Immunizing the Internet

jonny4001 writes "The Harvard Law Review has published a student-written article that argues that hackers, worms, and viruses are good for network security and that the law and public policy should encourage 'beneficial' hacking. From the article: 'Exploitation of security holes prompts users and vendors to close those holes, vendors to emphasize security in system development, and users to adopt improved security practices. This constant strengthening of security reduces the likelihood of a catastrophic attack -- one that would threaten national or even global security [...] Current federal law, however, does not properly value such strategic goals.'"

Comments

Finally!

[Anonymous Coward]

Totally telling the FBI slashdot said it was 'ok'.

Re:Finally!

[Crayon Kid]

Except it's not ok. Glorifying "hacking" (used loosely) makes it look cool and omnipresent and makes it accepted at some level. Stupid young kids see it as a desirable activity.

And claiming that a certain amount of malware going around helps security measures stay alert is silly. The analogy with living organisms and biological malware is way off. Computer malware doesn't thrive in the wild, mutating randomly. It is powered by misguided humans and by misguided blacklisting approaches to security.

Perpetuating the status quo only perpetuates those misconceptions. It doesn't prevent anything in particular. The reason nothing really big has hit .gov sites is not because they were "immunized" by constant exposure to a certain amount of malware. That's just stupid. They aren't usually hit because (a) they usually employ good security, in all its forms, and (b) because there's hasn't been a REALLY bad piece of malware to hit the fan just yet.

Some day somebody will write a worm that will finally do something really distructive, like spread for a year undetected and then format 75% of the world's HDD's on the same day. Then we'll actually see if real security and chastizing wannabe hackers would've perhaps been better than stupid theories, except it will be too late.

Re:Finally!

[Guuge]

They aren't usually hit because (a) they usually employ good security, in all its forms, and (b) because there's hasn't been a REALLY bad piece of malware to hit the fan just yet.

The article argues that good security practices are a result of finding vulnerabilities ("hacking") and a really catastrophic worm would be far more dangerous in the absence of smaller attacks. Claiming that the solution is "real security" flagrantly begs the question.

Re:Finally!

[MacJedi]

Computer malware doesn't thrive in the wild, mutating randomly.

Yet...

Re:Finally!

[Odin_Tiger]

Some day somebody will write a worm that will finally do something really distructive, like spread for a year undetected and then format 75% of the world's HDD's on the same day.

And the day after that, somebody will point out that MS was alerted to the issue 18mo ago, but they swept it under the rug as a low-risk DoS.

Then we'll actually see if real security and chastizing wannabe hackers would've perhaps been better than stupid theories, except it will be too late.

Either that, or there will be a few big companies that won't be affected, even though they should've been. When we investigate to find out why, we'll find out that they all used the same independent security anaylyst on contract. Turns out, they knew about the problem, but instead of reporting it, they just started quietly patching client systems with unofficial patches, because they were afraid that if they reported it, they'd have feds in SWAT gear busting into their house.

Re:Finally!

[Anonymous Coward]

they give bad reputations to whoever makes them
-- mark washburn

Re:Finally!

[RockDoctor]

Computer malware doesn't thrive in the wild, mutating randomly.
Yet!

There's enough work going on with genetic algorithms as ways of learning how to control systems that a computer "bacterium" (as opposed to a "virus") is becoming increasingly credible. Such an organism would be a very interesting piece of code in itself, regardless of it's potential for nefarious uses. Whether such an organism could only survive in a homogenous environment (vaguely analogous to the stereospecificity of all complex metabolic chemicals in the Earth's biosphere), or whether organisms could develop that can adapt to function in different environments is a very interesting question. But by analogy with the many modern groups of organisms that feature alternation of generations between widely different environments, a need for different environments is not incredible. Read into that a [L|U][i|]n[u|i]x | Windoze debate if you want, but it could equally be a debate between TCP/IP and IPX network "thin organic soups" (to mis-quote Darwin) if both environments included the equivalents of metabolites and energy flows.

Wow! Who knew?

[Heavyporker]

Darwin operates perfectly online! Now all we need is to set up the digital version of the Darwin Awards. Now, granted, idiot users aren't permanently removed from the gene pools, but if they ram enough computers into the dirt, they'll be dirt-poor and thus unsuitable as mates, hence they won't reproduce. Right?

