Slashdot Mirror
Analysis Of Symantec's Stance On Censorship
robochan writes "According to this report in the Sydney Morning Herald, Chief Operating Officer of Symantec, John Schwarz, was quoted as 'calling for laws to make it a criminal offense to share information and tools online which could be used by malicious hackers and virus writers.' This article takes a look at the negative affects and also a couple of recent examples of "censorship legislation" backed by the COO of Symantec, and what little effect it has had on criminals, while having a substantial affect on responsible citizens."
I believe it is illegal in most states to be in possession of 'burglary tools' such as slim-jims, lock picks, and the like unless you are licensed in some way to own them (mechanic, lock smith, etc...).
When (if ever) do 'hacking tools' fall under this category? Obviously any tool can be used with ill-intent, but are there specific pieces of software that could be classified as such?
As others have noted, what Symantec really wants is to prevent people from cleaning up the worms and viruses without paying Symantec a fee.
But if the number of viruses and worms goes down, I'm sure Symantec would be happy to write a few more to keep their profits up.
He's stating that "Only the information security elite should ever have access to information security issues." Or if Bill Gates stated: "Only large enterprises should write operating system software. Linux should be outlawed." This means we'd all be forced to eat Microsoft's or Symantec's 'dog food'.
I ask you this: When was the last time Symantec wrote a signature for Snort? How about a nessus plugin? They want to get rid of the open source security model because they can't profit from it!
As an information security professional, I don't even listen to Symantec as their information is generally 2-3 weeks too late. Its like waiting for the Sunday paper to read about the double homicide that's taking place right now on your front lawn. All their info is being published after the fact! If they successfully cut off all access to information that is happening in the security community, then they make everyone reactive rather than proactive.
It doesn't matter how much detail Symantec offers about a virus or bug. I want to be able to take an exploit, compile it and run it against a test server on a test network. Capture the packets transmitted and analyze them. I want to dissect the 'worm' or 'virus' and develop an IDS signature as well as produce a Nessus plugin to scan other servers. If I use other tools, I want to have enough knowledge to look into their signature files to realize that they're looking for the wrong stuff and thereby giving false positives (or false negatives).
It's called FULL DISCLOSURE
Symantec is trying to tell us that I can do all this with a really descriptive set of documentation? Or maybe I should just turn my entire enterprise security model over to Symantec. Uh huh, sure... I don't think so. Gimme the code for the exploit.
Allow me to digress for a moment, stick with me though -- it's not too OT...
Lets talk for a moment about the MS03-039 exploit; the brother to MS Blaster. It's a really nasty bugger. Once it exploits a machine, it creates a user account of "e" with a password of "abc#321". Oh yeah, and the new user has admin rights.
This means the worm could use the newly created account to create other accounts, escalate privileges on existing accounts or just change everyone's password to a random string of garbage.
The price we could pay by not patching every single server and workstation this time around could exceed the damage done by blaster by a thousandfold. All it has to do is successfully nail just one Active Directory controller. Imagine if every single user on your entire network had their password changed on them, at the same time.
When blaster hit, it crashed the RPC service which forced the machine to reboot 60 seconds after the RPC service came crashing down. Imagine now that in the infection process changes admin and user passwords, revokes privileges, then reboots the machine... Your network is now down, and you can't even get back in. You are screwed.
So, how do I know this info? Well, it just so happens that I've got the source code to the worm sitting on my machine right now! I'm not contributing to the project, but I'm sure as hell monitoring what is going on, and I sure as hell didn't get ANY of this information from Symantec.
The only info I'll get from Symantec is the day after the worm's release when they announce that blaster.b is in the wild and that I should have patched my boxes, and they're very sorry but there is no cleanup file available if it compromised your AD controller and changed all the admin passwords. Symantec also recommends you have current tape backups. That's like telling the car accident victim to buckle up. Just a little late there, Jack.
We are going to continue down the road of Full Disclosure debate until M$ et al. starts writing secure code.
Good security is based upon reality and common sense. Common sense is a function of having common knowledge.
That's absolutely incorrect.
Freedom of speech is absolute. No exceptions.
Obscenity is not illegal, but you can be held accountable for any harm it may cause others (including mental anguish). The FCC has obscenity guidelines for the public airwaves that TV and Radio stations must follow. The on-air personalities can say whatever they want, and their words are not illegal. The FCC can however mandate that the corporations using the public airwaves do not broadcast obscenities, and that they either bleep them or silence them, at the risk of being fined (stipulations of using the public airwaves for free).
Fighting words are not illegal either, but you could get in trouble if you incite violence, which IS illegal.
Yelling "FIRE!" in a crowded theatre is actually not illegal either, but you will most definitely get in trouble for endangering the public if you do it.
There is a distinction here you have to make.
Words by themselves are not and cannot be illegal, nor can the usage of those words be deemed illegal. The first amendment garantees that.
The results of what happens because you spoke your words of choice, however, CAN be held against you.
If you say in a public place "I wish he were dead" (about anyone) you have the right to do so.
However, if you were to say "Go kill this guy", and someone who heard you went out and did just that because of what you said, then you would absolutely be held accountable for saying it.
Anything you say is legal, regardless of content.
The consequences of what you say is another matter entirely.
Fighting virus writers by banning the words they write is absurd and stupid. It is a slippery slope we do not want to enter. It sets a dangerous precedent that can and will be abused. If you ban one use of language, it's very easy to ban another. Next we'll be banning negative movie reviews because they can hurt the movie's business and thus must be banned. Or perhaps we'll start calling people traitors if they criticize the President. Oh, wait, Ann Coulter already is doing that. But of course she has the right to say that too...
-- This sig for rent.