Category: Law & Policy

We Have a RAT Problem Says DCA

“We the consumers are outgunned and outmanned. We don’t have the tools needed to protect ourselves.  While you are still better off having a 2013 anti-virus program, it won’t protect you against zero-day malware anymore than the polio vaccine will protect you from Ebola.”

That quote is from the introduction of a new report published last week by the Digital Citizens Alliance entitled Selling “Slaving.”  It focuses on an especially pernicious form of malware called RATs (Remote Access Trojans); the users of these applications; their victims; and the enablers — both corporate and criminal — that help spread and even monetize this growing trend in what sounds a bit like hobbyist hacking.  I have never explicitly recommended reading a whole report of this nature before — often the bulk of a study contains a lot of data supporting the main findings — but I do recommend reading all of this one.  Not only does it discuss a cybersecurity threat of concern to any computer or device user anywhere, but the report reads much more like a very long article that provides insight into the nature, motives, methods, and victims of this class of hackers called ratters.  Their brands of mischief include a wide range — from pranking people for sophomoric amusement; to identity and data theft; to slaving built-in webcams on the computers of women and girls to record Peeping Tom photos and videos that may or may not be used for the purposes of extortion and/or sold through black-market channels trading in child pornography.

The DCA report indicates that ratting is on the rise — and going mobile — but readers should take particular note of the lack of sophistication required relative to the amount of harm that can be caused to victims who fall prey to RATs.  In fact, many ratters can hardly be called hackers at all because they don’t hack into computers by means of any remarkable coding skills. Instead, the unsuspecting victim inadvertently downloads malware to her operating system, and a ratter is then able to control that computer (slave it) using one of a handful of cheap, easy-to-acquire, easy-to-operate software applications. An attack can be targeted (i.e. aimed at a specific victim like someone the ratter knows and has a motive to assault), but it seems that most victims are random people downloading files they assume are innocuous but that contain RAT malware.

Probably the most archetypal story of a malicious and targeted RAT assault — one the DCA report cites in some detail — is that of Cassidy Wolf, the California teenager, who was voted Miss Teen USA in 2013.  In the months leading up to her pageant victory, Wolf was the victim of a ratter, who turned out to be a teenage boy at her high school named Jared Abrahams.  Abrahams had taken control of Wolf’s computer as well as her entire social media presence, and she was completely unaware that he had been slaving her webcam to capture naked images of her until the day she received an anonymous email threatening to leak these images and other personal information on the Web, saying that he would ruin her career plans by turning her into an “internet porn star.”  His demand in trade for his silence was that she provide him with a “sexually explicit” video; and Wolf has been rightly praised for her courage in standing up to her assailant, even after he made good on his threat to release compromising images. She contacted the FBI, went public with her story, and used her pageant celebrity status to raise awareness of the problem. Her decision helped lead to the identification and conviction of Abrahams, and by the time authorities caught up with him, they discovered he had been “slaving” the devices of approximately 150 young women and female minors around the world.  He served 18 months and is currently under house arrest.

Abrahams was a relatively sophisticated hacker — and he clearly chose to target Cassidy Wolf — but many ratters are more casual, random, and technologically inept than Abrahams, so they turn to the same resource many of us use for How-To advice — YouTube.  The fledgling ratter (sometimes called a script kiddie) need not find some remote corner of the dark web in order to learn how to spread and use RAT malware because there are dozens — if not hundreds — of tutorial videos on YouTube right now that provide complete, step-by-step guides to ratting along with helpful comments and links by fellow ratters.  (See, the Web really is about community!) In addition to these tutorials, we find ratter “fan vids,” which are not so much tutorial in nature as  vicarious viewing, so you can watch a ratter harass or spy on a victim while narrating his  observations like “Dude, watch this!” and “Oh, fuck, did you see that?  This shit is sick.”

RATs on YT
Just one of many ratter videos on YouTube. All the visible titles suggest tutorials in how to be a ratter.

Collectively, both the tutorial and the ratter “fan videos” have tens of thousands of views, and the DCA report indicates that about 38 percent of these videos are ad-supported, which means that both Google and the ratter are earning some revenue from the ad buys of major brand advertisers.  This means Google has a problem that reads something like this:  “This illegal invasion of an underage girl’s bedroom brought to you by Procter & Gamble.”  And as much as I criticize Google for profiting from the exploitative aspects of digital life, I would not be surprised if the company seeks to mitigate its role as an enabler of ratting just as it has with a zero-tolerance approach to keeping child pornography out of the Google-verse.  The DCA recommends Google assign a “human team” to address the role that both search and the YouTube platform are playing in this regard, but it cannot be overlooked that the Internet industry’s larger policy agenda, advocating a “hands off” approach to all things Web, provides cover for bad actors in a variety of ways.