Re:Wow! Who knew?

[Tatarize]

It turns out while your a child, you will turn out better if you touch everything and pick your nose and eat your buggers.

In general being exposed to a lot of germs (typically harmless) trains up your immune system. buggers catch a lot of local bacteria and allows for exposure in a safe and weakened form.

-- Just because it's correct. Doesn't make you want to do it.

Re:Wow! Who knew?

[Joebert]

hence they won't reproduce

Don't bet on it.

Re:Wow! Who knew?

[nacturation]

It turns out while your a child, you will turn out better if you touch everything and pick your nose and eat your buggers.

While it may be safe to eat those who bug you, you may instead try eating your boogers.

Re:Wow! Who knew?

[ndg123]

Buggers ? I thought the term was boogers (USA) or bogies (UK). Buggers has a ahref=http://dictionary.reference.com/browse/bugge rsrel=url2html-19225http://dictionary.reference.co m/browse/buggers> somewhat different meaning where I come from. Apologies in advance if I'm just not familiar with your local dialect. Mind you, much of your post may still be true.

Re:Wow! Who knew?

[Mark Hood]

Yeah, but you just try going around sneezing on babies....

Mark

Re:Wow! Who knew?

[dnoyeb]

Heh, try saying that in England.

To the point, children may be stronger for this, but its increasingly a problem for adults having petri dishes running around.

Re:Wow! Who knew?

[JonathanR]

You only eat buggers in Germany

Re:Wow! Who knew?

[Ohreally_factor]

I was under the impression that buggers was a verb, implying that it was healthful for a child to perform oral sex on a person who performs anal sex on him or her. Unless the poster meant burgers. Who knew that eating fast food could be healthy?

Re:Wow! Who knew?

[Tatarize]

HAHAHA YOU MEANT TO SAY BOOGER!

if you can't beat them... join them.

The well is poisoned.

[argent]

More than a quarter of a century ago I inadvertently found a hole in a UNIX based bulletin board system, went in and fixed the code, called the operator to tell him what I'd done and how to fix the rest of the problems, and ended up with a series of contracts.

A few years later I wouldn't have considered it. People who'd not done much more had spent time in court and been threatened with jail. Not much later, you had people actually doing jail time for simply "knocking on doors".

What happened?

The whole "ethical intruder" meme had spread, and people had started cracking into systems and then claiming they were just "rattling doorknobs" to "help security". Of course you couldn't tell an "ethical hacker" from a crook, and the crooks could claim they were just trying to help.

It's the "ethical hackers" themselves that have made it impossible for this kind of activity to be condoned.

Re:The well is poisoned.

[Xugumad]

I think also, as systems stop being maintained by one person, and are covered by a group, it has become a lot less easy to simply go "Ah, they meant well, I'll just ignore it". Instead, the entire group has to come to a decision, and no-one wants to be seen as lazy at maintaining security.

I've seen a student here report a security hole (the muppet that originally developed the web app they were using tracked currently logged in user by putting their username in the CGI parameters. Change the name, and you can be whoever you want), and some members of staff still wanted to seem the kicked out (we did manage to talk some sense into them, though). Point is, if it had just gone to the person maintaining the system at the time (me), I'd have patched up the code, thanked them, and forgotten about it.

Re:The well is poisoned.

[vistic]

I'll have you know that Dr. Bunsen Honeydew is a very good coder!

Re:The well is poisoned.

[jaclu]

One problem is accountabilitty,

While I do agree with you, that a kid reporting an error and perhaps even a sugested solution, would be regarded as helpful and something of a "white-hat" on a private perspective

However one thing that has changed since the early eighties is that now there is usually quite a bit more money involved.

Now accountability is a big concern.

If that kid was into a system I admin, I must realize that even if he propably just is helpful, I still cant be sure, after all he was in there, where he shouldnt have been, who knows what he did and discover but not tell me about.

And thats what its all about, ne one side I have a complete stranger who claims that he has been in one of my systems, found a few bugs, and have a few suggestions, one the other side is that the only way to be sure of system integrity is to asume that the system is completely penetraded, and do a very expensive security checkup, to see how much damage that _could_ have occured.

