Security Researcher Faces Jail For Finding Bugs

An anonymous reader writes "French security researcher Guillaume Tena, who is working at Harvard University, faces 4 months in prison after being sued by Tegam for reverse engineering its Viguard antivirus software and publishing exploit codes for a number of vulnerabilities. According to a ZDNet article, he could also be sued by Tegam for 900,000 euros in damages. More details are available (in french) on Guillaume's website and on the K-OTik's website."

Comments

Here we go

[lordkuri]

And now we have people getting arrested for pointing out someone else's mistake...

When did greed become more important than helping someone?

Re:Here we go

[dirkdidit]

Yes, but rather than pointing that mistake out to the company that produced the software, he pointed the mistake out to the world. I'm sure the company would have taken quite a difference stance on it had he let them know about it first before going public with it.

Re:Here we go

[StikyPad]

Help me [tech4free.com] get an iPod for my 18th birthday!

OKAY!! I can't think of anything I'd rather do. Here's how I'll help...

I'll give you three words: GET A JOB.

Then go out and buy one, and you too can be unique, just like everybody else.

Re:Here we go

[ScentCone]

someone else's mistake

So, there are lots of makers of expensive vaults and safes. Some are better than others. If you deliberately post information on how to break into the good (but not the best) models, are you pointing out mistakes, or providing assistance to those that thrive on such vulnerabilities? I say the latter. It's all about the venue in which you present the info. Sending an e-mail to the maker is one thing, but posting it online, no matter how much of semi-good-intentioned drama queen you are, is reckless or malicious.

Re:Here we go

[dirkdidit]

While I agree that a company should be doing it's own bug testing, there are always going to be certain hardware and software setups that will inevitably cause a problem that the company couldn't have ever imagined.

Sure, there isn't a law saying this guy should have reported the flaws to the company first before going public, but as a software developer, I always appreciate when people bring bugs to my attention and I try to compensate them justly (such as discounts if they are current customers, etc).

Re:Here we go

[cyxs]

And would you like the company that makes your car to get that too if it failed to deploy airbags so that they can figure out the problem and slowly release the update the next time your in an authorized repair center they automaticaly update your onboard computr that deploys airbags?

For all the people that say this is two different worlds its not, both companies have a right to have there products do what they say there going to do. Nobody thinks that there airbag won't deploy when they get into a crash, so why shouldn't your software fail to stop a virus. Companies don't like to have bad press about there product or product line. When someone finds something that is a flaw I do belive that people have the right to know, cause then its not just one person saying, hey fix this. They will get TONS of people calling, emailing and faxing them asking for the fix.

Re:Here we go

[lordkuri]

how in the hell is that a troll? It's an honest question!

fucking moderators on this site need to be kicked in the head

yeah *this post* is a troll, have at it

Re:Here we go

[smokeslikeapoet]

Lets get this straight. Lets say Consumer Reports did a review of 4 safes: Safe A and Safe B can be opened with a fingernail file, Safe C can be opened with a bobby pin. Safe D was inpenatrable with known methods, so buy that one.

Should Consumer Reports, their reporters, or editors be criminaly or finacially liable for posting the exploits? Should they contact the manufacturer and not inform the public? Should they be applauded and rewarded for offering the consumer a service? I'm sure your smart enough to figure out the answer there.

If my antivirus software or firewall isn't secure than I sure as hell want to know about it!!!

Re:Here we go

[Grab]

Here we go indeed.

The guy didn't just "point out someone else's mistake" - he produced and published exploits to allow access into the system. /. analogies are always dodgy, but what he's done is like duplicating someone's front door key a thousand times and standing on a street corner in the local Cracktown handing keys out to everyone who walks past.

You want to point out a mistake, there's plenty of legitimate channels for doing so which don't involve hackers (or crackers, if you prefer the outdated early-80s terminology) ass-raping the system in question.

Grab.

What were his intentions?

[linolium]

This was definitely unfair and uncalled for if his intention was to notify the company of their product's defects, or if he already did but got no response. On the other hand, if he only wanted to hinder the company, he is at fault. But even then, he's got a pretty harsh reprimand.

Does security through harsh penalties work?

