Slashdot Mirror
Publishing Exploit Code Ruled Illegal In France
Dexter writes "A French Court has condemned the security researcher Guillame Tena for publishing a security vulnerability in the Viguard anti-virus software of Tegam. This ruling makes the publication of security vulnerabilities and their proof of concept through reverse engneering illegal in France."
What good is it to publish software vulnerability, especially on closed source products?
If one really wants to help, isn't it better to inform the software maker? If the latter couldn't care less, maybe one shouldn't care more?
However, as the friendly article pointed out, the fine was for a copyright infringement charge, so it looks like you can still publish a vulnerability as long as it is subtle enough.
Rock that crushes, Paper & Scissors that don't matter.
You may notice the article has no details.
I did a Google News Search and found this one which is much better.
Also, the guys own website.
Hope this helps.
- Jax
The condemned seems to think differently.
"That the fine is suspended means that Guillermito will have to pay up if he continues to publish about the vulnerability and other software vulnerabilities. As a result he has taken the Tegam publication, and a dozen others, from his website."
WOW, you are a retard to miss that.
the part you mentioned was in regards to DIFFERENT legal proceedings.
good lord you suck enermous balls for missing that stuff.
Yeah, and timothy seems to be especially biased. So, folks! Let's remove timothy from our front page. (look under authors, and remove the mark in front of the one you don't like...)
Assembling etherkillers for fun an profit
I did read the article and the link in it to a previous article. The previous article stated that his exploit code was judged to be an illegal copy of Teagam's (or whatever their name is) code. I'm not sure exactly where you are getting the idea that his antivirus copy was not legitimate, but this conclusion does not seem to be supported by the articles.
There are top notch security experts in France, specifically the folks at K-Otik http://www.k-otik.com/
I'm a security consultant and I look to these folks as a source of reputable information. I spent a LOT of time on their site when Microsoft was trying to deal with the fallout of the MSO3-026 vulnerability which begat the MSBlaster worm. I even got the source code for blaster from the K-Otik crew.
This is going to have huge ramifications if it is interpreted as described here.
Good security is based upon reality and common sense. Common sense is a function of having common knowledge.
A cognate. "Condamné" means convicted/punished in French, it doesn't have the same connotation in English.
--- Jump!! Fire!! Bullet time!! - Lego version of the Matrix
Please, read the articles before commenting. As usual on Slashdot, the news is misleading : he was not condemned for releasing exploit code, but simply for software piracy (the antivirus copy he had used was not legitimate).
After reading the article I see no information there about software piracy.
Following the links I did find some interesting tidbits that would indicate the company in question is less than honorable:
A factual issue, not part of the trial but seemingly of Tegam's scare tactics, is that Guillermito was accused publicly by the software company to be a "terrorist wanted by the DST (French secret service) and the FBI". This has not lead him to recluse in fear, but he is hardly optimistic of the outcome, scheduled for March this year...
It seems he was being procecuted for violating a European Directive which prohibits tampering with copyright protection measures. Ergo, that this researcher had to by-pass copyright-protection measures to find the flaws in their product.
Do not spread "09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0" over the internet, thank you.
It would be nice if somebody could point to the detailed condamnation and the motivations.
For all I've been able to (quickly) find, he has been condemned for intellectual property, namely counterfeiting.
One possibility is that it's becausehe has published source code, which looks strange because it would be probably be the fair use (short citation for eduction).
But it's probably because he pirated Tegam's software and didn't buy it.
You can also read on this lawyer blog that
"Il ne faut pas interpréter cette décision comme une condamnation du (EDIT : full disclosure), à mon sens : la même chose faite sur un programme licite ne tomberait probablement pas sous le coup de la loi."
So that it is NOT condemning full disclosure and that such publiction made on a legal software wouldn't be sanctionned.
At the moment, it really looks like some people are screaming as loud as possible about that, but until the details are know that just PR operations from Guillermito and the others.
#include "coucou.h"
Yes, the French continue to be well-known for always willing to make a profit, regardless of consequences.
One little short frenchie with a bad attitude almost conquered the entire world, twice.
Europe != World
developed the most heavily armored and gunned tanks during the early German Blitz, one French Char B1-Bis held up an entire German Division for an entire day.
Sadly, it appears that the next day, they surrendered. We'll skip over the Marshall Plan at the end of said war while we're at it.
They've developed nuclear weapons
First? Second? Third world countries have developed nuclear weapons. BFD.
Euro continues to dominate the American Dollar
You might want to look back a little further in historical performance of USD vs EUR.
They were one of the first modern countries to pick on the buzzword "Democracy" long before a bunch of colonists got pissed at their King's latest tax law.
Hmm Declaration of Independence: 1776. French Revolution: 1789.
You Sir, are an uneducated bigot
Glass houses.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
Tegam refutes his claims...
and
Tegam is adamant that Tena's claims are false and his motives are questionable.
BTW, was it already illegal in France to do what he did? If so, then the people should get the laws changed, not trash the judeges and judicial system for doing their jobs by upholding them...
The benefit is simple: exploit code is proof that the vulnerability is real. Without proof, it's all just an unsubstantiated claim, and there's no way to know if you are in danger or not. Another benefit is that the exploit code allows anyone to verify that a supposed patch really fixes the problem.
I found this one quite interesting:. php?num=88
http://www.viguard.com/en/news_view
Have no idea about the truth, though.
As some linked texts say, it seams like he was accused because he did the work on a pirated/cracked version ; he did not buy the software.
Then I conclude it is more carful to buy the license before publishing security flaws, and then everything is ok. But a question arises : is it possible that a license states that the license holder is forbidden to publish security flaws about the software ? If so, then we are really stuck.
Guillame Tena was condemned because he worked on an illegal copy of the Viguard anti-virus software of Tegam. This news was a bit too quickly published... arg! Slashdot is more and more like a tabloid newspaper... sad.
at http://www.viguard.com/en/news_view.php?num=88 which is viguard's side of the story. They quote a ZDNET story where Guilermito is a virus writer and then go step by step to reply to his accusations
Not to slap the French in the face, but before Vietnam, there was a little battle called Dien Bien Phuh... Don't quote me on the spelling, I don't care if its right...
The French allowed the Vietnamese to encircle them in a valley, and shoot mortar fire down into the camp, thus routing the French out of Vietnam before we ever got there...
At least we stuck around and fought them...
All these people are foaming at the mouth about some great injustice, when it's not even clear what is the situation. The original article is somebody's blog, which quotes and links to the website of the accused. I think there may be more to this story.
u illaume_tena_cond/ (in French)
This article, for instance, paints a different picture: http://www.weblmi.com/sections/articles/2005/03/g
Allow me to provide a rough translation of one of the more interesting paragraphs: This judgement focuses not on the core issue, but rather on the methods "Guillermito" used to produce his findings, therefore the tribunal is punishing "Guillermito" for having used a pirated copy of Viguard Anti-Virus to discover it's vulnerabilities. Therefore the judgement seems not to question the right to publically criticise/publish exploits with supporting evidence, but rather that the exploit cannot be researched and discovered illegally [by using pirated software].
To re-analyze some of the analogies already put forth, should the courts go easy on someone who finds a problem with a particular brand of car that could cause it to explode; if they first stole the car and then studied it?