Slashdot Mirror
Talk About A Security Hole, Go To Jail?
Nu11.org writes "According to a SecurityFocus article, 'Federal prosecutors in California went too far when they put a man in prison for disclosing a website security hole to the people at risk from it.'" According to the article, "...by explaining how the vulnerability worked, and why customer data was at risk, prosecutors asserted, the security specialist 'impaired the integrity' of the affected network", citing the case of Bret McDanel and his former employer, Tornado Development, Inc. We've discussed the disclosure of software exploits recently.
When doing wireless security assessments, I've noticed neighbooring companies with unencrypted WEP access points, but I don't bother telling them because of this sort of thing.
but he did kinda take extreme measures. But they did even worse by deleting the mails
Well, if it's too dangerous to disclose security holes when they know who you are, do it anonymously on Slashdot. That'll sure get their attention...
Do not look into laser with remaining eye.
One thing not mentioned in the article was where he got the list of email addresses of the Tornado clients. If he had taken this information when he left Tornado, there could be legalilty issues involved there as far as client privacy goes. Perhaps that weighed on the jury's decision...
I keep hearing stuff along the lines of this and it reminds me of things you used to only hear of in the former Soviet Union. What is this country coming to?
"Sir, if you don't lock your car, someone could steal your stereo."
"Officer! Arrest this man! He has figured out a way to steal my stereo!"
Sign. Some people are just too stupid to live.
Hate to say it, and I suppose I should prepare for the 'flamebait' moderation, but the editorial is a bit biased on this one. Will this really stop people posting to bugtraq? Not really... this man was not (like the bugtraq contributors) responsibly informing people who needed to know about the details of the bug. He distributed this information to thousands of potential attackers (i.e. random strangers, not the company involved), and in the process spamming thousands of people who just didn't want to know (yes, spam; I'm sure every spammer thinks his mail is absolutely crucial to every recipient, but it's still spam).
From the article:
He could have explained to the customers that their information was at risk, without revealing quite so much detail. But according to the government's theory of liability, this would not have prevented his prosecution. Moreover, as is frequently the case with security vulnerabilities, this likely would have prompted a quick denial by Tornado that any such bug existed -- and they may or may not have fixed them.
It looks like just saying that there was a flaw would have gotten the guy thrown into jail.
'ta
It was the company who "impaired the security of the network" by not fixing the vulnerability once they were informed of it. The whistleblower did nothing to impair the security of the network, he merely informed the users of the impaired security status of the network,
b) They continued to advertise their webmail services as secure despite knowing that they were vulnerable.
He should get all of the users of the service together and class-action sue Tornado for knowingly lying to them about the security of their service.
It's pretty clear most of you haven't read the article. All the police state/hat the USA/Big brother comments prove this. The guy was stupid. He went way beyond what normally is done to disclose major security flaw.
That would be a very interesting exercise. It would be facinating to see just how fast OSDN would roll over and cough up the "Anonymous" IP address to the feds.
He went to jail for sending emails? Perhaps he should have just sent a death-threat to his somebody by email, probably would have netted him less time.
Seriously, more and more nowadays you read about people being incarcerated for defying authority, the government, of worse: corporations. Real crime is being pardoned, especially corporate white-collar criminals, while the jails are being filled with people just trying to exercise their rights.
America strikes me as a very odd country. There, you have a right to bear arms, based on the revolution against the government sometime ago. Yet somehow, say one wrong thing, against the government, or against their sleazy funders (big business) and your screwed. Give us another 10-15 years, and the crime for whistleblowing with be more than murder - and you'd be better off solving your problems with a gun than making an honest attempt at helping your fellow countrymen.
Thirty spokes share the wheel's hub,
But it is the center hole that makes is useful.
Shape clay into a vessel, it is the space within that makes it useful.
Cut doors and windows for a house, it is the emptiness that makes them useful.
Therefore, profit comes from what is there,
usefulness from what is not there.
~Lau Tsu, Tao te Ching
Its interesting that other professions actually have a duty to inform others of their vulnarability - while in IT you can be punished for it.
As a physician, if I find that a patient presents a danger to another person (for example, a man has a psychotic break and intends to kill his wife), I have a legal and ethical obligation to inform that person (whom I have never met.) If I fail to do so, I can be thrown in jail.
Its not hard to envision a future scenario in information security where one could have legal obligations both to inform and _not_ inform -- thus finding a security hole would guarentee punishment no matter the road taken.
+--------------------- You idiot! I told you we were facing the wrong way!
Isn't this type of action protected by whistle blower protection laws?
There's a question of whose data was at risk. In this case, it was the customers who had data at risk. His notifying them was proper to the cause of enabling those with possibly sensitive data to protect it. To repeat: It was not the data of the e-mail provider that was at risk, it was instead data belonging to the customers, and the provider which was putting that data at risk.
Define the "system" for purposes of interpreting the law in virtual terms, as a data-space. Consider that primary rights in that space belong to whoever leases it. If you break into a business office, the breakin is against the occupant of that office, not the landlord. And if you discover that the landlord has left the master key to the building's offices where thieves can make copies, your moral responsibility is to the tenants, to warn them the locks are insecure, rather than to the landlord, to help cover up the collusion with thieves.
