Swatters Used Ring Cameras To Livestream Attacks, Taunt Police, Prosecutors Say (arstechnica.com) 98
An anonymous reader quotes a report from Ars Technica: Federal prosecutors have charged two men with allegedly taking part in a spree of swatting attacks against more than a dozen owners of compromised Ring home security cameras and using that access to livestream the police response on social media. Kya Christian Nelson, 21, of Racine, Wisconsin, and James Thomas Andrew McCarty, 20, of Charlotte, North Carolina, gained access to 12 Ring cameras after compromising the Yahoo Mail accounts of each owner, prosecutors alleged in an indictment filed Friday in the Central District of California. In a single week starting on November 7, 2020, prosecutors said, the men placed hoax emergency calls to the local police departments of each owner that were intended to draw an armed response, a crime known as swatting.
On November 8, for instance, local police in West Covina, California, received an emergency call purporting to come from a minor child reporting that her parents had been drinking and shooting guns inside the minor's home. When police arrived at the residence, Nelson allegedly accessed the residence's Ring doorbell and used it to verbally threaten and taunt the responding officers. The indictment alleges the men helped carry out 11 similar swatting incidents during the same week, occurring in Flat Rock, Michigan; Redding, California; Billings, Montana; Decatur, Georgia; Chesapeake, Virginia; Rosenberg, Texas; Oxnard, California; Darien, Illinois; Huntsville, Alabama; North Port, Florida; and Katy, Texas.
Prosecutors alleged that the two men and a third unnamed accomplice would first obtain the login credentials of Yahoo accounts and then determine if each account owner had a Ring account that could control a doorbell camera. The men would then use their access to gather the names and other information of the account holders. The defendants then placed the hoax emergency calls and waited for armed officers to respond. It's not clear how the defendants allegedly obtained the Yahoo account credentials. A separate indictment filed in November in the District of Arizona alleged that McCarty participated in swatting attacks on at least 18 individuals. Both men are charged with one count of conspiracy to intentionally access computers without authorization. Nelson was also charged with two counts of intentionally accessing without authorization a computer and two counts of aggravated identity theft. If convicted, both men face a maximum penalty of five years in prison. Nelson faces an additional maximum penalty of at least seven years on the remaining charges.
On November 8, for instance, local police in West Covina, California, received an emergency call purporting to come from a minor child reporting that her parents had been drinking and shooting guns inside the minor's home. When police arrived at the residence, Nelson allegedly accessed the residence's Ring doorbell and used it to verbally threaten and taunt the responding officers. The indictment alleges the men helped carry out 11 similar swatting incidents during the same week, occurring in Flat Rock, Michigan; Redding, California; Billings, Montana; Decatur, Georgia; Chesapeake, Virginia; Rosenberg, Texas; Oxnard, California; Darien, Illinois; Huntsville, Alabama; North Port, Florida; and Katy, Texas.
Prosecutors alleged that the two men and a third unnamed accomplice would first obtain the login credentials of Yahoo accounts and then determine if each account owner had a Ring account that could control a doorbell camera. The men would then use their access to gather the names and other information of the account holders. The defendants then placed the hoax emergency calls and waited for armed officers to respond. It's not clear how the defendants allegedly obtained the Yahoo account credentials. A separate indictment filed in November in the District of Arizona alleged that McCarty participated in swatting attacks on at least 18 individuals. Both men are charged with one count of conspiracy to intentionally access computers without authorization. Nelson was also charged with two counts of intentionally accessing without authorization a computer and two counts of aggravated identity theft. If convicted, both men face a maximum penalty of five years in prison. Nelson faces an additional maximum penalty of at least seven years on the remaining charges.
Quit using the same logins and passwords for all.. (Score:4, Interesting)
Quit using the same logins and passwords for all your accounts.
Weren't most if not all of these cracked accounts using the same logins and passwords in different services?
Convenient, but if you get had once, you'll get had everywhere.
I know a lot of people like that. Scary.
Each vendor, each service, gets a unique email and password. That way if I get spam, I know who sold me out, and chances of a mass crack is slim.