[Anonymous Coward]

I would have thought not -- but seeing how easy AAA can get in my car, I think that's how most physical security works.

What's next?

[DamienNightbane]

Will the little Dutch boy be executed for sticking his finger in the dike?

If I break in your car...

[Anonymous Coward]

with the same techniques AAA uses when some mom forgets her keys in the ignition, I'd be arrested.

Most physical security (house locks, car locks, office building locks) is indeed "security through harsh penalties", where the locks are really not much more than an advisory symbol saying "don't do this".

Re:If I break in your car...

[Seumas]

If I break in your car with the same techniques AAA uses when some mom forgets her keys in the ignition, I'd be arrested.

If you bought a car, figured out some ways to break into YOUR OWN CAR, then published those ways to alert other consumers as to the lack of security the car has, should you still be arrested?

Re:If I break in your car...

[barc0001]

He lives in Winnipeg. Car theft capital of Canada right behind Surrey and Regina. It was only a matter of time regardless.

But to address your argument at face value, is it :

a) better to have a hidden flaw that is only known to criminals (which is undoubtedly where the Sun heard about it from) that is built into cars for years to come, providing hundreds of thousands of easy targets...
or
b) expose the flaw to daylight and both force the manufacturer to do something about, and alert all owners of said existing cars to the problem so they can buy additional anti-theft devices.

I mean, come on. If we replace the word "theft" with "car has tendancy to spontaneously explode, killing occupants in a fiery inferno of doom", everyone and their dog would be lining up to lynch any bastard who tried to defend option a.

I don't know about you, but I would always prefer to know well in advance if my car was either easy to steal or about to explode.

Re:If I break in your car...

[Anonymous Coward]

With software, you only own the right to use one instance of it - right to use, not right to do whatever you want.

Copyright stops you from copying. It does not prevent you from looking at the inner workings of something.

A book critic can find fault in the language the author uses. A music critic can find fault in the way an instrument is played. A journalist can find fault in the actions of soldiers. Why can't a software engineer find fault in the software he looks at? Oh, that's right, it's e-magical so we have to come up with entirely new sets of laws and ethics.

Re:If I break in your car...

[kfg]

Just like a radio station can't go buy a cd at a store and then play it over the airways. . .

Yes, they can. In fact, all the independants do. You think they all just get free handouts of everything they want to play, or payola for playing it? Some DJs will even bring stuff from home, especially the jazz freaks. Perfectly legal.

. . .don't get ownership of a car confused with ownership of software.

And don't confuse a copyright license with a license to "use."

KFG

Re:If I break in your car...

[Mercedes308]

Now, which side of this argument do you think he would fall on? The "I shouldn't have bought an insecure car" side Perhaps he should direct his anguish at Dodge instead of the Newspaper. They are the ones who stuffed up the design in the first place.

Re:If I break in your car...

[Chris Burke]

Copyright is what requires you to have the license to broadcast over the radio. You are perfectly free to do anything that copyright doesn't restrict you from doing without any kind of license whatsoever.

Re:If I break in your car...

[optimus2861]

.its a bit hard to reverse-engineer something without it being derivative, is it not?

You just keep digging yourself in deeper, you know. Reverse-engineering is a well-established fair use of copyrighted material under copyright law. IBM PC clones came to market in large part due to Compaq (IIRC) reverse-engineering the IBM BIOS and creating their own implementation of the functionality they observed through that process. IBM couldn't touch them, because the functionality wasn't and can't be protected under copyright law, only IBM's implementation (or "expression" to use the term in copyright law) of that functionality.

Reverse-engineering an anti-virus program and describing the functionality thereof is exactly the same thing. Under the law, 100% legal. Under stupid draconian EULAs that the courts are all too likely to uphold (see Blizzard v. bnetd), you're up shit creek, though. Which is different from what the law is.

Re:If I break in your car...

[dAzED1]

if you're merely just figuring it out, you're not *engineering*. When you then do something like "publishing exploit codes for a number of vulnerabilities" you are creating a FREAKING DERIVATIVE WORK. The expoit itself is the reverse engineering...it is the derivative work. He published it. BOOM. Therein lies the problem with what he did. He didn't just figure out how it works - if that's all he did, then no one would have ever cared. He figured it out, CREATED an EXPLOIT, and PUBLISHED it.

