Hackers Are Sending Fraudulent Police Data Requests To Tech Giants To Steal People's Private Information (gizmodo.com) 14
An anonymous reader quotes a report from TechCrunch: The FBI is warning that hackers are obtaining private user information — including emails and phone numbers — from U.S.-based tech companies by compromising government and police email addresses to submit "emergency" data requests. The FBI's public notice filed this week is a rare admission from the federal government about the threat from fraudulent emergency data requests, a legal process designed to help police and federal authorities obtain information from companies to respond to immediate threats affecting someone's life or property. The abuse of emergency data requests is not new, and has been widely reported in recent years. Now, the FBI warns that it saw an "uptick" around August in criminal posts online advertising access to or conducting fraudulent emergency data requests, and that it was going public for awareness.
"Cyber-criminals are likely gaining access to compromised US and foreign government email addresses and using them to conduct fraudulent emergency data requests to US based companies, exposing the personal information of customers to further use for criminal purposes," reads the FBI's advisory. [...] The FBI said in its advisory that it had seen several public posts made by known cybercriminals over 2023 and 2024, claiming access to email addresses used by U.S. law enforcement and some foreign governments. The FBI says this access was ultimately used to send fraudulent subpoenas and other legal demands to U.S. companies seeking private user data stored on their systems. The advisory said that the cybercriminals were successful in masquerading as law enforcement by using compromised police accounts to send emails to companies requesting user data. In some cases, the requests cited false threats, like claims of human trafficking and, in one case, that an individual would "suffer greatly or die" unless the company in question returns the requested information.
The FBI said the compromised access to law enforcement accounts allowed the hackers to generate legitimate-looking subpoenas that resulted in companies turning over usernames, emails, phone numbers, and other private information about their users. But not all fraudulent attempts to file emergency data requests were successful, the FBI said. The FBI said in its advisory that law enforcement organizations should take steps to improve their cybersecurity posture to prevent intrusions, including stronger passwords and multi-factor authentication. The FBI said that private companies "should apply critical thinking to any emergency data requests received," given that cybercriminals "understand the need for exigency."
"Cyber-criminals are likely gaining access to compromised US and foreign government email addresses and using them to conduct fraudulent emergency data requests to US based companies, exposing the personal information of customers to further use for criminal purposes," reads the FBI's advisory. [...] The FBI said in its advisory that it had seen several public posts made by known cybercriminals over 2023 and 2024, claiming access to email addresses used by U.S. law enforcement and some foreign governments. The FBI says this access was ultimately used to send fraudulent subpoenas and other legal demands to U.S. companies seeking private user data stored on their systems. The advisory said that the cybercriminals were successful in masquerading as law enforcement by using compromised police accounts to send emails to companies requesting user data. In some cases, the requests cited false threats, like claims of human trafficking and, in one case, that an individual would "suffer greatly or die" unless the company in question returns the requested information.
The FBI said the compromised access to law enforcement accounts allowed the hackers to generate legitimate-looking subpoenas that resulted in companies turning over usernames, emails, phone numbers, and other private information about their users. But not all fraudulent attempts to file emergency data requests were successful, the FBI said. The FBI said in its advisory that law enforcement organizations should take steps to improve their cybersecurity posture to prevent intrusions, including stronger passwords and multi-factor authentication. The FBI said that private companies "should apply critical thinking to any emergency data requests received," given that cybercriminals "understand the need for exigency."
Slashdot Editors Are Sending (Score:5, Funny)
Re: (Score:2)
Surely that must be hackers posing as Slashdot editors?
This is a joke, right? (Score:4, Insightful)
The editors are having us on?
Re: (Score:2)
Deja vu
Re: (Score:2)
Deja vu
April Fool's Day All over Again
Re: (Score:2)
How is one person's opinion the same as two different "professional" editors publishing the same news story on the same site within a matter of hours "no worse"?
If you don't understand the difference I recommend restarting your education from the first grade Billy.
It has to be said (Score:5, Insightful)
"The abuse of emergency data requests is not new..."
What's unusual is the number of hackers abusing the system, when usually it's the cops themselves taking liberties.
so basically ... (Score:2)
compromised US and foreign government email addresses and using them to conduct fraudulent emergency data requests
... "don't trust us". don't say ...
Hackers? (Score:1)
I think you mean Russians. I heard they just bought a deluxe two in one heat pump washing machine and are now hacking the world.
Hello AI bot (Score:2)
The police pretending (Score:2)
Why is that important? If the FBI/police demanded a system with authentication, of both the calling party and the existential threat, that wouldn't be possible. This is the police pretending their power-grab is not reason the safety of ordinary people, is imperiled.
Re: (Score:3)
Why is that important? If the FBI/police demanded a system with authentication, of both the calling party and the existential threat, that wouldn't be possible. This is the police pretending their power-grab is not reason the safety of ordinary people, is imperiled.
IF police are legitimately and legally allowed to request this data, this isn’t really a power grab. This is a problem of urgency, and a weakness being exploited. It’s not in the same league as SWATting, because the time sensitivity usually isn’t that urgent. Police simply like to lie and say it is every time to avoid any normal process and procedure.
They could secure this process as you suggest. But that would create the kinds of paper trails that could actually be defended instead of