Re:Quit using the same logins and passwords for al (Score:5, Informative)
Yahoo's webmail is hugely insecure because it loads 3rd party advertisements from the public ad networks. Anyone who has control over the JavaScript in a banner ad it loads can slurp up millions of passwords in one go. Don't astroturf over this complete failure of basic security while also having a username that is one character away from having the word "phish" in it.
Re: (Score:2)
Re: (Score:1)
Yahoo's email has been breached multiple times before. It's got more holes than Swiss cheese.
Re:Quit using the same logins and passwords for al (Score:5, Informative)
JavaScript hasn't worked like that since the 2000s, when browsers started implementing same origin limits and protections against password theft.
Re: (Score:1)
If you think it can't be done I think you didn't try hard enough, but I suspect you're just actually in on it and trying to help astroturf over the threat.
Re: (Score:1)
You also forget not everyone is running the latest hardened version of Chrome in a sandbox with banners all blocked, and JavaScript also has access to keystrokes, cookies, adjacent frames, browser history log, and can make invisible http requests as the client.
Re: (Score:2)
Wow. And what about my reply was astroturfing?
Lock your shit up. Securely. Not with the same login used for all your other accounts. This is simple and effective.
I'm not astroturfing anyone or anything. I'm pointing out that with basic security practices things like this are avoidable. And yes yahoo is a cesspit. So? Reduce your exposure footprint by not re-using credentials
Your reply was unwarranted flamebait. My username is also one character off from another word that has nothign to do with phis
Re: (Score:2)
The trouble is...today people have SO freakin' many accounts, they can't possibly keep up with different user/pass for every one of them.
Sure, it is a security problem, but that's the reality for most common folks out there.
They can't remember so many user/pass without using the proverbial st
Re: (Score:2)
Encrypt a text file with information for each site, login, password, and any security questions and answers on your desktop. Make the encryption pass phrase somewhat easy to remember but hard to guess. Cut and paste to login and don't let your browser remember anything you care about. No need to remember anything but the passphrase to the text file.
Not easy with phones? Well stop using your phones for everything and actually interact with the people and the environment around you! Securely access your home
Re: (Score:1)
I absolutely realize people often use the same password for everything and it's often super insecure, but every time Yahoo's massively insecure email service is conspicuously implicated in a serious breach of privacy and safety there's always some jackass who pops up with the very first post to handwave it away and blame the users. Go to Hell.
Re: (Score:1)
Also, how do you explain that it was only Yahoo email accounts breached, smart guy? How do you handwave away that this happens to Yahoo email account so often it almost seems like it only happens to Yahoo email accounts?
Follow-up question: How long have you worked for them?
Re: Quit using the same logins and passwords for a (Score:2)
Let me know when you come up with a genetic brain enhancement that enables people to remember hundereds of long passwords that look like "&4A!':*zw" and not have to rely on "password wallets" or other extra and cumbersome stuff that come with it's own set of problems.
In the meantime "Password01, Password02, etc..."
Re: Quit using the same logins and passwords for a (Score:5, Interesting)
I simply use all lower caps pass phrase and append the same suffix to all of them!
My slashdot password:
i like to to play dices with my girlfriend KK88!!
My gmail password:
google sure would never do any evil KK88!!
It works fine for me and I always wondered what was the real problem everybody seems to be talking about in such a recurring way.
It's like nobody ever got the xkdc memo:
https://xkcd.com/936/ [xkcd.com]
Re: (Score:2)
I tried this as well.
The failure mode Mr. Monroe didn't include is that as the password length increases, the probability of making a typo goes up. Since it is a password, feedback on whether an error occurred is limited to nonexistent.
This may not be a problem depending on the error rate of various people (mine can be high)
Re: (Score:2)
Whenever I log into Yahoo I never even get asked for my password, instead I receive a SMS with a one time use code after entering my login name. I never set this up myself, Yahoo sort of steered my account to this feature automatically. Perhaps the users that were compromised never connected their phone number with their Yahoo account. While SMS is not 100% secure, it is vastly more expensive for the attacker to gain access to than using compromised passwords from the dark web.
