what authorization might include.
So what's authorized?
The application for a warrant is fairly long, at 34 pages, much of it explaining why the particular defendant is worthy of a search, and the "time and manner of execution of search" starts on page 30.
What the FBI apparently gets to do is to operate a set of supernodes for the Kelihos botnet, and "The FBI's communications, however, will not contain any commands, nor will they contain IP addresses of any of the infected computers. Instead, the FBI replies will contain the IP and routing information for the FBI's 'sinkhole' server."
What questions does that raise?
A first technical point is that for the FBI's replies to reach those infected computers, there must be packets sent over the internet. For those packets to reach the infected computer's, they need addressing, in the form of an IP address. Now you can argue that those IP addresses of infected computers are in the headers, not the content of the packets. The nuance of content versus headers is important in some laws. In fact, the warrant para 66 explicitly states that the FBI will gather that data, and then provide it to ISPs, who they hope will notify end users. (I've written about that experience in "The Worst User Experience In Computer Security?.")
Another technical point is that the warrant says "The FBI with the assistance of private parties..." It's not clear to me what constraints might apply to those parties. Can they record netflow or packet captures? (That might be helpful in demonstrating exactly what they did later, and also create a privacy conundrum which the FBI takes apparent pains to avoid.) What happens if an unrelated party captures that data? For example, let's say one of the parties chooses to operate their sinkhole in an AWS node. I suspect AWS tracks netflows. A warrant to obtain that data might seem pretty innocent to a judge.
The idea that the FBI will not send any commands is, on the surface, a fine restriction, but it eliminates many possibilities for cleaning up. What could we imagine in the future?
For example, a command that could be useful would be to remove Kelihos from startup items? How about remove C:\Program Files\Kelihos.exe? Removing files from my computer without permission is pretty clearly a form of unauthorized access. It's a form that's probably in the interests of the vast majority of the infected. We might want to allow a well-intentioned party to do so.
But what if the commands fail? When Sony built a tool to remove the rootkit their DRM installed, the cleanup tool opened a big security hole. It's hard to write good code. It's very hard to write code that's free of side effects or security issues.
What if there's disagreement over what fits within the definition of well-intentioned? What if someone wants to remove duplicate files to help me save disk space? What if they want to remove blasphemous or otherwise illegal files?