Please do not take down the Sality botnet • Hacker News Board

Re: Please do not take down the Sality botnet

#41

Post by phillmv » Wed, Mar 28, 2012, 6:23 AM UTC

rprasad wrote: post #31

a3camero wrote: post #18

Earlier quoted context omitted.

Law student. These sort of situations have been considered by the people that write criminal laws. If you recommend a crime to someone and then they do it then you're a party to that offence ( http://laws-lois.justice.gc.ca/eng/acts/C-46/page-6.html#h-5 [Canadian Criminal Code, but I assume US is quite similar on this]). There are a variety of ways to become a party to a crime, and then you're as guilty as the rest o…

The U.S. criminal code is not like the Canadian Criminal Code. Also, I suggest you reread the statute. By the plain language of the CCC, it is not enough to recommend that someone commit a crime, you must actually counsel them in how to do it (i.e,. provide advice).

I don't see how TFA doesn't fall under counsel. He gives you a step by step process.

Re: Please do not take down the Sality botnet

#42

Post by majmun » Wed, Mar 28, 2012, 6:29 AM UTC

You should NOT takeover botnet and harden it.

Re: Please do not take down the Sality botnet

#43

Post by useful » Wed, Mar 28, 2012, 6:37 AM UTC

vibrunazo wrote: post #34

rprasad wrote: post #30

Earlier quoted context omitted.

Actual lawyer. He's generally right, in the U.S. at least. Suggesting that someone commit an illegal act does not rise to the level of conspiracy. You have to actually do something meaningful to support the criminal effort to be charged with conspiracy. In certain circumstances, incitement can be a crime, but the threshold for that crime is very high.

> but the threshold for that crime is very high What exactly does that mean? What is the line between "incitement" and "suggesting a crime"?

Whatever a jury thinks

Re: Please do not take down the Sality botnet

#44

Post by acqq » Wed, Mar 28, 2012, 6:45 AM UTC

Reading README in the linked zip file, inside is, first, an executable which is a QBFC (http://www.abyssmedia.com/quickbfc) packaged and slightly modified version of AVG's Sality Removal Tool (http://free.avg.com/us-en/remove-sality) to automate the removal of the Sality virus. Then, there is the encrypted version of the same executable, so it will run properly when downloaded by the Sality virus. And finally, there's a simple Python script that queries super peers from a bootstrap list for the most recent URL pack pushed to the Sality P2P network.

Re: Please do not take down the Sality botnet

#45

Post by micaeked » Wed, Mar 28, 2012, 7:00 AM UTC

would this be completely prevented if the botnet owners signed (with a private key) their payloads?

Re: Please do not take down the Sality botnet

#46

Post by zacharypinter » Wed, Mar 28, 2012, 7:15 AM UTC

eridius wrote: post #39

maaku wrote: post #35

What if I get permission from the owner of one of the infected systems to "penetrate" his setup and upload the botnet-destroyer. Would that still be illegal?

I think the issue is that to remove the botnet, it requires having your code be executed on all infected machines. You can't possible get permission from the owners of the millions of infected machines to do this.

Yep. Imagine if it bugged out and broke all the infected machines. Even if the bug that broke the machines wasn't his fault, he'd probably still be in a grey area.

Re: Please do not take down the Sality botnet

#47

Post by jcampbell1 » Wed, Mar 28, 2012, 7:29 AM UTC

rprasad wrote: post #33

jcampbell1 wrote: post #24

Earlier quoted context omitted.

I agree that a DA would be highly unlikely to prosecute as it would take a large amount of effort for little gain, but this clearly fits the definition of conspiracy. There is no requirement that conspirators know each other, and posting the files required seems like an overt step.

In the U.S., by definition the conspirators must agree to commit a crime. Thus, they must know each other--not in a personal sense, but they must actually know that there are other participants and agree to act in concert with those other participants.

Exactly. This is an open offer, and there is no agreement until someone actually accepts the open offer.

Re: Please do not take down the Sality botnet

#48

Post by dredmorbius » Wed, Mar 28, 2012, 7:42 AM UTC

useful wrote: post #43

vibrunazo wrote: post #34

Earlier quoted context omitted.

> but the threshold for that crime is very high What exactly does that mean? What is the line between "incitement" and "suggesting a crime"?

Whatever a jury thinks

... and an appeals court upholds.

Re: Please do not take down the Sality botnet

#49

Post by joelhaasnoot » Wed, Mar 28, 2012, 7:53 AM UTC

ricardobeat wrote: post #15

So why can't those nice guys from the FBI go and do it already? It's so easy to replace sites when piracy is involved...

Dutch police infiltrated a botnet recently, and left a message for victims. No one was too happy with them and they weren't really allowed to...

Re: Please do not take down the Sality botnet

#50

Post by s_henry_paulson » Wed, Mar 28, 2012, 8:27 AM UTC

The guy takes all the time to put this together, write this up, and is perfectly ok with the outcome, but instead of going to a coffee shop and doing this himself, he spends a lengthy amount of time writing up instructions and giving the criminals a chance to fix their injection problems before someone can take down the botnet.

Baffling.

Not only that, but this guy seems to know what he's doing and instead of someone who knows what they're doing completing the task, he's willing to watch script kids bork the whole thing, or run the risk of russians (or others taking over the whole network and hardening it)