Re: (Score:2)
The only way out of this is that services that are especially vulnerable (banks, security, shopping, email, game platforms etc) *require* or at least strongly insist that the user turns on a second form of verification, be it a fingerprint, picture, verification code, dongle or whatever. Or researchers figure out a way of offering passwordless authenti
Re: (Score:1)
WTF does that have to do with people getting swatted...because someone hacked into their Ring system, etc?
It has nothing to do with citizens in the US legally exercising their 2A rights.
Re: (Score:2)
Re: (Score:2)
Fortunately, the overwhelming majority of gun owners aren't a problem...they aren't "stupid and irrational".
I live here and fully feel any tradeoffs we have for the 2A is overwhelmingly
Re: (Score:2)
Re: (Score:2)
As another poster mentioned, that stat is VERY deceiving since it includes suicides...which are close to 2/3 of the number, and the remaining ones are just street gangs killing each other.
That gang violence is mostly only in isolated areas....if you don't go there, you won't have any problems.
It isn't like the Wild West over here....far from it.
Most people live their lives and don't ever hear a gunshot unless they are out hunt
Re: (Score:2)
Fortunately, the overwhelming majority of gun owners aren't a problem...they aren't "stupid and irrational".
and
...it includes suicides...which are close to 2/3 of the number, and the remaining ones are just street gangs killing each other.
Can you give us a definition of what you mean by stupid and irrational? You know, so that we're both on the same page. And presumably, you don't count mass shootings as stupid & irrational, right?
Re: (Score:2)
As another poster mentioned, that stat is VERY deceiving since it includes suicides...which are close to 2/3 of the number, and the remaining ones are just street gangs killing each other.
Sorry, but wouldn't it only be deceptive if the stats from those other countries didn't include suicides and gang violence? Admittedly, the US has a pretty high suicide rate all things considered.
Re: (Score:2)
Re: (Score:2)
They could be using the mail accounts to reset the passwords. The "I forgot my password" utils quite often will just email you a reset link.
Re: (Score:2)
Re: (Score:2)
We've long known people are idiots about passwords and they are easily hacked, so anything important must have at least two-factor authentication. That's Ring's fault.
Wish the penalty were a lot harsher for this (Score:5, Interesting)
For a serial swatter, five years seems like a joke. I'd prefer to make it 20 years minimum to really give them time to think over bad life choices, given how they are endangering both the officers and the residents of the homes they are targeting.
Re:Wish the penalty were a lot harsher for this (Score:4, Insightful)
Re: (Score:3)
should be min of attempt 1st degree murder of anyone in the place at the time it happens. No screwing around with this soft sentences.
True. Ultimately if you mess around with the application of a deadly force without remorse, you deserve all the punishment in the world without remorse from the judge or your peers.
Re: (Score:2)
100% agree with you, it absolutely should be.
You know what you're doing, and people have actually died from swatting, you're literally taking steps that may get someone murdered. The punishment needs to fit the attempted crime.
You can't fire a gun a someone and claim "I wasn't trying to kill him so don't charge me with murder"
Re: (Score:2)
Re: (Score:1)
Isn't that based on intent? I don't think you can fire a lethal weapon at someone while claiming it being lethal wasn't the intent.
Swatting someone sounds like lethal intent, because you convince people with fire arms that a serious left threatening situation has happened, and people come running in with body armor on and loaded guns, ready to neutralize the threat / kill them.
I was under the impression manslaughter only applies in situations where an action unintentionally results in the death of someone,
Re: (Score:2, Insightful)
How is the life threatened? Police should just go and check FIRST. No need to go in guns blazing. Swatting is only a problem if you live in a country with military dressed as police.
Re:Wish the penalty were a lot harsher for this (Score:5, Insightful)
How is the life threatened? Police should just go and check FIRST. No need to go in guns blazing. Swatting is only a problem if you live in a country with military dressed as police.
Because quite often the SWAT will go in guns blazing. Yes, this is a huge problem that needs addressing, but the person doing the swat attack knows very well that sometimes people die during SWAT raids, and they don't care. I say hold them accountable for attempted murder and jail them for most of their remaining life, but if the victim does get killed, jail them for life.
