MatthewKeysSearchWarrant

							                             UNITED STATES DISTRICT COURT
                                DISTRICT OF NEW JERSEY


IN THE MATTER OF THE SEARCH OF
5201 RIVERSIDE STATION BLVD.,                     Case No. 12-4085 (MAH)
SEACAUCUS, NEW JERSEY, 07094,
WHICH IS MORE PARTICULARLY                        SEARCH WARRANT
DESCIRBED IN ATTACHMENT A

To:    Special Agent Gabriel Andrews and any Authorized Officer of the United States

Affidavit having been made before me by Special Agent Gabriel Andrews who has reason to
believe that on the premises known as


                                     SEE ATTACHMENT A


in the District of New Jersey there is now concealed a certain person or property, namely

                                     SEE ATTACHMENT B


I am satisfied that the affidavit and any recorded testimony establish probable cause to believe
that the person or property so described is now concealed on the person or premises above-
described and establish grounds for the issuance of this warrant which is

                                     SEE ATTACHMENT C


The facts to support the issuance of a Search Warrant are as follows:

                                     SEE ATTACHMENT D


YOU ARE HEREBY COMMANDED to search on or before #t&6"                        /Z_ £>o/£
(not to exceed 14 days) the person or place named above for the person or property specified,
serving this warrant and making the search in the daytime, 6:00 a.m. to 10:00 p.m., and if the
person or property be found there to seize same, leaving a copy of this warrant and receipt for the
person or property taken, and prepare a written inventory of the person or property seized and
promptly return this warrant to the Honorable Michael A. Hammer, U.S. Magistrate Judge as
required by law.

October 3. 2012. at    3:«f^„                        Essex County. New Jersey
Date and Time issued                                 County and State

Honorable Michael A. Hammer                                                             vJUi**~
United States Magistrate Judge
Name and Title of Judicial Officer                   Signature of Judicial Officer
                                      ATTACHMENT C



       Evidence of violations of federal law, including Title 18, United States Code, Sections
371 (conspiracy), 1030(a)(5) (transmitting malicious code), and 1030(a)(6) (trafficking in
passwords).
«no                                                             internetfeds (                                                                                                CD

                      A»h                                                                                                                     <X Search Messages
 Style   Emoticons   Encoding                                                                                              Mark   Clear                Search
                                                                                                                                                                     —




                                Welcome. We are the Internet feds. Everything that Is shared here Is private and must remain In this channel unless stated otherwise.
                                            I looks around                                                                                                      i2:SSom
         OperationPayback
                                             Wow, things got quiet fast.                                                                                        i2 JSoni

                                    oh i jst seen the others in tfoperationpavback talking about the LHC and CERN                                               12 S7pm
                                    someone showed me thels the other day I couldn't stop laughing                                                              i2.S73m

                                    http://hcc.web.cern.ch/hcc/control/vacuum.php?sector=/../,./,./control/vocuum.oho^OO                                        12:S7pm ~
                                    LFI on CERN xD                                                                                                              •2:S6sni          =
                                             LOLs.                                                                                                              j2:SBpm

                                            Their website has no pictures :/                                                                                    :2.;Ssm

                                            i pokes Kayla                                                                                                           i03pti
                                    :3?                                                                                                                             iOJo-n I
                                            Ohai                                                                                                                    i 03p-ii
                                                                                                                                                                                      H

                                            .0                                                                                                                      1 OJpn

                                            I dunno I'm bored and nobody's talking in here.                                                                     ! 04pn

                                          Wait, that LFI doesn't make sense :S                                                                                      i O'.p-n          CO
                                          It goes 3 directories up...                                                                                               iOSpil
                                          Oh, nevermind                                                                                                         1 G6p.ii

                                          The script is at D:\WWWRoot\HCC\control\vacuum.php                                                                    lOGpii
                                            So what does that do             / Kayla?                                                                           1 07pm
                                           Ohshi-                                                                                                               2 IfJpii
                                    you can basically use it to read any file from the server                                                                   3 lOpii
                                            How?                                                                                                                MOpii
                                            hears loud explosion from Switzerland                                                                               1 lOp-n
                                    if there's mysql/mssql config file you can get passwords from them and dump their database                                  llOpn
                                    it's Just finding them                                                                                                      i lOpn

                                           It's a Local File Inclusion vuln, AES                                                                                ;        i .oil




<*-