If I trust the kid, and he happens to be a black-hat - poof - there goes my job

If he turns out to be a white-hat, well in that case he was nice and not much won for either me or my clients (since we have to do an expensive audit anyhow)

So I would asume he was a black-hat, cause if he wasnt, I havent lost much... Maybe synical, but thats how it works. /Jacob Lundqvist

Re:The well is poisoned.

[Dagmar d'Surreal]

What? Are you trolling or just high? Your premises don't just fail to support your conclusion-- they would appear to support the exact opposite conclusion. You've distinguished "ethical hackers" as being separate from crooks, and then blamed the "ethical hackers" for the problem.

It's crooks who are the problem, but more commonly it just appears to be lawyers who are the major part of it, since they so often find themselves "forced" to do due-diligence and attempt to prosecute every little thing that comes along, catching the ethical hackers (who obviously aren't trying very hard to avoid being noticed, since they're not up to much, and who usually step forward and give them the information needed to send them to court thinking some sanity will prevail) and going full-tilt on them to make up for staff being utterly unable to cope with the actual criminals.

Re:The well is poisoned.

[Dagmar d'Surreal]

Doing an expensive audit after an intrusion is the cost of not having enough security in the first place. If you got hacked, you got hacked. It's true that it doesn't matter whether or not anything else was done with respect to the follow-up audit.

Having someone come forward and say "you've got a rather specific problem that needs fixing and here's a way to maybe fix it" and then going and doing your damnedest to ruin their career and/or put that person in jail is simply needlessly shooting the messenger.

Having someone break into your network and steal all your company's secrets and go sell them to a competitor without you knowing about it is called "a complete @#$@% disaster" and is usually the end of your company.

Generally, I would want the first group to get to my company before the second group does, since there's a chance my job would actually remain afterwards.

Re:The well is poisoned.

[jaclu]

Maybe I was unclear, I didnt mention it in the post but I work in Sweden, and here we dont have the same tradition of suing people. Not because we are nice guys, more because the fines here are not very high, so going to court is not normally a way to turn a profit. You would more propably sue somebody if you wanted to taint there records if (you belive) they really are crocked, but only if you have a reasonably good case. Here the loser pays all legal expences, and also a corp losing to the "little guy" is very bad PR in the media.

What I ment was that if I did experience an helpful intruder, I woudlnt go after him per se, but would focus very much on asuming a total penetration and work on making sure nobody else gets in and that I have som dammage control.

If he seems like a reasonable person, and he checks out OK, I might even bring him on the team, but my gut reaction would be to distrust him until proven otherwise. /JacobL

Re:The well is poisoned.

[brother_b]

Yeah, Dr. Bunsen Honeydew might be a good coder, but the application was coded by Beaker.

Re:The well is poisoned.

[humungusfungus]

way to be sure of system integrity is to asume that the system is completely penetraded, and do a very expensive security checkup, to see how much damage that _could_ have occured.

Which, arguably, you should have done in the first place.

Re:The well is poisoned.

[Anonymous Coward]

Every other line was just "me me mememe me me memmem eme meme meme me meme meme e" and it was constantly breaking things.

Re:The well is poisoned.

[Billosaur]

The whole "ethical intruder" meme had spread, and people had started cracking into systems and then claiming they were just "rattling doorknobs" to "help security". Of course you couldn't tell an "ethical hacker" from a crook, and the crooks could claim they were just trying to help.

That's like a jewel thief or bank robber claiming they were "just trying to help out" when relieving a bank or jewelry store of its goods. Breaking and entering is breaking and entering -- if you do not belong in a place and you enter that place without authorization, you're breaking the law. Come up with any justification you like.

It's the "ethical hackers" themselves that have made it impossible for this kind of activity to be condoned.

"Ethical hacker" is an oxymoron; a hacker is trying to break into something they are not supposed to, namely the security of a computer system. Entering a system you do not have authorization to be in is the computer equivalent of breaking and entering -- it's a crime. If "hackers" want to be part of making of the solution to security concerns, then let them form security companies and have other concered companies contract their services. Don't try to get me to buy the "helping out" garbage.