Oh, and SWAT is not military dressed as police, SWAT is police dressed as military.
SWAT is police with military training (Score:3, Insightful)
In practice this means that yes, we live under a military occupation. But that's not the kind of thought anyone wants to have to deal with, so we laugh it off.
Re: (Score:2)
If you take somebody and give them all the training and equipment of a military then congratulations, you got yourself a military.
Well, technically they only get the equipment part, and a Rambo box set of videos.
Oh no, they get a **** ton of training (Score:2)
Only trouble is that training is to kill, not protect. Also we wouldn't want or need them in the 1st place without our politically motivated drug war (google "Nixon started the drug war")
Re:Wish the penalty were a lot harsher for this (Score:4, Informative)
This case is especially egregious: the swatters took over the Ring doorbell system and pretended to be the people inside the house, and when the SWAT team came to the house they verbally threatened and taunted the police. When shooting suspects start shouting stuff like "we are about to kill the boy and you can't stop us...5,4,3,2...",, well, you can imagine the police might be rushed into breaching, entering and potentially making hair-trigger decisions ("I thought he was turning towards me with a gun" when they were holding something else etc.).
Re:Wish the penalty were a lot harsher for this (Score:4, Informative)
How is the life threatened? Police should just go and check FIRST. No need to go in guns blazing.
If things don't go wrong, they should, and most of the time they do.
HOWEVER, keep in mind that the people being swatted don't know that armed police are about to show up thinking that a crime is in progress, and may misinterpret the sudden appearance of armed strangers; for example, they might think they are being invaded and grab a gun, not knowing that this is the worst possible thing.
And the police have been told that the site has people that are armed and dangerous and are holding hostages that they have threatened to kill. Their mindset is that they are on a hair trigger to start shooting.
A small misinterpretation of cues can escalate into shooting very quickly.
Re: Wish the penalty were a lot harsher for this (Score:2)
"Your honor, I merely arranged the circumstances under which an armed group of law enforcement were at this home expecting to find a dangerous situation, possibly with an armed gunman. I ask you, wouldn't a reasonable person expect these professionals to see through my webcam ruse, drop their posture, and join the homeowner for discussion over tea? I submit they would indeed, and if they didn't, I should consider myself absolved."
Hard to imagine the thing a swatter like this brings to the table that makes t
Re: (Score:2)
I don't know the specifics, but typically, SWAT is called to the scene if the situation warrants such an escalation. If someone calls 911 and say their grandmother has fallen then dispatch will coordinate with with hospital or some sort of medical first response. When someone calls in and tells the dispatch that someone or someones is wielding weapons and the threat of loss of life is imminent, then of course, to deal with something serious such as this, you don't just call regular foot patrol to the scene,
Re: (Score:2)
Re: Wish the penalty were a lot harsher for this (Score:4, Insightful)
If you were given five years in prison I bet you would view it as a significant amount of time. It is do weird how flippant we are when demanding prison time for others and how we are so quick to view prison as retribution.
Re: (Score:2)
That kind of stupid needs to be eradicated from the gene pool.
Well then sign me up! (Score:2)
Who could've predicted such abuse of such a system?! Can we think of any other potential/realized issues with such a product/service?
Don't Buy Anyone a Ring Camera [gizmodo.com]
What to Know Before You Buy... [eff.org]
Amazon Requires Police to Shill Surveillance... [vice.com]
14 Reasons Not To Get A Ring Camera [mashable.com]
Re: (Score:2)
Yahoo gets breached a lot too due to the giant truck-sized hole in their webmail implementation; 3rd party banner ads loaded right there on the same page.
everyone that does this (Score:5, Insightful)
Re: everyone that does this (Score:2)
What they need to know are the physical consequences on their bodies when they do go to prison. The prospect of having their faces sliced up with shanks as he is in a headlock and two more men are breaking his ribs, jaw, and legs. Or being repeatedly raped, beat, cut, and tortured in a cell with an absolute maniac for days on end (stuff that has actually happened in prison). Or being left in a cell that is in no way climate controlled during an extended 100+F heatwave, turning a regular prison cell into a V
Re: (Score:2)
What they need to know are the physical consequences on their bodies when they do go to prison. The prospect of having their faces sliced up with shanks as he is in a headlock and two more men are breaking his ribs, jaw, and legs. Or being repeatedly raped, beat, cut, and tortured in a cell with an absolute maniac for days on end (stuff that has actually happened in prison).
