Slashdot Mirror
HP Uses DMCA To Quash Vulnerability Publication
Several readers wrote to note the fact that HP has evidently threatened to use the DMCA and computer crime laws against SnoSoft who have found a security flaw in Tru64. The quote from the HP VP is that the accused "could be fined up to $500,000 and imprisoned for up to five years."
So this is the real reason HP didn't want Bruce Perens to demonstrate against the DMCA?
Very mature compared to what big business does. "Wahh wahhh wahh!!! Help us Uncle Sam, we're poor defenseless transnational corporations!" Buncha whiners.
People shape laws. Not the other way around.
that someone is writing down all these "infractions" of the DMCA so that regular people can see a) what a pathetic joke this law is and b) that the government is no longer making laws for the people but for the lobbyists instead.
When Alan Cox originally discussed the notion that companies would (mis)use the DMCA in the security field, he was widely attacked for being silly.
Anyone still feel like laughing?
Here's another fucking BIG CORP trying to strongarm to get there way.
Fuck HP. IT's like Ford trying to get the safety concerns of the Pinto hushed up.
Consumers are in danger, and WE COME FIRST.
Finisterre said that while he wanted to resolve the dispute with HP, he resented receiving DMCA threats. "We are like the guys that found out that Firestone tires have issues on Ford explorers," he said. "It's not our fault your Explorer has crap tires. We just pointed it out. We should not get attacked for pointing out issues in someone's product nor for proving it is possible."
When will people learn this is the same thing?
Finding and publishing a security hole in an OS is not a way to circumvent copyright protection.
If I take over somebody's True64 machine via this security hole, I haven't broken copyright at all.
Now, if I take documents off of the server, then I may be breaking copyright, but I don't think the connection is strong enough to stand up in a court of law.
I could hold up a book store with a gun and make them give me their books. I've stolen the books and therefore broken copyright. Does that mean we should ban guns since they are a possible copyright protection circumvention device?
It was legitimate for you to cooperate with HP's valid concern that, as a "deep pockets" organization it would be too risky for them to let you challenge the DMCA. I understood that.
But now it appears that you work for a company that is using the DMCA as a club to suppress discussion of security flaws. It doesn't seem that the two hats you wear (your HP role and your open source leadership role) are compatible unless you can persuade HP to back off.
It is possible, of course, that the DMCA threat is coming from one manager who is shooting his mouth off. If so, we need a clarification from higher management: is it the policy of HP to use the DMCA to suppress discussion of their security flaws, or not?
* Technically, they only threatened to invoke the DMCA. As of now, HP has also only threatened to invoke it.
-- Don't Tase me, bro!
this is really a shame. hp was one of the technology companies that had a lot going for it.
when you are fighting in a tough market *and* trying to make a merger happen without too much bad stuff, it seems that it is counter-productive to play this game: you make people mad, you spend resources (money and man-hours that could be easily used elsewhere) and you are *not* going to achive the immediate goal of supressing bad stuff (real or imagined).
so hp gets more points in the bad pr column, they waste money, and the problem doesn't go away. i hope that they spin off the printer division before they crash and burn.
eric
p.s. i guess the worst part is that hp *didn't* learn from all the other companies that went down this path.
How are we to feel secure while computing if it is illegal to check up on the companies providing the software/hardware solutions?
... except the criminals who are going to exploit the vulerability and steal hard earned money.
Imagine if you would, a secure piece of software ( or a secure piece of hardware ) is sold to handle monitary transactions, no-one can verify that the software/hardware is infact secure
Yeah for the DMCA for protecting corporations instead of the individual!
my 2 cents.
The article says the informed HP about these vuln's a year earlier, in reality it is up to the company to secure their products, mistakes happen, but should Ralph Nader be put in jail for telling people that the Pinto's gas tank would explode on impact?
- Securith through Obscurity
and- Security through Diligence
we now add the mighty- Security through Litigation?
To be fair, when do the handgun designers go to jail again?Kevin Fox
Ok someone fill me in here:
How on earth does a law pertaining to the circumvention of copyright protection systems apply at all to someone releasing a security flaw in an operating system?
The public has the right to know about these security flaws, just as much as we have the right to know if the tires we buy pass safety standards.
HP trying to cover this up just proves its a problem. HP is using the DMCA to prevent people from discussing valid flaws in their OS'.