Re:If I break in your car...

[Anonymous Coward]

if you're merely just figuring it out, you're not *engineering*.

*Round of applause*. That's why it's called... wait for it... reverse engineering! Somebody took a design and engineered a product... and then somebody else did the reverse, and figured out the design from the product. *Reverse* *engineering*.

When you then do something like "publishing exploit codes for a number of vulnerabilities" you are creating a FREAKING DERIVATIVE WORK.

You go on and on about this, but you have yet to offer a single reason for believing so. Is this just a particularly unimaginative troll? If not, you have some very odd ideas about copyright.

He figured it out, CREATED an EXPLOIT, and PUBLISHED it.

So? People figured out Windows file sharing, CREATED SAMBA, and PUBLISHED it. People figured out the IBM BIOS, CREATED a CLONE, and PUBLISHED it. People figured out the Office file format, CREATED a CLONE, and PUBLISHED it. Reverse engineering is not only legal, it's widespread.

Re:If I break in your car...

[sjames]

its a perfect example in that you only purchase a license to use it in a prescribed way.

Actually, that's a strongly contested issue in law right now. Some maintain that because the license is hidden away inside the box, it carrys no force and first sale applies. That is, if it looks and feels like you bought it, you DID buy it. If so, you are only restricted by copyright which does allow reverse engineering. Note that this does disallow public performance (such as playing a CD you bought on the radio).

Personally, I maintain that the act of licensing software but making it look like a sale is fraud and should be treated as fraud. Just because a lot of big corporations all routinely commit fraud doesn't mean we are obliged to look the other way.

The fair alternative is to grant everyone the right to do this. That is, If the software can contain a hidden EULA, I have the right to write up MY terms on the back of the check I pay for it with. "By cashing this check, recipiant agrees that this constitutes a first sale, any EULA is null and void, and that recipient has legal authority to enter into this agreement. Recipient further agrees to pay any and all legal expenses arising from blah blah blah". If the company doesn't like MY terms after the fact, they'll just have to contact me and negotiate. Given the way that usually works out when the end user doesn't want to click on accept, I have the moral right to just hang up when they call to disagree.

Since the above is clearly unacceptable, I guess we'll just have to go back to good old copyright, or admit to being a Fascist state.

its a bit hard to reverse-engineer something without it being derivative, is it not?

Not really. Inter-operation is not derivation. Nor is commentary or review.

This would set a terrible precedent (in France...)

[Anonymous Coward]

Reverse Engineering isn't illegal, certainly finding that "Unlike the advertising claimed, this software didn't detect and stop '100 percent of viruses'" isn't illegal, surely it should be lauded.

The company had two options. Take on board the issues and fix them, or get in a hissy fit. They got in a hissy fit. Well done. Instead of responding to issues that software does have in an adult manner, they've just made themselves look petty and bad.

No, but make a film about how Islam treats women

[Anonymous Coward]

And you will be....

Think about the users.

[Schrodinger's Monkey]

If he were just researching the security of the program, then it would be unreasonable for the company to complain. However, he took a security program and published a list of exploits. He puts a lot of innocent users in unsafe positions by doing that. It seems reasonable to sue him, from that perspective.

Re:Think about the users.

[unoengborg]

The users was already in an unsafe position. If you fortget to lock your door, putting on a blindfold that prevents you from seeing the open door, will not protect you from burglary.

If he could find the open door, so could sombody else. But he was kind enough show the open door rather than leaving it open.

I've considered moving to France before...

[theblacksun]

...in my occasional Europe scan. But yea this just killed that idea. I always forget they have a history of computer cases like this.

I absolutely hate this backwards shit. Software engineers and governments and everone just best get used to the fact that people are going to reverse engineer everything they can. Until they get used to it, lawmaking is just going to go overboard, stifling development and competition.

And I believe the proper response to pointing out an error in your system is "Thank You."

Re:I've considered moving to France before...

[theblacksun]

Limiting revese engineering is harmful to society. The PC is only so standard because reverse engineering is legal. Otherwise it would have remained the propertyof IBM and much less accessable.