Do you really have prisons like that in the USA? Or are you talking about some third world country prison?
Re: (Score:2)
What's the difference? The USA hasn't be a first world nation for at least a decade.
Re: everyone that does this (Score:2)
USA, sadly. We call ourselves a first world country, and we put on a big show to look like a first world country, but we are very third world on how we do things. And it shows. Look at all of the homeless encampments that popped up in every major US city in the past two years. "Rich" cities are becoming like Calcutta, India, complete with shit on the streets.
Re: (Score:2)
Re: (Score:2)
If someone swats someone it should be automatic attempt 1st murder of person that lives there. If there was 3 people in the house it should be 3x charges of it then cause that is what this is trying to do.
Appreciate the thought, but that's not how 1st degree or attempted murder works in the USA. Unless you can prove a direct intent it can't be attempted murder or 1st degree murder and without a link between all people involved and the accused the intent clause fails. This is precisely the reason 2nd degree murder exists, and you can't attempt second degree murder since doing so fails premeditation clause.
Basically you've got bugger all chance of murder charges or attempted murder sticking for swatting incid
Re:everyone that does this (Score:5, Insightful)
Appreciate the thought, but that's not how 1st degree or attempted murder works in the USA. Unless you can prove a direct intent it can't be attempted murder or 1st degree murder and without a link between all people involved and the accused the intent clause fails.
I don't know.. this seems to fit with "planned and acted with intent":
On November 8, for instance, local police in West Covina, California, received an emergency call purporting to come from a minor child reporting that her parents had been drinking and shooting guns inside the minor's home. When police arrived at the residence, Nelson allegedly accessed the residence's Ring doorbell and used it to verbally threaten and taunt the responding officers
I mean.. what did he think would happen if he tries to initiate a armed response, and then goes on threatening the officers?
"Relax, it was just a prank, bro!" doesn't quite cut it as a defense here.
Re: (Score:2)
Note that he is saying what it should be, not what it is.
Re: (Score:2)
Re: (Score:2)
You are totally correct and your inability to see the problem means nothing will change.
Your rant becomes gibberish here.
Great idea! Can we apply that to cars, boats and planes where a crime is committed, Ferris wheels and roller-coasters too? Think of all the lives you'll save.
Re: (Score:3)
If someone swats someone it should be automatic attempt 1st murder of person that lives there.
It's very telling that in a country where people think calling the police should be considered first person attempted murder that the vast majority is on harsher penalties for the attempted-murderer, and almost nothing on why calling the police is attempted murder in the first place.
Is it attempted murder? Yep. Is it so astonishingly bad that calling the police is attempted murder, that the discussion should be on
Re: (Score:3)
The criminals called the police and gave them: "an emergency call purporting to come from a minor child reporting that her parents had been drinking and shooting guns inside the minor's home."
All the police have to go on is there are armed, drunk people, threatening a minor child.
The police will respond accordingly.
The perps knew exactly what buttons to push to get the maximum response.
Re: (Score:3)
This is far more than just "calling the police".
Mild hyperbole, but no it isn't really.
The perps knew exactly what buttons to push to get the maximum response.
Yeah and the maximum response of American police is to not bother to check anything it's to go in guns blazing with their new toys purchased at a discount from the Army.
Somehow other countries manage without their police force being an easily deployed murder weapon.
Re: (Score:2)
I submit that any man who waits to “check things out” after having received a call from a panicked kid about drunken abusive parents shooting guns at him or her isn’t much of a man.
This is not the cops fault. They make mistakes, and there are plenty of bad ones out there. But this blame clearly lies with the swatters, and the judge should have thrown the book at them. With bone-breaking force.
Re:everyone that does this (Score:4, Insightful)
Of course it's the cops fault.
This isn't an either/or thing. They are both at fault.