Re:The well is poisoned.

[dave_mcmillen]

... [On] one side I have a complete stranger who claims that he has been in one of my systems, found a few bugs, and have a few suggestions, one the other side is that the only way to be sure of system integrity is to asume that the system is completely penetra[t]ed...

Yeah, it's like what von Clausewitz said about war: "You plan for what the enemy can do, not what he will do."

When somebody can corrupt your whole system, the only secure way to proceed is to assume they already have.

Re:The well is poisoned.

[Anonymous Coward]

That's like a jewel thief or bank robber claiming they were "just trying to help out" when relieving a bank or jewelry store of its goods. Breaking and entering is breaking and entering -- if you do not belong in a place and you enter that place without authorization, you're breaking the law.

In that case, using your metaphor, what happens to the person who walks by the jewelry store and calls the owner (or the authorities) to inform them that the door has been left open. In a real jewelry store, the owner will probably be very grateful that he was informed of this mistake. And even if he finds out some things were stolen you wouldn't be a major suspect. Why, becuase criminals aren't usually very helpful to those they've stolen from.

If you do exactly the same thing on the internet however, everyone immediately assumes the worst. The question a company which uses it's website to store sensitive information should ask itself is; If a well meaning person notices a flaw in passing (not becuase they are trying to crack it but becuase it was an extremely obvious, like the one in the GP), do they want that person to come forward and inform them of it, or should that person hide and ignore it so that he isn't considered a criminal and wait until an actual criminal comes along and uses the same vulnerability to steal billions from them?

(Shucks I've forgotten my password)

Re:The well is poisoned.

[GPLDAN]

Beaker, however, can't bounds check his code worth a damn so he only writes in Java.

Re:The well is poisoned.

[abb3w]

I found a similar bug with one of the early PC-based email apps used where I went to college in the 90's, allowing anyone who looked at how the thing worked (IE: read the batch file used to launch the program) to determine the password associated for any username. BAD design.

Of course, given the nature of the problem and the state of local security at the time, reporting the problem was easy. Working in one of the less-used open labs on sucessive Sundays around 3AM (when it was almost always deserted), I sent three messages, each detailing the hole, stating the message was sent as a demonstration, and suggesting both short-term and long-term fixes for the problem. The first was to the Postmaster account, from the username of the person behind Postmaster. The second went to all the IT subdepartment heads, everyone in the IT "Security" sub-department, the head of the Computer Engineering department, and the school's head — again, from the Postmaster. For the third, I added the rest of the CE department faculty, all of the full-time IT employees I could identify from the school phonebook, all of the academic department heads, and the faculty senate representatives. The fourth message would have added the mail list for the part time student computer lab monitors and the all the CE grad students... however, that hole had been closed. =)

I heard from a lab monitor in my dorm that all of the lab monitors and CE students were questioned about any involvement, for the powers that be were Not Happy. Fortunately for me, I was majoring in Mechanical Engineering at the time, and they did not elect to sweep that broadly. The people who ran the IT department were at least smart enough to learn from the experience; barely a month later, a school wide announcement went out, announcing that any problems discovered with security for any of the computer systems or labs should be reported to Security@, but that students should PLEASE not deliberately go poking around trying to find holes.

Security has tightened up considerably in the years since.

Re:The well is poisoned.

[Anonymous Coward]

The problem is, how do you tell group 1 apart from group 2, and what if you have group 3 break into your network?

Group 3 - Break in, steal all data, and then email you how to fix your problem.

Eitherway, nail the messager to the wall. It's like someone breaking into your house and than when you come back home, they tell you that you left your upstairs window open. I doubt you would thank the guy and not assume if he did anything else. Admins should be paranoid.

Re:The well is poisoned.

[gnuLNX]

Not sure how that was modded imformative. It's illegal to break into computer systems. What's so hard with that? You can't break into someone's house and then show up the next day and show them how you did it? Also it's hard to really imagine the person having much of a career to ruin....remember they are hacking computers?