Beyond that, software is an intangable entity that is very difficulty to track. Discouraging people from breaking into the software they've bought is hard psychologically. What different is this than publishing mods? What's the difference between that and souping up your car and making a website? Software hacks look exactly like a audio/vehicle tweaks to me and a lot of other people. On top of these problems, software is also so easily recreatable as the act has no percieved reprcussions.

Look at the pace of the technology around you. Bits are rapidly becoming cheaper and cheaper. Software providers are going to have to deal with this, as well as the gradual improvement of computer literacy as PCs have spread. Fighting this is like fighting the tide.

Re:He got what he deserved

[furiousgeorge]

SO i guess by your logic, you should be able to sell anything you want, and people shouldn't be allowed to point out bugs or flaws because you might not like it?

Tough Shit.

same difference

[Doc Ruby]

Actually, companies usually don't take any different stance when they're notified of their bugs before public disclosure. But at least that gives them the chance. So when published, the disclosure leaves them no recourse to this diseased retaliation; they are more pressured to fix it instead of making matters worse by killing the messenger. In this case, the messenger (apparently) made matters worse, by disclosing publicly (including bad guys) before giving the company a chance to fix the problem. That is a crucial distinction between his somewhat reckless actions and those of other whistleblowers. Integrity demands reporting to the people who can fix the problem first. Even if they do fix it, the vulnerabilities can be published later, to embarass the company out of doing it again amidst even worse publicity. If they don't fix it quick, of course publishing is an option to force them. Unfortunately, I doubt the "group mind" of our media will make the distinction, and we'll all get polarized over the oversimplification of whether or not disclosure is ever appropriate without permission of the malware copyright holders.

Re:same difference

[grcumb]

"Actually, companies usually don't take any different stance when they're notified of their bugs before public disclosure. But at least that gives them the chance. So when published, the disclosure leaves them no recourse to this diseased retaliation; they are more pressured to fix it instead of making matters worse by killing the messenger. In this case, the messenger (apparently) made matters worse, by disclosing publicly (including bad guys) before giving the company a chance to fix the problem. That is a crucial distinction between his somewhat reckless actions and those of other whistleblowers."

That's a really decent analysis. Thank you for that. The distinction between acting responsibly and acting foolishly is often a little difficult to discern, especially at first glance.

The thing that upsets me, though, is that apparently foolhardiness by the whistle blower carries a penalty of over USD 1 million and potential jail time, whereas the (arguably criminal) negligence of software makers seems to carry no cost at all.

What he should have done

[FusionDragon2099]

was take what he knew about the exploit and write+release a patch for it. Seems a bit more reasonable than giving crackers an extra target to shoot at.

And remember kids!

[Anonymous Coward]

Just because it's law, doesn't mean it's morally correct!

Corporation = Ogre
Law = large club

By this logic...

[earthforce_1]

Ralph Nader should have been sued for publishing information on verifiable safety problems and inaccurate odometers in automobiles. Ditto for the one who first broke the story about a certain brand of tire failing on a certain manufacturers SUVs, causing death and injury.

Re:Bad analogy

[Anonymous Coward]

The analogy also doesn't hold because it isn't like "opening the hood" (though I wonder why you'd open the hood to inspect the brakes, but I digress) and taking a look. It is more like he hooked up wires to the control box and did a packet scan on the computer signals in the computer.

Which should be equally encouraged.

If it becomes illegal for people to figure out how things work, we'll find ourselves living in a society of morons (even more than now).

Re:I wonder what the lucky winner will get...

[Anonymous Coward]

It's "Explorer." You're not clever. HTH.

The French seem stuck in some Napoleonic fugue.

[putko]

They do this all the time. Not having a tradition of Common Law, they fall on the wrong side of this all the time.

Thank God for the First Amendment. For those of you not from the US of A, it guarantees freedom of expression in the most absolute terms. Short of something that incites violence (e.g. "let's kill him") or yelling "fire" in a crowded theater, it is OK. The Pentagon Papers case essentially destroyed "prior restraint" for national secrutiy reasons (as practiced in Britain).

Even countries that are supposedly as free as the USA are actually not. Politically incorrect things like "tribe A is stupider than tribe B" will get you put in jail.

