I am reffering to a part of this news video: Hak5 news video starts at 5:33

I found out that proton mail can only give out encrypted message to requesters(reference):

ProtonMail can only hand over encrypted messages as we do not have the ability to decrypt user messages.

How can the encrypted message help the FBI or other requesters to plead the attacker guilty?


What you shouldn't forget about encrypted e-mail, is that while the message body is properly encrypted, some meta data like the subject, sender or receiver aren't.

The subject of the emails, together with the metadata to link the sender-person to the receiver person, can be very valuable.

In an example of a terrorist case, someone who has been suspected of planning an attack, who happens to be mailing with a lot of users that have known terrorist group links, can be enough proof to assume that he was at least involved with them.

This could be a pointer that our suspect is actually what we think he is!

  • If my mail name is some random ID for example 5x6fh45@protonmail.ch, this is still usless in your example with the terrorist group? – Nightscape Oct 5 '18 at 13:24
  • Unless they get a hold of your computer and find the login details to that account somewhere. Or someone who's willing to testify that that is your mail address. A sole piece of metadata probably can't be used for much good, but the correlation of different pieces of data from different platforms might be enough to link that account to you, and then the metadata becomes useful again. – Nomad Oct 5 '18 at 13:43
  • Let's say you create a forum account with that mailbox, and FBI asks the Forum webserver logs, they can see which IP created the account associated with that e-mail for example. As you can see, now it becomes a lot more dangerous :-) – Nomad Oct 5 '18 at 13:45
  • Can you give my a reference or explain my why some meta data like the subject, sender or receiver aren't encrypted? – Nightscape Oct 22 '18 at 8:25

The most likely scenario is that ProtonMail was being used as the Command and Control Server, and the bots were configured to listen for messages from/to certain user names and execute whatever command was found within. Now, if you see a message from one user sent to 1,000 users (or perhaps another user with 1,000 logged IP addresses), and within seconds those 1,000 IP addresses light up with some sort of DDoS attack (reflection, jumbo packets, whatever), you can be pretty certain who the culprit is.

The moral of the story is: do not use your DDoS targets as a C&C server unless you want to be caught. The fact that the messages were encrypted doesn't matter, because apparently there was an obviously clear correlation between user names, IP addresses, and the timing of the attacks. Using encryption doesn't automatically protect you from other forms of evidence, such as IP logs.

As the newscast mentioned, they didn't use proper OpSec (Operational Security), or they might not have been caught. For example, configuring each bot to use a VPN for receiving the messages but attacking directly, randomizing the time between message and attack, using a separate user name over VPN to command the attack, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.