Brian Krebs Gets SWATted 240
RedLeg writes "ArsTechnica reports that Brian Krebs, of KrebsOnSecurity.com, formerly of the Washington Post, recently got SWATted. For those not familiar with the term, SWATting is the practice of spoofing a call to emergency responders (911 in the U.S.) to induce an overwhelming and potentially devastating response from law enforcement and/or other first responders to the home or residence of the victim. Brian's first-person account of the incident and what he believes to be related events are chronicled here.
Krebs has been prominent in the takedown of several cyber-criminal groups in the past, and has been subject to retaliation. I guess this time he poked the wrong bear."
Re:Danger. (Score:5, Informative)
Thankfully Brian had already contacted his local PD and advised them that this was a distinct possibility so they were prepared for the possibility that it was a hoax when they arrived.
That and Brian is white, so that helps...
Furthermore, the police called him before he came out his front door and was confronted by armed police.
However, as he was vacuuming and preparing for a dinner party, he didn't answer the phone but made a mental note to check his voice mail.
The police had to respond and it did seem to end rather quickly. Had he answered the phone things would have gone down at least slightly differently. The police would've had to still check the situation out but perhaps it would've been easier on him.
So, a big "Thank You" to Brian Krebs for his on-going work on computer security issues and a big "fuck you" to whomever called 911 with his phone number faked as the calling number.
Re:Danger. (Score:3, Informative)
That and Brian is white, so that helps...
Not much actual evidence this is the case.
Re:Ars Technica under DOS attack? (Score:5, Informative)
This morning, Dan Goodin, a good friend and colleague at Ars Technica, published a story about my ordeal after a late night phone interview. This morning, Ars Technica found itself on the receiving end of a nearly identical attack that was launched against my site on Thursday. Turns out, the records at booter.tw show clearly that a customer named Starfall using that same Gmail address also paid for an attack on Arstechnica.com, beginning at approximately 11:54 a.m. ET. A snippet of the logs from booter.tw showing the attack on Ars Technica.com (a.k.a. ‘http://50.31.151.33‘ in the logs) is here.
According to Eric Bangeman, Ars Technica’s managing editor, their site was indeed attacked starting earlier this morning with a denial-of-service flood that briefly knocked the site offline.
“We’ve been up and down all morning, and the [content management system] was basically inaccessible for 2 hours,” Bangeman said, adding that he wasn’t aware of an attack of similar size that knocked the site offline. “If it did, it wasn’t enough to be registering in my memory, and I’ve been around for 10 years.”
Re:Danger. (Score:4, Informative)
Like I said, in countries *not* inundated in gun violence.. London would be a more apt comparison to Chicago than Oslo though, and they manage without guns in their day-to-day work.
Re:How do they get away with this? (Score:2, Informative)
CallerID on landlines can be hacked by an Orange box. Though this won't usually work with 911.
Probably this was done from VOIP to E911. Supposedly easier to hack.
It's unlikely the call came from a cellphone.
It's only going to get worse now that some 911 dispatches accept SMS/texts.
Full disclosure: Infosec guy. Haven't actually done any of this, but I did make a red box in college with my HP95lx. Never got it to work.
Re:Danger. (Score:5, Informative)
To your point: you're far more likely to die as a commercial fisherman, roofer or electrician than a cop.
Re:Danger. (Score:5, Informative)
Idaho's murder rate is lower than Hawaii's (200.9 per 100,000 vs 287.2 for 2011 [fbi.gov]); its gun laws are so weak that the Brady campaign gives Idaho 2/100 [bradycampaign.org]. (For those outside the U.S., the "Brady Campaign to Prevent Gun Violence" is a leading advocate for the criminalization of gun ownership; in their scale, a higher number means more legal obstacles to exercising the right of self-defense.) Mississippi has a murder rate close to Hawaii's, 269.8; it gets 4 on the Brady's scorecard.
Illinois gets 25 from Brady, and a murder rate of 429.3.
Brady's favorite state is CA, with 81 points; homicide rate 411.1. Texas gets a 4 from Brady, and has almost the same murder rate as California, 408.5.
The Bradys don't rank DC, but we know it has some of the strictest gun laws in the country; it has a murder rate of 1,202.1. (The cynic in me thinks this is why Brady doesn't rate it...) The lowest murder rate is Maine, 123.2, a whole order of magnitude less than D.C.'s rate; its permissive gun laws get a 7 on Brady's scale.
Across U.S. states, gun control laws seem to have no correlation with murder rates. The same applies internationally and across our own history -- the U.S. homicide rate has fallen 50% since the early 90s, the decline starting before the Brady bill and the "assault weapons" ban and continuing after the ban expired, while more and more states liberalized CCW laws and the number of guns in private hands increased.
Re:Danger. (Score:5, Informative)
Aecurity and authentication were not built in to POTS protocols. That answers your question. They were not designed to handle geolocation nor identity.
The caller ID system relies on either the caller, or a database provided by the caller's provider. Once you transfer from one provider to another, typical in any long-distance call, the second provider has no way to track the caller beyond what the first provider claims. I found this article enlightening, although slightly off topic it is fundamentally about caller ID spoofing.
http://telemarketerspam.wordpress.com/2012/10/08/pacific-telecoms-robo-call-revenue-sharing-scheme-revealed/ [wordpress.com]
Now you're going to ask why we can't fix it? Because it's not worth the amount of money it would take to re-configure the entire phone infrastructure. The companies that would pay the most would benefit the least. Individuals would not sign up in large enough numbers, and so we are stuck.
Yes we have the technology, but not the will. US Congress has made it illegal to send false info, but has not found a way to ensure companies follow the law. As common carriers, they can set up a scam-friendly block and blame the customers for all mischief. The only way to positively identify the people behind the calls is to hand over your credit card information, let a bogus charge hit, and spent a few years fighting back.
Re:Danger. (Score:2, Informative)
What do they do when someone pulls a knife? Tries to run them over? Sics a dog on them? Do they train to run away really fast, or do they rely on the criminals to take pity on their helplessness?
I can't speak for Norway, but in the UK police carry big sticks and wear stab vests, which is usually sufficient. Although they have started rolling out tasers to officers working in particularly rough parts of the country; those are usually kept in the car until needed, rather than being routinely carried while on patrol.
Re:Danger. (Score:5, Informative)
Ranking states for Brady and violence is meaningless, as data show. Only ranking high violence areas versus low violence areas gives meaningful data. So ranking Chicago, DC, Detroit, and other large cities with high crime rates against large cities with low crime rates is an interesting comparison. London, as well as England and Great Britain, have high violent crime rates and strong gun laws. Are there large cities in the US with low crime rates? There are in Europe: Zurich, Bern, and Geneva, Switzerland, for example. If you do that in the US, you get confused, because Houston has a high violent crime rate, for example. It just is not obvious.
Re:Danger. (Score:3, Informative)
the U.S. homicide rate has fallen 50% since the early 90s, the decline starting before the Brady bill and the "assault weapons" ban and continuing after the ban expired, while more and more states liberalized CCW laws and the number of guns in private hands increased.
There seems to be growing evidence that the increase in crime in the 70s ,and eventual decrease in the 90s, is related to environmental lead pollution from the rise and fall of the use of lead in gasoline [motherjones.com]