I'm reminded of the theme song from "Team America: World Police". Too rude to print here, it would probably get you put in jail in some countries.

Only America could produce someone like "Ol' Dirty Bastard".

Re:The French seem stuck in some Napoleonic fugue.

[HuguesT]

It is true that you can be sent to court for "incitation to racial hatred" in France. However shouting anything from the mountaintop will not get you charged under this. You would have to be a high-level politician or in charge of a newspaper, and even then that would not be enough to send you to jail, you only get fined.

Maybe you've heard of Jean-Marie Le Pen? He is an openly racist politician to the extreme far right of the French political spectrum. He's been around for decades and in spite of proferring racist insults on TV an in various far right newspaper he has yet to see a single day in jail. He may have been fined a few times though.

Perhaps you are thinking of Maurice Papon, the famous revisionist? Indeed he was sent to jail, but not for his written opinions, instead because of his responsibilities during WWII. He sent a lot of Jewish people to their death.

Furthermore I don't find this self-evident that proferring a racist discourse should be protected under free speech laws. It could be argued that speech is by itself non-violent but this is demonstrably a fallacy. In the US not all speech is protected, such as shouting "fire!" in a theatre. Where do you draw the line?

You miss the point entirely...

[jrl]

The vulnerability advisory is for the protection of the consumer. It is not to punish the software writer.

When it comes to vulnerabilities, it is presumptuous to assume that you are the first to discover the bug. We have discovered countless bugs that we've never disclosed to anyone... partly because of fear of this type of retaliation, but mostly due to apathy to the whole mess we call the security industry.

Whether you inform the vendor first or not is really not consequential. Those who are keeping up to date with information will know about the vulnerability when it becomes public in an advisory and can take their own appropriate actions to defend, even if that means take the resource offline until a patch is made available.

An uninformed person will not only miss the advisory, but will likely miss the patch as well.

Also, don't overlook the fact that the vendor is not in control of the information. Since they are not finding the bugs, they are not going to be able to contain the information. This is especially true when "bad" people find and control the information. When a "good" person, IE someone who is sharing the information freely with the public without direct financial gain, decides to donate their time for your benefit, you should respect them and look favorably upon them.

I don't really care either way, but if I had to choose I'd rather see full and immediate disclosure rather than the find a problem, alert the vendor, and sit there policy that companies are forced to endure.

It turns out people really like to keep their heads buried in the sand. If they don't know about a problem, maybe it doesn't exist? Darn .. what happened to our customer database... what does "Hacked by Chinese" mean exactly?!?!?!?

Re:FYI

[tetromino]

Are you implying that we shouldn't care about the freedom of software researchers in other countries?

Violating the DMCA gets you jailed in the US, disassembling a binary gets you jail time in France, posting the results on a blog gets you in trouble in Iran... Is there a single country in the world where one can do security research without being accosted by the Man?

Re:Bad analogy

[mostlyalmighty]

There shouldn't be anything wrong with scanning the computer signals in YOUR car. It is belongs to YOU. Proprietary software may be a different story though with its nasty EULAs and things.

Hacked by Chinese!

[jrl]

The vulnerability advisory is for the protection of the consumer. It is not to punish the software writer.

When it comes to vulnerabilities, it is presumptuous to assume that you are the first to discover the bug. We have discovered countless bugs that we've never disclosed to anyone... partly because of fear of this type of retaliation, but mostly due to apathy to the whole mess we call the security industry.

Whether you inform the vendor first or not is really not consequential. Those who are keeping up to date with information will know about the vulnerability when it becomes public in an advisory and can take their own appropriate actions to defend, even if that means take the resource offline until a patch is made available.

An uninformed person will not only miss the advisory, but will likely miss the patch as well.

Also, don't overlook the fact that the vendor is not in control of the information. Since they are not finding the bugs, they are not going to be able to contain the information. This is especially true when "bad" people find and control the information. When a "good" person, IE someone who is sharing the information freely with the public without direct financial gain, decides to donate their time for your benefit, you should respect them and look favorably upon them.

