Slashdot Mirror
Hacker Indicted In France For Publishing Exploits
Guillermito writes "Hello. I'm a French scientist living in Boston. I analyse small security softwares under Windows as a hobby, for fun and curiosity. For example, I showed how to easily extract hidden information from a dozen of steganography softwares, often commercial programs claiming a very high security level. I did the same with a french generic anti-virus, showing several security flaws, and that it didn't stop '100% of known and unknown viruses' as claimed. First the company called me a 'terrorist,' than sued me. I've just been indicted last week in Paris. It seems that it's a general trend in France, and maybe in Europe, these days."
There is no faster way to make enemies than to point out someone's stupidity, and then prove it publicly. But I am on your side. Companies that market security products that aren't are committing fraud, IMO. And I'd rather have you publish the vulnerability than someone else publish the automated exploit.
Fred
"A fool and his freedom are soon parted"
-RMS
If they publicly called you a terroist in writing without sufficient evidence, can't you sue their berets off for libel?
"You know Myra, some people might think you're cute. But me, I think you're one very large baked potato."
Now, if Microsoft is forced to release the windows source because of the EU, does this mean anyone who points out vulnerabilities will get sued too?
Seems like a strange way to thank someone for helping them. It's like beating someone to death with a tire-iron because they told you your tire is flat.
Sure it can be said that publishing an exploit will encourage a hacker to take advantage of said exploit, but by not publishing & letting it remain a secret is no guarantee that someone is not exploiting that same exploit. In fact, I'm willing to bet that some 3v1| H4x0r would eventually find it anyway. But I would rather know that it exists so that I may act, since, in my experience software companies are slow to react and try to hide or downplay flaws.
Security solely by obscurity doesn't work.
On the flip side, if the door to my house was wide open, I wouldn't want anybody yelling hey your door is wide open (to the world) without allowing me to fix it.
IMO it boils down to common sense, and in this case I think that it is a beneficial thing to publish that sort of information. An even better route would be to alert the software makers first, and give them a 'short' time to release a patch. But only a very short time.
ohh ohhh a quotation contest!
.
"Did you really think that we want those laws to be observed? We want them broken.
You'd better get it straight that it's not a bunch of boy scouts you're up against . .
We're after power and we mean it. You fellows were pikers, but we know the real trick,
and you'd better get wise to it. There's no way to rule innocent men. The only power
any government has is the power to crack down on criminals. Well, when there aren't
enough criminals, one makes them. One declares so many things to be a crime that it
becomes impossible for men to live without breaking laws. Who wants a nation of law-abiding
citizens? What's there in that for anyone? But just pass the kind of laws that can
neither be observed nor enforced nor objectively interpreted - and you
create a nation of law-breakers - and then you cash in on guilt. Now that's the system,
Mr. Rearden, and once you understand it, you'll be much easier to deal with."
From "Atlas Shrugged" by Ayn Rand
Mod down people who tell people how to mod in their sigs
-
You joke as if people here do not have that right, but it has already been shown that such free speech is protected here. Not only that, but you can even distribute source code to exploit it.
At one time I would have agreed with you. Having had an encounter with the government over false accusations made against me (not even computer-related), and having seen the results, I have to say that in theory we have freedom of speech, in PRACTICE, the government can quite easily ruin your life over something you say, even if they can't even charge you with anything.Remember, publicity about something you're accused of is all the court of public opinion needs to convict you. Winning at trial (if you're charged) or having things dropped later on aren't enough to undo that. To use what's probably a bad example, remember the OJ trial? He was found not guilty of murder, but exactly how many people do you know who believe that to be the truth? And how many do you know who'd hire him to work for them, even if it was digging ditches?
Finally don't forget that fighting charges against you can bankrupt you. Even if you end up innocent, you may find your life utterly and totally destroyed thanks to this. Frankly our "justice" system has lost all its justice, and innocent into proven guilty has gotten forgotten somewhere along the way.
A few years ago, Serge Humpich discovered a flaw in the French smart-card payment system, and proved that it was possible to get money from an ATM with a false card ; he never earned money with it and just showed journalists he could get money, and gave it back.
Banks sued him, and won: 10 months jails (deferred), about 4000 euros to pay (amends+banks' laywers fee). Technically, he was guilty of "unallowed access to a computer system". Banks have denied that the flaw existed but changed their system ; it didn't prevent many false cards to appear in the following years. Disgusted, Humpich wrote a book ('Le Cerveau Bleu').
Although similar, I hope it won't finish the same way. Guillermito didn't crack any computer, so the Humpich precedent does not apply. The European version of the DMCA is not yet voted in France (it won't last), and copyright infringment claims are stupid. But America does not have the monopoly of technically illiterate judges, and he influence of good lawyers, as was already shown in his case. The "terrorist" accusation should be enough to sue ("diffamation"). Ironically, cryptography and stenography are supposed to be terrorists' tools!
I'd say he should contact "60 millions de consommateurs" and "UFC-Que Choisir", two powerful consumer organizations.
Christophe (Don't hesitate to point out my spelling and grammar mistakes, I want to learn - Thanks).
The NZ government has gone out of their way to try and destroy my life since I publicized the risks associated with home-built cruise missiles.
:-(
I still have my missile (largely due to the fact that a network of friends have stored it safely in such a way that I can honestly say "I have no idea where it is") and had considered taking it on a tour of the country so that people could actually see what I've been talking about.
My lawyer advises me however, that to do so would almost certainly result in a very severe prison term. After all, they've already broken the law in respect to the actions they've taken against me so they've proven that, as far as they're concerned, the ends justifies the means.
He's strongly of the opinion that the government is just itching for an excuse to throw me in jail on some trumped-up terrorism charge because I've become such a thorn in their side.
In this country It's not illegal to build a cruise missile, and it's not even illegal to own one, nor is it illegal to transport one -- but, as a criminal lawyer of long standing he made it quite clear to me that under the new anti-terrorism laws we now live in a police state and that the government can do whatever it wants to who-ever it wants to -- by simply accusing them of terrorist activities.
In the case of my tour, they'd likely accuse me of moving the missile as the precursor to a terrorist action.
It wouldn't matter whether they were able to win such a trumped-up case, because here in NZ (as in the USA), people accused of such things seem to spend inordinately long periods of time in jail just waiting for their case to come to court. We have a guy here who's been in prison for 16 months already and, even though our High Court ruled just the other day that the head of our Security Inteligence Service had shown bias against the guy and has had to resign -- the imprisoned "suspect" is still having to wait at least another 6 months for his day in court.
It makes no difference apparently, that I've always been totally open in my activities and the reasoning behind them, and was planning to have a media contingent on my little tour. I don't recall any *real* terrorists inviting the media along on one of their attacks or offering to share all their information with the government.
I don't know whether I should really angry that governments have used the war against terror to give themselves such draconian powers, or if I should feel sad that the public are allowing them to do this without even a whimper.
I suspect that we will eventually regard these days as a dark period in the world's history -- not because of terrorist activities, but because so many people gave up so many freedoms so easily.
P.T. Barnum was right I'm afraid