"with their freedom lost all virtue lose" - Milton
Excuse me, but exactly WHY do you think he shouldn't have emailed the customers? We have the right in this country to say whatever the fuck we want, to whoever we want to say it to. And the point of the justice system is exactly that: Justice. It's not supposed to be about who has the most money -- it's supposed to be about who's right.
This guy didn't do anything wrong. If you're not revealing classified information you can say whatever the hell you want. What we're dealing with is a vicious, stupid, unethical prosecution, if the facts in the security focus article are accurate.
you're using the system password as part of your data security on your Win98 box.
Did you know that the entire password system can be aborted by simply hitting escape?
Have I just commited a federal crime, and if so, why?
KFG
I call BS on three points.
1) The company could DEFINITLY fix this problem.
2) The company was informed of this problem prior to the emails being sent out, and did nothing.
3) Our arrested subject in question did not inform the general public, he informed only patrons of said company, who could use this information to protect their privacy by switching ISPs.
But the analogy at the end is very good. Is the integrity of the bank's security impaired by them leaving the front door open, thus allowing armed robers entry, or is it impaired by someone informing *potentialy* armed robbers that they leave their doors open and you can walk in with a gun?
Because this is capitalism.
He was paid by the company to (amongst other things) find out wether or not the site was secure.
He was paid to leave it at that.
He didn't.
Corporations don't care about you, they don't care about people stealing your data. They DO care about employees telling people bad things about the company ("your data can be stolen when it's with us", I'm sure you understand why they'd want to contain this), and they will use the legal system to prevent it.
Big surprise. Now change the law or stop whining.
While I don't agree with what he did, I certainly don't think he did anything illegal. Why isn't the government going after Tornado for exposing their customers to a risk that could breach the confidentiality of their emails?
This is another example of "Security through obscurity". Someone makes a broken piece of code, doesn't want to bother to fix it, and then gets pissed off when someone forces their hand.
If the U.S. eventually passes a law that makes software publishers liable for these flaws, there will probably be a huge backlash from sloppy programmers because it interferes with their Consitutional rights for the "Pursuit of Happiness", since they are stuck at work fixing their unsecure code.
--
Luck is just skill you didn't know you had.
getting punched or kicked in the groin is funny because it works on so many levels. heck, Homer thinks it is funny. i don't really know why pain has become funny to so many people. people watch those amerika'sfunniest home videos, eXtreme crashes, or NASCAR to be entertained by the hoped for electrocution, impalement, or explosion. sometimes the entertainment becomes a reflection of how fouled and stilted the society is today. Mods: yes, please mod this down to flame bait or troll.
a slut did tulsa
If you've got a younger brother or cousin or son who ever happens to spend time locked up, I'm sure you'll laugh your ass off when he gets brutalized.
Really, would you chuckle at the thought of, say, Susan Smith being gang raped?
Sorry for the disjointedness... longest post ever from my Zaurus...
hang brain.
Bret was not prosecuted for revealing a security vulnerability. He was prosecuted for DOS'ing our server. He sent 14,000 emails to our system, and it overloaded and stopped accepting mail. He did this several times, and knew it overloaded the system when he did it, and knew the FBI had been called after the first time, so nobody needs to feel sorry for him. Holding him up as a martyr or hero is just asinine, but it speaks volumes about how our media works these days.
Of course, there's plenty of culpability to go around...the main server was a Sun Enterprise 4500 with 4x450 CPU and 4Gb RAM. A machine like that should swallow 14,000 emails without a trace. Of course, Tornado's brain-dead custom system implementation meant that every single incoming email spawned off an SQL script to take the message apart and inject it into the database, and a shell process to control the SQL script. The system load went over 100. I had to write a script to kill off all the processes. Since the load was so high, sendmail stopped accepting incoming mail and the rest of the spam piled up on the backup server, where it was rm'd. So, it was Bret's fault for spamming us, but it was Tornado's fault for such a painfully bad email processing method. This actually raises the most interesting question of all, is it a crime to knock down a system that was incompetently implemented?
Of course, the email system was not the only part of the system that was breakable...we had system outages several times a week from different causes, and really, the Bret thing was not that bad, being in that it was easily identifiable and fixable.
Another fun thing was that Tornado initially claimed $300,000 in losses from the incident. This is important because the FBI will not get involved with anything under $50,000. This figure was later reduced (much, much later) to $9,000. Oh yeah, what else...Tornado's great email implementation also meant that we had to run an open relay, which was frequently abused. We sent out hundreds of thousands of nigerian bank account emails. A manager who took a stand and turned off the relaying one weekend was demoted and ultimately fired. Basically Tornado was a bunch of Windows developers who couldn't use Windows to implement their custom email/fax/paging application because Windows wouldn't scale to the sizes they needed. So they had to use Unix, and they didn't know anything about Unix, and they made just about all of the predictable errors that the ignorant make.
In conclusion, it's scary that every time this story comes up, there's a different (wrong) angle on it.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!