I don't really care either way, but if I had to choose I'd rather see full and immediate disclosure rather than the find a problem, alert the vendor, and sit there policy that companies are forced to endure.

It turns out people really like to keep their heads buried in the sand. If they don't know about a problem, maybe it doesn't exist? Darn .. what happened to our customer database... what does "Hacked by Chinese" mean exactly?!?!?!?

Re:Bad analogy

[techno-vampire]

The analogy also doesn't hold because it isn't like "opening the hood" (though I wonder why you'd open the hood to inspect the brakes, but I digress) and taking a look.

The master cylider for the brake system is under the hood. If you needed to check that, or the level of brake fluid, you'd need to open the hood.

Re:"Researcher" = hacker

[Anonymous Coward]

Yes, the same rule of law that enslaved certian segments of our population for a time and the same law that keeps people from ingesting chemicals into their body for the "greater good".

Just because its a law doesn't make it just.

Re:Bad analogy

[endx7]

Well, you see, with a physical object like a car, minor variances in materials and manufacturing can lead to random defects showing up in any specific vehicle.

It is also possible for a certain defect to occur in every single car of that model.

You mention manufacturing flaws. In the case we have here it is a design flaw, which is just as applicable in cars as it is in software.

Re:This would set a terrible precedent (in France.

[cornjones]

they've just made themselves look petty and bad

They make themselves look like idiots but they make this guys life hell while they are doing it. The sad part is, it may not effect their business (lusers won't know about this) but the cost of a this lawsuit will haunt him for a long time.

not to mention the chilling precedent. I especially like this quote "If independent researchers are not allowed to freely publish their findings about security software then users will be only have "marketing press releases" to assess the quality of the software. "Unfortunately, it seems that we are heading this way in France and maybe in Europe,"

suppose it was a defective car.

[tallbill]

Suppose he discovered a defect in a car or some other piece of physical hardware. If that defect were severe enough to kill someone and he did not publish his knowledge of the defect, then could he then be held criminally liable and be accused of negligent homocide? Surely the right thing would be to publish the defect and warn the users of the product.

How did software companies get all of these special rules for them if stuff that doesn't work.? If it were a tire or a car or a bridge or a robot, they could never get away with it. But if software doesn't work we are all supposed to just buy the upgrade.

The damage is done, and company's own fault

[Alwin Henseler]

If the software maker presses this upon the researcher, the customers need to press the software maker.

And my guess is, that's exactly what will happen. The company made a mistake by producing flawed software. The researcher didn't make that mistake, only pointed it out.

With these flaw(s) pointed out, the company didn't handle it in a grown-up manner. Instead of fixing the mistake, focusses on attacking the messenger. Dumb: mistake #2, again made by the company. And only makes the problem worse.

So customers may drop the product because it's flawed, stay away from the product/company because it's gaining a bad reputation, and because they dislike the company's response to the issue. Either way, all losses are caused by the company's actions, not by the researcher.

Regardless of the outcome, any company that handles software quality in this manner deserves to be dropped like a brick. Let's hope the (financial) fall-out for this company will be big.

Re:Look dammit

[Spy der Mann]

I don't know why I should be wasting my time correcting AC's in here. Still, here's a good phrase and my personal interpretation:

SECURITY THRU OBSCURITY IS NO SECURITY AT ALL.

Maybe you won't see people shouting bugs on the streets. But the hackers are there, posting the exploits in underground networks. Away from the police forces.

With public exploits, at least you can see the enemy (the security hole). With "unpublished" exploits, the enemy will strike you from behind.

Is this what you REALLY want?

The point, entirely.

[Doc Ruby]

No, we are each addressing an opposing viewpoint on "the point". I believe the consumer is better served by informing the developer first (in cases like this, closed source), because they have a significant advantage in fixing the software. After a short time (maybe a day, maybe an hour, maybe a week, depending on the nature of the bug), if the developer has not convincingly responded that they'll fix it quickly, it's time to go public anyway. After a similarly short time from disclosure without a fix, it is appropriate to go public anyway. And it's almost always appropriate to go public after a fix is released, as pressure is applied to the consumers who, without upgrading, often pose a risk to others just by running the unpatched software.

