Slashdot Mirror
Publishing Exploit Code Ruled Illegal In France
Dexter writes "A French Court has condemned the security researcher Guillame Tena for publishing a security vulnerability in the Viguard anti-virus software of Tegam. This ruling makes the publication of security vulnerabilities and their proof of concept through reverse engneering illegal in France."
What about Tegam? They published the exploit in every copy of Viguard. While telling everyone it would protect them. Why aren't they guilty? What kind of crappy lawyer lets their client get punished for telling the truth about dangerous products?
--
make install -not war
I think the general rule of thumb is to inform the software publisher first, and then go public after they've had a chance to fix it. Going public forces the publisher to fix the problem if it hasn't already, and it let's the public know that there's a problem and they should do an update. (Or if the publisher still hasn't fixed the problem, switch to a different program.) According to the article the article links to, the copyright infringement charge is somewhat similar to the anti-DeCSS application of the DMCA. The researcher, AFAICT, is being sued because he *reversed engineered* the program, which is a traditionally accepted practice.
Richard Stallmann has written a text about a future scenario, where owning debuggers is forbidden. It's recomended reading, and at least has showed me why we have to fight for our rights! The Right To Read also carries a informational part, which is non-ficitional, and highly interesting reading. Both parts is here
Assembling etherkillers for fun an profit
If you discovered this exploit then so can someone else. This someone else could then use this exploit to their every desire (Think beyond viruses, i.e. blackmail, stock market, etc.)
What do you do?
Nag the company to fix it?
Tell everyone how horrible the company is without proof?
Release your exploit into the wild to pressure the company in patching it and giving them motivation to pay more attention to security?
Most exploits that are released typically occur after the vendor has been notified.
I'm a virgo and on Slashdot. Coincidence? Yes.
What good is it to publish software vulnerability, especially on closed source products?
A strange question. People who use these closed-source products (aka "the customers") would certainly be interested in knowing the true capabilities (or lack thereof) of the software they bought. People who are thinking about purchasing that software would be interested as well.
The head-in-the-sand technique doesn't work all that well in real life.
If I am running an anti-virus program, I most certainly want to know if that program is a close relative of swiss cheese...
If one really wants to help, isn't it better to inform the software maker? If the latter couldn't care less, maybe one shouldn't care more?
More strange questions... Let's see, there was this car, called Pinto, and its maker (Ford) for a while couldn't have cared less about certain umm... deficiencies in its construction and design. Are you suggesting that the proper response to the manufacturer's saying "I don't care" is replying "Oh, how wonderful, this means all is right in the world then"..?
Kaa
Kaa's Law: In any sufficiently large group of people most are idiots.
If a company doesn't fix a problem that's brought to their attention, published or not, they could be found negligent for damages as a result of that security hole.
Read any good EULAs lately?
It's not offtopic, dumbass. It's orthogonal.
Can you really make a secure system?
Yes.
Security is not a hard problem. It does add to both the cost and complexity of a system though. The problem is most people avoid the issue or try and make some sort of wrapper around there software that makes it secure. Mostly it's people not separating the data that is moving though the system from the system it's self which leads to security problems. When you treat every interaction a system has with the outside world as a hostile transaction you can make vary secure software. But, few people really want to build secure systems, mostly its just get it out the door fast which is why you keep seeing companies with there pants down.
As to your idea that some bugs are to expensive to fix well that's like saying well we made the bridge. It come in early and under budget, granted it would fall down if anyone ever tried to use it but hay that's not our problem. Yes, you can build a system that's not secure at lower cost, but if a bank get's hacked because they where using your software then clearly you did not do your job.
PS: Yea, sorry that came off as a rant it just pisses me off that people accept that there systems can and will be hacked but hey so does everyone else's so it's ok.
Going public forces the publisher to fix the problem if it hasn't already, and it let's the public know that there's a problem and they should do an update.
I agree, going to the author first with an exploit is good etiquette. And that going public afterwards is important, too, after some decent interval that is as short as possible.
Public disclosure gives the software user a tool to test just how vulnerable he is and whether various stopgap measures provide adequate protection against the exploit. Public disclosure is better than just having exclusive disclosure to black hats and vendors, IMHO.
"Provided by the management for your protection."
Since folks moderated this so highly, here's more info:
4 80 6/24806.html
http://www.windowsitpro.com/Article/ArticleID/2
It's one of the conditions of being a "Gold Level" partner.
Of course, this makes one realize how nonsensical the "window of vulnerability" arguments comparing Windows vs. Linux security are. For those of you who don't know, these arguments compare how much time time from announcement of a vulnerability to the time that the patch comes out. The F/OSS community is big into full disclosure, and the MS community isn't, so, the MS Window of vunlerability is almost always smaller, hence leading to claims that it's more secure. That is, until someone finds a bug that's been swept under the rug for a couple years and uses it to make the next Nimda.
Actually, I purposely didn't, because the /. engine coders really piss me off in this regard. Auto detecting a URL and having your submit handle it correctly isn't hard. Why impose that burden on a user? It's just bad design (and I've never heard any rationale justifying it). Most blog and WiKi engines do it this way, why not Slashdot?
If you discovered this exploit then so can someone else.
...
why do you think ~el8, PHC, AcidBitches, and other anti-sec groups want to outlaw exploit code? once we go to a vendor-only or non-disclosure system, blackhats will rule the roost. if exploits are outlawed