And that brings us to one of the primary channels through which RATs are spread (and you’ll be terribly surprised), which is illegal file-sharing sites.  Because Trojan Horse malware is delivered by sneaking the virus into an OS while the user downloads a file he/she assumes is safe, it stands to reason that the black-market world of illegal media and software provides an ideal hunting ground for ratters to set their traps.  In fact, some of those tutorials on YouTube demonstrate how a ratter can download a file from, say, kickasstorrents, modify the file with his RAT, then re-upload the newly infected file awaiting random downloaders because, y’know, “sharing.”

By these methods, ratters trap random prey to be fed upon at leisure and prioritized according to the intent of the ratter.  This may include mining victims for credit card or other sensitive information;  or the ratter may slave the computer to mine bitcoins or to spread RAT infiltration to a larger system, like the victim’s place of business.  But in many cases, it seems, the goal of many a low-skilled ratter (i.e. teenage boys and young men) is to gain access to the computers of women and girls who have webcams.  Thus, as ratters manage to trap these prized victims (often with the enthusiasm of trophy hunters), they sell the IP addresses to other ratters — like commodities in their own little RAT exchange — where access to a boy’s computer sells for about $1 while access to a girl’s computer sells for about $5, according to the DCA.

Now, I have at least implied in the past that piracy sites should be boycotted by anyone who considers herself — or himself — a defender of feminist principles.  In addition to the fact that the site owners directly profit from advertising links to “services” that are tied to varying degrees of exploitation of women (e.g. MEET ASIAN GIRLS NOW!!), this DCA study of RATs demonstrates that these sites also unintentionally provide fertile ground for spreading malware that is consistently used to exploit girls, which is apparently valued at a 5:1 ratio over the exploitation of boys. I’m not sure what else needs to be said about that.

Finally, the DCA report does contain some indication as to how Internet companies, users, and law enforcement might actually work to address the challenge of this growing risk of personal invasion.  But in order to get there, the public will first have to accept that Internet companies and law enforcement have a role to play, that our RAT infestation is just more evidence that a free-for-all policy on the Web is a fundamental failure.

The Innovation Act is Anti-Innovation

Google remains the third largest corporate lobbyist in the country, spending a reported $4.62 million in the second quarter in Washington, with Amazon, Facebook, and Apple spending a combined $6.07 million in the same period.  Naturally, each company has its own interests—Facebook would like more skilled immigrants in the U.S. and Amazon wants to deliver goods by drone—but all of these tech giants, according to this story in Wired, have urged lawmakers to support a patent reform bill called the Innovation Act (HR 9).  Of course, the names of bills can be terribly misleading sometimes. Because, as far as I can tell, the Innovation Act is fundamentally anti-innovation.

At its core, HR 9 is meant to rid the patent system of the dreaded Patent Troll, who—like its cousin the Copyright Troll—will enforce a somewhat flimsy claim in some constituent patent it has no interest in developing, but pursues the case solely for the purpose of extracting money from an entity that is developing something new.  Even strong patent proponents will admit that bad actors exist—bad actors exist in every system—but that trolls are the exception not the rule, and more importantly, that the Innovation Act is based on a definition of “troll” so broad as to potentially disenfranchise many legitimate inventors.  In essence, the passage of HR 9 would be a rather sad comment on the fundamentally American rationale that established the intellectual property clause in the first place — the assumption that a great idea might come from anywhere.

The central problem with the way Silicon Valley interests are portraying the need for reform, according to Professor Adam Mossoff at the Center for the Protection of Intellectual Property at George Mason University School of Law, is that so many of the arguments are predicated on what he calls “junk science.”  Mossoff criticizes inaccurate studies of patent litigation, which have led to defining the term “patent troll” so broadly as to threaten a hugely inventive sector of the American market.  In legal lingo, the colloquial troll is generally referred to as a Non-Practicing Entity (NPE), but much of the data used to support reform proposals will define NPEs as “any entity that derives the majority of its revenue from patent licensing activities.”  As Mossoff—and former patent judge Paul Michel—will point out, this would include universities, start-ups, biotech firms—literally any entity that has the capacity and resources to invent but not the resources, structure, or expertise to develop, manufacture, distribute, and market. To quote Mossoff, “…the definition [of the NPE being applied] is so broad that it renders the results of its study completely uninteresting, unremarkable, and predictable – it’s like saying that 90% of people who sue over an auto accident own cars.”

