Post by @masek@infosec.exchange

2025-06-21 13:36 UTC

PostMortem: Assumed DOJ Montana Leak of Phone DumpsType of leak Highly confidential information on a public SMB share without authentication Threats from the leak I see the following threats: Integrity and Confidentiality of investigations into serious crimes compromised Privacy of U.S. citizens compromised (very likely to contain most intimate data)Providing 3rd parties hostile to the U.S. with blackmail material 1/4

Replies (1)

@masek@infosec.exchange 2025-06-21 13:37

TimelineMay 14th 2025: Scanner of Security Researcher flags a public SMB share for inspection (leak open at latest at this date)IP addresses involved: 216.220.10.217 and 216.220.10.222June 5th 2025: Security Researcher analyses the SMB share and discovers phone dumpy created with Graykey. Some data is mere hours old, therefore this is a live leak.In between: File names show that some investigations are tied to child abuse as directories contain "CSAM" as part of the directory names.Remark: Usually investigations are identified by three parameters in thge file name: type of crime, location and some keyword (optional). In case of major crimes, using those identifiers one could easily identify those crime through press reports.One directory name seemed to indicate the dump to be done from a police officers phone who comitted suicide.June 12th 2025: As the Security Researcher could not identify a clear owner and previous contacts to CISA and FBI didn't produce any reply, he contacts me and asks for support. I receive as supporting material:One extraction report by Graykey for "Policy Violation" investigationList of file names in the leakJune 12th 2025 06:42 UTC: Asking friends in my environment for contacts in the U.S. to help with this leak.June 12th 2025 ~19:00 UTC: Start discussing the leak with journalists in the U.S. Due to the CSAM topic, there is great reluctance to engage.June 13th 2025, 19:20 UTC: From the extraction report I assume that this investigation is done by the Cascade County Police Department. I attempt to contact Sheriff Jesse Slaughter him by: mobile (spoke on his voice box), text message (iMessage) and email. As of today there is no answer.June 17th 2025, 07:22 UTC: A second security researcher informs the Bozeman PD about one of their investigations to be in the leakJune 17th 2025: Second security researcher also reaches out to the former Attorney General and former Governor of Montana Steve Bullock via LinkedIn to help with the leak. As of today there is no answer.June 17th 2025, 08:47 UTC: Bozeman PD reaches out to the second security researcherJune 17th 2025, 09:10 UTC: My initial post on Mastodon (https://infosec.exchange/@masek/114697924639525296) asking for helpJune 17th 2025, 11:36 UTC: On recommendation received, I contacted the Attorney General of Montana by Email. As of today there is no answer.June 17th 2025 12:46 UTC: Former FBI employee offers to create a contact.June 17th 2025, 16:20 UTC: Contact with employees of the software vendor (came through the SM post above). I provide them with serial# from the extraction report and additional information in the next 30min. They say they identified the owner of the license and will attempt to contact them.June 17th 2025, 17:21 UTC: On recommendation received, I contacted the County Attorney of Lewis and Clark Counry. As of today there is no answer.June 17th 2025, ~20:00 UTC: Initial two-way contact with FBIJune 17th 2025, ~20:00 UTC: Leak is closed (according to my information the communication chain through the vendor and Bozeman PD reached the lab at pretty the same time)June 18th 2025 between 08:42 and 16:11 UTC: Further communication with the FBI

Open ##2426778