Look I grew up playing war games and such with others as well, but once you cross the line and hit a system that isn't yours then I suggest you keep your mouth shut about it. It's illegal and it should be....now if the person is sharing a drive or something totally stupid then shame on them.

PDF WARNING!

[Maelwryth]

The link is directly to a .pdf file. This should link to the Google html cache.

Re:PDF WARNING!

[Joebert]

Good [wo]man !

Re:PDF WARNING!

[Maelwryth]

I thank you for your $20...doh! Damn you Anonymous Coward person!

Re:PDF WARNING!

[tomhudson]

Like a pdf isn't a royal PITA under linux + firefox? No wonder yu posted AC (/me currently running SuSE + Firefox, and avoiding pdf files whenever possible because they're still bloated).

Now back on topic, this is just SO fucked up logically:

hackers, worms, and viruses are good for network security and that the law and public policy should encourage 'beneficial' hacking. From the article: 'Exploitation of security holes prompts users and vendors to close those holes, vendors to emphasize security in system development, and users to adopt improved security practices. This constant strengthening of security reduces the likelihood of a catastrophic attack -- one that would threaten national or even global security [...] Current federal law, however, does not properly value such strategic goals.'"

... try it under this scenario ...

bank robbers, home invaders, and carjackers are good for your personal security and that the law and public policy should encourage 'beneficial' thieving. From the article: 'Exploitation of security holes prompts users and vendors to arm themselves to the max, vendors to emphasize rapid deployment of total coverage fields of fire in system development, and users to adopt a "shoot first, ask later" mentality. This constant arms race reduces the likelihood of a catastrophic attack -- one that would threaten national or even global security [...] Current federal law, however, does not properly value such strategic goals.'"

If it isn't your system, don't be f*cking around with it, same as if its not your car, your home, or your other sh*t. Just because it's computers doesn't make it special all of a sudden, with a suspension of all the rules.

Yes, I know, servers are just responding to queries ... but there's a difference between entering through the front door where the welcome mat is, and the door is wide open, and the host is expecting you, and trying to break in through a rear window on the second floor.

Re:PDF WARNING!

[amorsen]

Now back on topic, this is just SO fucked up logically:
[..]
If it isn't your system, don't be f*cking around with it, same as if its not your car, your home, or your other sh*t.

You are making a moral argument. The article isn't about morals, it's about facts.

Re:PDF WARNING!

[tomhudson]

Poster wrote: You are making a moral argument. The article isn't about morals, it's about facts. No wonder its in a Law Review - morals are optional for lawyers.

Seriously, the simple fact is that don't have a legal right to try to do a buffer overrun on someone else's system. Or try to install a root kit. This isn't morals - this is fact. Its a crime.

For those who won't RTFA

[Anonymous Coward]

I'm sure plenty won't click the link, so you are missing out on the great title that was left out of the summary:
IMMUNIZING THE INTERNET, OR: HOW I LEARNED TO STOP WORRYING AND LOVE THE WORM

Re:For those who won't RTFA

[Joebert]

A tank of manatees couldn't cover the potential jokes of that line.

Re:For those who won't RTFA

[arivanov]

Well...

Realistically this is the history repeating itself. Many times.

Prior to Edward Jenner discovering the vaccination the people tried to instill immunity to Smallpox in their children by a process known as variolation. The difference from vaccination was that people were deliberately infecting children with the real virus hoping that they have it in a milder form. Well... and if not, that was just a child, one more, one less who cares. In some more awkward and less developed parts of the world this is still done with Varicella, and less frequent Rubella, Measles and Mumps.

Society attitudes have changed since. The majority no longer consideres normal to infect children with the real viruses. Still, even now, there are idiots who insist that "having child diseases is good for the children as it improves their character" (or other such bollocks).

Similarly, infecting networks with real worms is not dissimilar to variolation. There are plenty of security tools out there nowdays which can detect the vulnerabilities that can be used by the worm and force the user to fix them. There is no real need to weed out the "weak" (yeah, I know, I am tempted myself to weed out the idiotz sometimes).

And as far as jo average user it will take some time for them to grow up, but it will end up the same as with vaccination. People were reluctant to do it initially. That is not the case now.