If a doctor has a concept for a new medical device, both she and the public are going to benefit faster in most cases if the device is sold or licensed to a company that already has the resources to bring the instrument to the market.  Perhaps this same doctor will create a business entity that goes on to invent or improve several other medical devices, but which only ever sells the licenses for those products because it doesn’t make sense to become manufacturers.  Why should this innovative company’s patent interests be weakened by the fact that it would be defined as a Non-Practicing Entity?

In fact, where proposals like HR9 appear to lead is to further exacerbate the central hazard in the U.S. market, which continues to favor the massive corporation over the entrepreneurial endeavors.  It puts giant corporations at an unfair advantage—as if they didn’t already have an advantage—when it comes to licensing or exploiting the intellectual property created by individuals, start-up entities, or R&D-based institutions like universities.  Not only does this seem as though it would accelerate the disastrous trend of wealth consolidation, but it also appears to undermine the central, democratic principle that genius may come from the humblest corners of society and should be rewarded when it does.

On this note, I also have to point out that the arguments for this proposed reform to patent law sound a little too app-centric for our own good.  In large part, the aims of the “reformers” appear to be predicated on software and other innovations that tend to have short lifespans in the market–transformations measured in months in contrast to patents that last years.  And while I understand how distracted we can be with all the shiny objects that dance around on our little screens—giving us new ways to spy on ourselves for data mining companies; to hook up for casual encounters; to order a car service; or to play games on the crosstown bus—we should remember that there’s a lot of lower-tech invention and development that needs doing around here, even in the computing world.  We still need a greener energy paradigm, still have aging infrastructure, healthcare needs, security issues, outdated transportation systems, and growing concerns over resource management.  The inventions inherent in addressing any of these and other long-term challenges may well be in the minds of people whom HR 9 would define as future “patent trolls.”  That doesn’t sound like progress to me.

Flags & the Tyranny of Quantum Liberty

It has been fascinating to watch the power of social media rapidly catalyze a latent disdain for the confederate battle flag as a byproduct of our outrage over the hate-filled, random murder of nine defenseless people.  I say it’s interesting because I have long-believed that there are perfectly unemotional arguments against any official flying of these battle flags, even if they did not connote racism.  Slavery, Dixiecrats, and the KKK aside, those flags were carried by regiments who fought to sever allegiance to the Constitution of the United States, and so do not belong flown over any institution that now derives its authority, liberty, and security from the power of that same body of law. As such, I have never been able to fathom why any conservative would defend the flag’s use in an official context, let alone anyone who has taken an oath to defend the Constitution.

Of course, these battle flags do connote racism and slavery and hate. In fact, the Stars & Bars may well have become one of the symbols of the early KKK because that group’s first members were supposedly veterans of the Army of Northern Virginia, whose banner that was. And I suspect these flags will soon come down in their official contexts, while private sales of rebel merch will continue to skyrocket, despite mainstream retailers like Walmart and Amazon discontinuing the sale of confederate-themed items. Some citizens who purchase these emblems are, of course, racists and haters, who were doubly-appalled last week by the concurrent hoisting of the rainbow flag with the Supreme Court’s affirmation of marriage rights for gay couples.  (No doubt, It sucks to be on the wrong side of history. Just ask Robert E. Lee.)

But many who will suddenly crave rebel hats, mugs, tees, shot glasses, etc. will do so as a reaction to the feeling that this sudden anti-flag “tyranny” represents another example of federal government overreach. And it is this narrative, often expressed by both the left and the right, that I believe is being overlooked, particularly as it plays out in cyberspace. As Jacob Siegel explains in this excellent article for The Daily Beast, it is a narrative that has been seething in the underbelly of the Internet for years.  And most interestingly, Siegel describes a confluence in which the anarchic sensibilities of the left swim in the same ideological pool that nourishes hate-crimes destined to manifest in people like Dylann Roof. Siegel writes…

“A reactionary, defiantly anti-social politics has been emerging for the last decade. It was well known under the auspices of “trolling” and well hidden by its pretense of trickstersism. It was actually juvenile fascism and vitriolic racism but, because it grinned and operated in cyberspace, it was a sensation when it first appeared less than a decade ago. Excitable theorists, bored journalists and naive political activists looked at its strange, adolescent face and pronounced on its revolutionary potential.”

My fellow progressives look at Dylann Roof, see a racist with a gun and want to go after the racism and the guns.  This is understandable. But it has thus far been anathema to the progressive agenda to look critically at the role of social media itself in helping to foster the seemingly relentless increase in these localized massacres.  Siegel provides insight into the evolution of hate groups, first on 4Chan and now on Reddit, and he describes the split within the “community” of trolls that produced the vigilante-style hacktivism of Anonymous. From Siegel again …

“In 2008 when The Church of Scientology began suing websites, forcing them to remove videos the Church considered private or defamatory, 4chan turned its attention to trolling the Scientologists. Eventually that produced a schism on 4chan. Some members, inspired by their success going after Scientology and the attention it brought, wanted to take a more activist role. The dedicated trolls rebelled. The activists splintered off and became the collective represented by a Guy Fawkes mask, known as Anonymous.” 