People have the right to know if the car they're driving -- or are going to buy -- is unsafe. Why? Because their lives depend on it, literally. For the same reason, people have the right to know if the OS they're using is secure. Why? Because their lives depend on it, or at least their carreers. Data important to one's carreer (i.e., scientific experimental data) is stored on one's computer. Private information -- i.e., credit card information -- is stored on a computer. Security holes can literally destroy one's life.
We have the right to know exactly what problems their are in our software.
social sciences can never use experience to verify their statemen
Yep. Murderers don't kill people; guns do! Don't send the murderers to jail; go after the gun manufacturers.
The USC made a stupid law; just because a stupid law exists it does not mean that it should be used to quash legitimate research. If Carly had half a brain, she would fire the idiot VP and apologize to Snosoft. But don't count on it happening anytime soon.
Let the crackers have it.
...richie - It is a good day to code.
So free speech is good for academics, but not for random hacker?
What difference does it make who finds and reports a bug? The cool thing about the Internet is that you don't have to be a professor at MIT to publish security exploits. The publications speaks for itself.
And if I'm running affected software, I don't care who reports the problem - as long as I find out and get a fix.
Would you still feel the same if your bank kept your accounts on an Tru64 HP machines?
...richie - It is a good day to code.
Call me crazy, but if I were a mega-corporation, I wouldn't want someone releasing "warez" to break into my systems this way.
No, of course you wouldn't like it. And, if you were an emperor who got suckered into walking around naked, you'd be fairly pissed at the kid who pointed out that you were, in fact, naked.
But, this story has nothing to do with HP "liking" or "not liking" it when people (rightly) point out that they're walking around naked. The story is about the fact that the DMCA has emboldened HP to the point that they feel it's better to walk around naked and sue anyone who notices, rather than buying some reasonable clothes.
Etiquette in the security community demands that the discovers of holes give companies reasonable time to respond to security problems, before publicizing the security problems. But this courtesy is not, in any way, a courtesy towards the company that manufactures the flawed product. That company's opinion in the matter doesn't mean squat. It is a courtesy extended entirely to the users of the product. Users are harmed if they do not know about exploitable flaws in the products they use, but at the same time users are harmed if the exploitable flaws are widely known before patches are available. The only reasonable role for a company with flawed products in the security process is to work diligently to minimize the harm to users, by the only method available to them -- by expediting patches for their products, and thus providing an environment where the user can be informed of security flaws in their product as quickly as possible.
Unfortunately, what HP has done here is imagine itself to have some other role in the security process -- someone at HP is under the completely mistaken impression that their opinion of the security process matters in any way. It does not. The courtesies of the security process are entirely towards the users of the flawed product. People have a right to know about flawed products. HP has the opportunity to provide patches to their product, so that those users might have some alternative to simply throwing all of their HP equipment in the garbage, but that is entirely HP's opportunity, and really of no concern either to the users or to the security professionals who disclose the hole.
Companies that deal with software are less supporting of DMCA. If they have a bug in their software, they whip out a patch, put it on their webpage and tell people to install it themselves. They have little to lose if someone hacks around their software since they can more cheaply play a game of cat and mouse with the hackers with the full source code at their disposal where the hacker has none of the proprietary code.
Talk about the pot calling the kettle black...
If companies start to make it a habit of suing people who tell the truth about them people will stop trusting these companies. Why did they tell HP about it first? They were honest and got bitch slapped. So, next time the researchers will think twice before going to the company. Maybe they will just publish on FreeNet or leak their story on Slashdot first?
Imagine...
You have a brand-new deadbolt lock installed on your front door.
A month later, a master key for your lock's exact model leaks out.
Every thief within a hundred miles has a key to your front door, they just have to notice that it fits to rob you blind.
Fortunately, a neighborhood watch group got wind of the leaked key, and started publicising it heavily, saving countless people from break-ins.
So who does the lock manufacturer go after, on learning of this problem?
Not the engineer who stupidly designed a master-keyed lock for the general public...
Not the thieves who make use of this information...
Not even the problem itself, which would take only a limited recall and almost no effort to correct...
Instead, they go after the neighborhood watch group, on some shaky grounds about loss of confidence in the company.