The "point" is that there are several timers ticking down simultaneously, all starting simultaneously before a known person finds the bug. One timer is the time the bug is undisclosed (though posibly known to an unknown "bad guy"), which determines how long the developer might get away with lazily leaving it unpatched, as well as how long the bad guy can exploit it, which does govern the entire scenario. But since switching apps (or another drastic workaround) is often expensive or risky itself, the most appropriate mitigation is publication of a patch. The problem with public disclosure is that it usually increases the risk from unknown (though possibly large enough) to nearly certain that someone can exploit it. So the timers on a "swift response" count down time from private disclosure to a deadline for at least assurance that the bug will be fixed. If that timer runs out, or either it, or the timer on a patch release, is still ticking when the governing timer, how long has at least one person (and therefore possibly an unknown bad guy) been in a position to exploit it, runs out, then it's time to pull the fire alarm and get everyone to abandon the building, releasing the fire extinguishers all over the office equipment.

The disclosure calculus is very complex. Risk factors need not include actually guessing whether a bad guy can exploit it (which ought to be assumed). They are complex enough just considering the time to fix, and the intervening time to accept the need for a fix, and the relative risks of the other mitigations than waiting for a fix. Just announcing publicly reduces that complexity to pure, irrevocable simplicity, while often increasing the risk: lots of bad guys can now exploit before any fix is possible, while workarounds bring their own risks and costs. Tanga, the whistleblower in this story, is a security researcher; consensus in that community is to evaluate that complex calculus, usually favoring a chance for the developer to issue a fix. Which, in reality, is often already just trapped somewhere in a bureaucratic release pipeline, so could be delivered faster than even the switchover time after solely public disclosure, after which risks and losses are already guaranteed, even if the fix is quickly released.

Re:He got what he deserved

[Theatetus]

Nope, that won't work. Vulnerability disclosures must include a working exploit; otherwise I could anonymously destroy my competitors by posting false but hysterical vulnerability reports about their products.

As I said in another post: software companies don't give us their software for free; similarly, we shouldn't give them consulting services for free. If I find a vulnerability, I don't owe the software company anything and I'm under no particular obligation to tell them before I tell anyone else.

Or are you saying it is irresponsible / immoral / illegal to state a provable fact about the security of a software system?

Re:The devil is in the details

[Pofy]

>Yes, but the kinds of things that make contracts
>void are very few indeed.

How about someone forcing you to agree to it so that you can use something you bought? Imagine next time you buy a TV, get how, and then find a piece of paper stuck on top of were to plug the antenna in. It says that by removing the piece of paper you agree that the TV is not yours, that they can come and pick it back whenever they want, and that they WILL do it if you watch channels that are not theirs or try to figure out how it works in any way and so on...

Time to stop.

[killjoe]

It's high time people stopped informing companies about security holes. It's perfectly OK to let the coders of open source projects know about security holes because they are not going to sue you. If you find a hole in a commercial product just announce it anonymously on the usenet and let it go.

not exploits, exploit CODE

[dirk]

The main thing here is that he didn't point out bugs in software, he published code that would take advantage of these bugs. For all the people making the car comparison, he didn't notice a problem that would let you unlock a car without the key, he made something that would take advantage of the problem and let you unlock any car without the key. There's a big difference between publishing bugs you find, and actually publishing code that will take advantage of the bug. Even example exploit code serves as a blueprint for any person who wants to modify it to do something worse with it.

I have no problem with saying there is a bug in software and giving information about it. I do have a problem with someone releasing code that take advantage of said bug.

In theory.

[Chris Burke]

Actually, companies usually don't take any different stance when they're notified of their bugs before public disclosure. But at least that gives them the chance.

The chance to what? Sue or threaten to sue the researcher and get a gag order placed on them before they're able to warn the users of the software, preventing the vulnerability from ever being seen?

I agree that notifying the company first is the responsible thing to do, but only if the company is going to be responsible which fewer and fewer are showing the capacity for. It isn't clear to me how this situation would have been different for Tena if he had first told Tegam about the exploit, they told him to be quiet about it and did nothing themselves, then he published. Maybe we would think him more diligent and responsible... or maybe we wouldn't have heard about him -- or the flaws he discovered -- at all.