Although it is presently a progressive or liberal position to champion an “open” Internet bordering on a lawless internet with an absolutist approach to speech and a professed intolerance for infiltration by intelligence services, we might want to reconsider a more sober and balanced approach to these matters.  Because we can remove all the flags we want and scream for all the gun control we’re never going to get (or isn’t going to work), but what does work from time to time is intelligence gathering and, dare I say it, public demand that owners of businesses not support or profit from hateful, offensive, or criminal behavior. Siegel writes …

“Reddit defends the existence of communities like r/gasthekikes, r/watchniggersdie, and r/rapingwomen on free-speech grounds. That atmosphere has attracted right-wing extremists who left or were booted from other more established sites like Stormfront, where moderators, aware of scrutiny from law enforcement, have stricter posting rules.”

If Arkansas-based Walmart believes it’s time to remove a half-innocuous symbol from its merchandise, does it really make sense that San Francisco-based Reddit can defend hosting platforms that support the encouragement of racists, misogynists, and anti-semites to commit acts of violence?  Even if 99% of the idiots in the rapingwomen “community” on Reddit are not prospective assailants, and their speech is technically protected, that does not mean Reddit can claim this forum serves any social value whatsoever. And when the owner of a site or a publication makes a judgment call to moderate or even delete material that is both offensive and useless, it’s called editing, not censorship. It is the difference between a mature grasp of the contours of freedom and an adolescent penchant for anarchy. Anarchy is an illusion of freedom in which nobody is free except the monsters. Perhaps the most compelling statement Siegel makes is this one:

“What’s long been clear to the fascists has eluded the rest of us for a few reasons. The self-serving deceptions embedded in the idea of trolling, for one. And our persistent difficulty in grasping, despite all evidence to the contrary offered by governments and Silicon Valley plutocrats, that the Internet was not built to liberate us.”

Yes, I’ll be happy to see confederate flags placed in their proper historic context despite the fact that doing so is already amping up racist reaction.  As such, it may be time, while we rebuke the symbols of hate, that we also look more critically at the new mechanisms through which hate preaches, recruits, radicalizes, and activates its soldiers and lone-wolf terrorists. Because many progressive “digital rights” proponents have bought into what I’ll call a quantum view of civil liberty in which the infinite, micro-universe of cyberspace creates infinite opportunities for micro-infringements against an infinite sense of liberty. This mindset cannot help but redefine ordinary boundaries of fairness and decency as censorship. It assumes naively that people left to work things out in the cage-match of cyberspace will naturally produce a collective morality that is somehow more pure than the morality we shape in the physical world and express through the antiquated “rule of law.” Call me a cynic, but as black churches burn once again in the South, I struggle to see evidence of this new, cybernetic enlightenment expressed in the Reddit forum watchniggersdie.

Meanwhile, progressives who buy into the quantum view of civil liberty inadvertently provide aid to domestic terrorists like Roof by demanding policy, which actually makes the job of intelligence services more difficult.  As recently posted, Senator Sheldon Whitehouse (D-RI) stated that Internet-industry funded fears, exaggerating the role of public vs private surveillance of cyberspace has made rational debate in Congress over the proper role of intelligence nearly impossible.  So, while we insist upon the removal of hateful symbols, accepting that this will inspire more hate crimes, perhaps we progressives should also allow for the possibility that there are well-intentioned intelligence experts crawling through threads and chat rooms, who are in fact looking for the next son of a bitch planning another lynching.

When it comes to flags, corny as it may sound, I think about Aaron Sorkin’s fictional President Bartlett from The West Wing, who concluded many stump speeches with the declaration, “This is a time for American heroes, and we reach for the stars.”  The reference to stars is both literal and metaphoric.  Literally, the nation born in science and the enlightenment, and blessed with so many resources, has both the capacity and responsibility to lead the world in grasping the actual stars.  As a metaphor, I think “reaching for the stars” broadly refers to looking with hope toward the future.  The U.S. flag is grounded in heritage, it’s composition a derivative of the British colonial flags, but in place of the Union Jack that once adorned the corner, is the field of stars.  The stripes represent history, but the stars are about the future — about the capacity for the collective states to continually transcend the past, even to defy gravity, as when MIT nerds and good-old-boy pilots once reached for the stars together. Surely anything we call progress must be held to that standard.

Have a safe and happy Fourth of July.