Re:For those who won't RTFA

[Haertchen]

***Well... and if not, that was just a child, one more, one less who cares.***

Can you provide any sources for this statement? Every description I've ever seen of losing a child, even in the bad old days, was usually pretty painful. You probably have to exempt the usual psychopaths.

Re:For those who won't RTFA

[Ohreally_factor]

The point of the article is not that we need to weed out the weak, but that hackers serve the purpose of revealing vulnerabilities in our systems, and allow us to take action to secure our systems. If they use non-destructive methods to reveal these system weaknesses, they should either not be punished, or their punishment should be proportionate (to what it might be if their attack was destructive). The point is that if we are continually having our systems tested by hackers and then fixing the weaknesses thus revealed, we stand a better chance of withstanding a catastrophic and crippling attack, presumably by terrorists or an enemy nation.

Re:For those who won't RTFA

[arivanov]

It was usually referred to: "Such was the God's will".

Which as far as I am concerned is about the same as the "one more, one less" attitude. Just a different form of it.

Let's not forget that 40%+ child (under 7) mortality was something normal as recently as the 19th century in most of Europe. People in those days were much more familiar with child death in the family then us. I am not saying that they did not care at all. Only idiots do not. They simply cared less, because they did not have a choice. Tuberculosis (in the cities), Malaria (in the south of Europe), Measles, Variolla, Pneumonia of all shapes and forms, Tetanus, Meningitus all took their toll.

Re:For those who won't RTFA

[Oligonicella]

Being more familiar with child death is not equivelent to "They simply cared less". It means they were more familiar, nothing greater. I noticed you did not provide any linkage to any form of support for your view.

The reason for exposing children to mumps, etc. (as my mother did me) is that these childhood diseases were far less fatal to children. They can easily kill adults.

Re:For those who won't RTFA

[Oligonicella]

Nobody's debating that a hack exposed a fixable problem. The debate is on whether the hacker should be absolved of responsibility for system penetration just because it highlights a problem. No is my answer.

Re:For those who won't RTFA

[Ohreally_factor]

The debate is on whether the hacker should be absolved of responsibility for system penetration just because it highlights a problem.

No, the issue, at least in the article, is to what degree do we punish or encourage system penetration, and should punishment fit actual damage rather than simple penetration.

There's nothing wrong with your opinion in and of itself, but perhaps you should actually read the entire article (for comprehension) before commenting on it. The author never suggests that there should never be any responsibility for system penetration.

Re:For those who won't RTFA

[Anonymous Coward]

Why don't you provide links for what you say?

Besides, the "caring" part is subjective.

Does this work for offline crime?

[amelith]

So bank robbery is good for their security and should be encouraged? Everyone who moves to a new city should be immediately mugged so they can learn valuable lessons about personal security? Perhaps there should be an official quota of licensed murders so people don't get too lax about their own safety?

What is the special magic about technology that makes people give opposite answers to "Is X sensible?" and "Is X sensible using a computer?" for just about all values of X?

Ame

Re:Does this work for offline crime?

[KlaymenDK]

Might be a good idea, as long as you make the Robbers' Guild (wrong name I'm sure?) hand out receipts so nobody gets mugged more than three times a year. :)

Re:Does this work for offline crime?

[skiman1979]

Well all those crimes hurt people/corporations. "Ethical hacking" is capable of occurring without causing damages. If I find a hole in a system for a remote code execution exploit, run code that simply displays a console message on a server, then determine how to fix the hole and inform the system administrator, that seems harmless. It allows the admin to find out about the hole and fix it. Now if I were to run code that roots the box and turns it into a spam bot sending millions of spam emails out wasting large amounts of bandwidth, or code to steal company data, that's another story. Should I be penalized if I go to your house, find out how to break into it, and tell you what I found?

Re:Does this work for offline crime?

[evilviper]

So bank robbery is good for their security and should be encouraged?

This isn't the equivalent of bank robbery (nobody gets potentially harmed, and no real damage done). Rather, a far better example would be the instances of journalists repeatedly and successfully smuggling weapons through TSA security, onto commercial flights. Absolutely no real harm is done by it, and success leads to very important good things (increasing security where it is lacking).