However, every country has asshole criminals who want to hurt people. Few countries have a police force which can be wielded as a weapon by those criminals. Stop defending your aggressive and militarized police force who regularly use excessive force and kill innocents.
Re: (Score:2)
Of course quite recently there was a case where the police didn't go in, and the result was dozens of dead children.
Maybe the problem is that other countries don't breed that brain damaged kind of sick bastards.
Re: (Score:2)
I can assure you, sir, that we are every bit as capable of breeding brain damaged sick bastards as you are.
Re: (Score:2)
Re: everyone that does this (Score:3, Interesting)
If someone swats someone it should be automatic attempt 1st murder of person that lives there.
"Swatting" is despicable and should be punished, but it's not murder.
But a good start would be not calling it "swatting" anymore. This shifts the blame solely on the caller. It suggests that a police SWAT team is an unstoppable, unavoidable, brainless force of nature devoid of any own capacity of judgement. Once triggered it cannot be stopped, and whatever comes is purely in the realm of fate. And if any responsibility is to be attributed, tjenthenit surely must be to tje caller.
In fact, what was done is a
Re: everyone that does this (Score:2)
Note to self: should stop slashdotting while watching kids... :-( Sorry for the crappy typing.
Re: (Score:2)
Note to self: should stop slashdotting while watching kids... :-( Sorry for the crappy typing.
Nevertheless, the spelling "swatzing" is strangely appropriate...
It is very much attempted murder (Score:4, Insightful)
Now, our police shouldn't be a militarized instrument of death, but that's what they are, and another topic all together.
Re: It is very much attempted murder (Score:2)
Now, our police shouldn't be a militarized instrument of death, but that's what they are, and another topic all together.
An "instrument" is, by definition, an inanimate object that can't make its own decisions. I understand that you can build a simile and extend that definition to live objects (cattle, tigers, a panicked crowd in a burning theater), but the main connotation should still apply: as-if-it-were inanimate, unable to make own decisions.
A police elite combat team isn't an "instrument" of death anymore than a person pulling the trigger on another person is. They are the intent behind the device, not the device itself
You're spitting hairs to distract (Score:2)
Re: (Score:2)
Some pranks can go bad and you know perfectly well and people do them anyway. Or they simply do not think about the odds at all. So are extreme sports suicide? The risk of death or major injury is part of the appeal but if it was a nearly sure thing .... not many people would do it.
The risk of death is part of the severity of it; but even if police were more competent (we know they are not) people would STILL do this and likely even more so because the ones who hold back THINK it's too risky. It still g
Re: (Score:2)
If these people were able to think, let alone twice, they wouldn't be swatting people.
Swatting shouldn't be a thing (Score:2)
But we're a bunch of cowards. We go so scared of fake news stories (and they were fake, long before chuds coined that term) about scary (let's face it, black & latino) gangs we allowed what can really only be called a military occupation to take place.
I mean, what el
Re: Swatting shouldn't be a thing (Score:2)
You shouldn't have a population laden with guns. Because you choose to have that, you need militarily trained police.
Re: (Score:2)
Because it's NOT attempted murder! Not 1st or 2nd degree. Maybe an argument for 3rd I'd have to think over but probably not that either. A half decent lawyer could explain to any jury well enough for some of them to understand this.
Intended targets are a count of charges; collateral targets are 2nd or 3rd degree of whatever you do find to classify it as can be counted as well.
Filing a false police report is clearly the obvious crime and maybe that should be changed to multiply out the counts by the number
The Matrix (Score:1)
Aggravated identity theft
I'm not sayin' the server was asking for it but it shouldn't have been broadcasting a short skirt and fishnets
Footrpints on the sands of time (Score:1)
Make the punishment fit the crime
Aren't the police armed with guns? (Score:3)
If I push someone into a hunting range I'm clearly trying to get them killed.
How is swatting not attempted murder?
Attempted murder (Score:3)
Charge them with the actual crime they committed: attempted murder.
Wait, what? (Score:2)
Facing five years in prison for putting people in physical danger? What would they get if the police killed an innocent? Still five years?
Constant use of swat teams is the real problem (Score:3)