It strikes me as a *DAMNED* good thing that we only have such f'd up laws relating to computers, rather than physical security. Oh, wait, one *could* read the DMCA as applying to physical security. Oops. Time to go install a 2x4 on a latch-and-hinge across my front door.
I dont see the point of taking HP to task for it. .. whoopdee doo.
.. what we need is a change in the law.
.. too often a flaw gets found and the company sweeps it under the rug maybe they'll fix it in the next version but prior versions are vulnerable.
.. why cant I do it with the applications I use and store my depply personal information (from baby pictures to tax and health records) on?
It's a waste of time. Even if they back off
Please
Hackers can expose findings and report them to companies
Given the sad fact that all our politicians (not just in america but worldwide are elected by money) maybe the following compromise can be reached:
a) Hackers who find vulnerabilites must email a notice and description to the company. He must try to give at least 24 hours notice before announcing it to the public unless he knows of an imminent exploit in the wild (like an impending mass DDOS attack or something). In that case he should be allowed to announce it to the public immediately.
b) Companies that take no action (that is dont make a patch available/requestable) on a vulnerability that was reported to them but not announced to the public, are liable for exploits.
c) The setup of a third party security company or government department where hackers can email reports of finding vulnerabilities. This is like CERT or bugtraq but the organization must have the funding and capability to pursue inaction on the part of companies that do not fix reported and well documented security flaws.
Is there any way for you to use your publicity to bring something like this about?
At least try. I hate the fact that curiousity is now a crime. I am allowed to take apart my car and see how it works
Thanks,
Johan
I can see it here, US Government is progressively inventing laws that ensures:
....Imagine, no violence, no crime, no hunger...a perfect world!
Only the Government can investigate crimes.
Only the Government can test, examine, uncover defectives in consummer products
Only the Government can perform reverse engineering on anything
Only the Government is allowed to use top-grade encryption
The scope of Free Speech is defined by senators, and it happens that no constitutional right are being intruded.
That's to say, US would become a country where citizens, by laws, SHOULD trust the Government and any questions on the already established laws and regulations are prohibited.
What's wrong with the picture? I don't know, but I've read a novel book about a country whose government has absolute power over their citizens and no citizen is allowed to question the decision of the government. This government does not use any military power or violence to control their citizens, but by laws.
IIRC at the end of this story all the citizens end up living in an array of big tubes of liquid, and the rest of the rebels are either jailed(brains were sperated from their body) or terminated(becomes food for others). It's like Matrix, but this time some humans control everything.
Don't say it...don't say it...I'm warning you...
Use Linux.
Damn, I said it.
Why the fuck don't people want exploits fully disclosed? Sure, I don't have a problem with waiting a week or so to give a team/vendor (yes, even Microsoft) a chance to roll out a patch before making it public. It's a courtesy, not a necessity.
<rant />
Clearly some sort of political action is required. I suggest:
1. The DMCA needs to be repealed or ruled unconstitutional. Hopefully the ACLU or the EFF will take a case that'll get us there. Or some rich philanthropist geek could 'violate' it by exercising their constitutional rights. But the best ploy is for every one of *us* to contact (visit,snailmail,fax,call,email) 'our' reps in the House and Senate, rationally outline our objections, and protest like hell if they don't. Civil disobedience, etc.
2. Abolish corporate personhood (same methods).
3. Abolish the lobby industry.
4. Abolish campaign finance. Make it publicly funded, free TV-radio spots (public airwaves) equally distributed among ballot-qualified candidates.
We've let corporations have far too much swing. I'm all for making a buck, but Jesus F***ing Christ...
Today I read an article on news.com (http://news.com.com/2100-1023-947325.html) that Hewlett-Packard has intended to use the Digital Millennium Copyright Act (DMCA) to punish a company that has released information about a security vulnerability in an HP product. For quite some time I have been telling you that the DMCA is a bad law that needs to be repealed, and this is just more evidence to that effect. HP has known about this vulnerability for a year, but has chosen to do nothing to fix it.
HP's action could set a precedent that would stifle technology research. Companies would be free to release broken technologies that would eventually be used in high-security environments. Anyone who attempted to test the strengths of these products would be branded a criminal.
HP's customers and the American public deserve to know about security issues in HP's products. Withholding such information is just like the accounting scandals that have been rampant in recent times. Insecure technology is a weapon that hackers and terrorists can use against us. So when an American company decides to hide behind an American law rather than fix it products, our politicians need to re-examine that law.
I urge you to sponsor legislation that will repeal the DMCA. Americans deserve better. Please write back to me and let me know that you support my fair use rights in a digital world, and that you'll be working to repeal the DMCA.
And the men who hold high places must be the ones who start
To mold a new reality... closer to the heart
Bruce,
I guess I don't understand how full disclosure can equate to a shakedown.
The company (snosoft) seems like a more or less legit research company, and the fact that they have a full disclosure policy in no way says that they are trying to take out companies. It just says, up front, that they have a policy of disclosing these security breaches that they find.
On the other hand they have to make money somehow - so they contract out their services to companies who wish to have their software audited.
I could be wrong, but by looking through their posts on security focus, I don't think they are out to extort money from companies - and this is especially true if they gave HP a year to fix this problem (in fact if that is true then you should REALLY stick it to the top brass).
It could go either way - but it doesn't look like they are in the business of extortion. And the fact that they have been around for a while, and seem to be respected in the security community says quite a lot....
ON THE OTHER HAND.... I don't see how it is in any way shape or form right for HP to sick the DMCA on them, no matter what their business practices are. This is a vulnerability in HPQ's software and should not be treated with such arrogance (don't report it or else!).
Just my $.02
Derek
As long as what you say doesn't jeopardize national security, suggest an interest in terrorism, reveal trade secrets, infringe on copyrights, trademarks, or patents, isn't a description of sexual activities involving anyone under the age of majority, isn't disruptive, doesn't explain how to circumvent copyright, doesn't explain how to acquire or use drugs, isn't seditious, doesn't reveal trade secrets, doesn't threaten our vital national unity during this ongoing and arduous war against terrorism, and is otherwise relatively inoffensive, you can say almost anything you like in the US.
I think HP is wrong with its DMCA style threats, because they are not appropriate. However, I can sympathise with HP and understand why they may have "lashed out". I think the hacker in question was wrong to irresponsibly post the exploit for script kiddies to start playing with fire. For all the debate about various sorts of disclosure processes, it's quite clear that this approach potentially has a high impact upon any deployed systems and gives no time for either the vendors or the administrators to take action. This is just not a responsible real-world approach to dealing with security issues.
-- Matthew - matthew.gream@pobox.com, http://matthewgream.net
Even if it was a company that engaged in outright extortion, ie "we just found this hole, pay us $10,000 by Friday or we release it", some advice my Mother gave me comes to mind.
Two Wrongs Don't Make a Right
HP's Customer's are inocent third parties in this matter. Once the exploit was released, no matter how shady the people who released it were, HP should have been trying to notify it's customers instead of engaging in a futile attempt to put the cat back in the bag. HP has increased the harm to innocent third parties by not contacting them, and now their actions have insured that the code for the exploit is more widely distrubited than before.
SnoSoft's actions may have been wrong, but that did not give HP a license to engage in wrong actions of their own.
Quemadmodum gladius neminem occidit, occidentis telum est
I'm going to wander slightly off topic here but I feel what you are saying is wrong. Today, top company exectutives seem to be above the law. They can operate their companies however they choose. No one ever seems to hold them accountable. A company goes bankrupt, thousands loose their jobs and top executives are laughing all the way to the bank. In this example an executive acts in an irresponsible manner that could affect many of his customers, and you suggest mearly a wrist slap?
UNIX/Linux Consulting
No, Bruce, Snosoft saying "Our advisory release policy is full disclosure unless bound by contract" does not seem like a shakedown to me. HP saying "If SnoSoft and its members fail to cooperate with HP, then this will be considered further evidence of SnoSoft's bad faith" seems much closer to the language used by blackmailing thugs. There is no implied threat in the former, because full disclosure is not a threat. The letter from HP to Snosoft, if the news.com report is accurate, is nothing but a threat.
That is my call on this. I answered, since you asked. And the reason why I'm not calling you on the phone telling you this is because I think (and I suspect there are others as well that feel similarly) that cold-calling someone like that would be rude. So that would explain why you're getting calls from soulless "reporters" instead of maladjusted geeks.
Sig (appended to the end of comments you post, 120 chars)