The more they will find security holes, and make the system safer against the real threat, the truely malicious professionals. Of course, the analogy isn't perfect, but it's far closer than bank robbery and murder.

What is the special magic about technology that makes people give opposite answers to "Is X sensible?" and "Is X sensible using a computer?" for just about all values of X?

Probably because of people like you... People who can't relate the computer world to the proper real-world equivalents, and therefore have a really warped and twisted misunderstanding of the computer world.

Re:Does this work for offline crime?

[Archtech]

Every time computer security is discussed, someone immediately trots out the "burglar" analogy. I have nothing against analogies - they are very useful for getting insight into unfamiliar situations - but every analogy has its limits. In this case, a burglar is someone whose only purpose is to steal property for his own gain. Some people who hack into computers have this motivation, but many do not.

This is where the analogy breaks down catastrophically. There is no simple, familiar motivation for anyone to try getting into a house as an intellectual exercise, or even as a challenge. Either the house is wide open - in which case it would be legal to enter in some jurisdictions, while in others the householder could legitimately shoot an intruder anyway - or it is secured, in which case any attempt to gain entry is almost certainly of a criminal nature.

Computers are different, in that trying to understand and improve on software mechanisms is a universal impulse among (good) programmers. Bill Gates, and many other people who came to be famous, hacked in his youth. The sainted Richard Feynman confessed openly to having made a hobby of getting into as many locked areas and safes as he could, while working on the Manhattan Project. He had absolutely no ill intentions, although he was well aware that the military bosses would be hard to convince of that. Incidentally, he told of a valuable spin-off, when a senior official left the project and his immense safe was found to be secured. No one had the combination, and they were thinking of explosives and thermic lances until Feynman came along and casually opened it.

Please don't accuse me of trying to excuse genuine criminals - I am the last person to do that. But do realize that many people who experiment with software do so from motives of genuine curiosity and intellectual challenge, which can be very useful if properly harnessed. And let's get over the crude physical analogy of "breaking into" a computer. A computer is a machine that executes instructions. When some sets of instructions are executed, the computer can display words, numbers, and pictures meaningful to humans, and accept human input through keyboards and other devices. A computer does not have a mind of any sort, and thus cannot be deceived, pleased, annoyed, or educated. Moreover, the idea of the computer as a structure or territory that could be broken into is simply an analogy that helps us to think about it; it does not correspond to anything real.

Re:Does this work for offline crime?

[swarsron]

The special thing is stupidity. Consider the things you see and hear about IT security in real life.
People taping their keys next to their door.
Banks where you just state a different name and get full access to the corresponding accounts.
People stating that they don't bother if other people can access everything in their house as long as they don't do anything that actually harms them ("i don't care if someone can read my mail")

I and probably everyone on slashdot know people who don't give a shit about IT security and if the only way to get them to care is a decent kick in the ass then so be it. A bank robbery now and then is good for *my* security because it keeps banks everywhere concerned about their security measures. Three years ago people laughed when i told them about the stuff they now experience and suddenly they care to take responsibility and secure their PC.

Re:Does this work for offline crime?

[Tim C]

Well, if it's *ethical* hacking you're talking about, the offline analogue wouldn't be bank robbing, it would be noticing that someone's front door looks a bit flimsy, managing to easily open it without doing any damage, then letting the owner know, perhaps fixing the problem in the process.

If you break into a computer system, copy/steal/mess around with stuff, then tell the maintainer, it's hardly ethical, is it?

That's not to say that it's sensible, just that done right, it's absolutely nothing like bank robbery or mugging.

Re:Does this work for offline crime?

[Ohreally_factor]

OK, let's say someone steals your car, but not for personal gain, only so they can figure out how internal combustion works . . .

I have no real point here. I just wanted to work a car analogy into the conversation. =)

Re:Does this work for offline crime?

[JasonKChapman]

And let's get over the crude physical analogy of "breaking into" a computer. A computer is a machine that executes instructions. When some sets of instructions are executed, the computer can display words, numbers, and pictures meaningful to humans, and accept human input through keyboards and other devices. A computer does not have a mind of any sort, and thus cannot be deceived, pleased, annoyed, or educated. Moreover, the idea of the computer as a structure or territory that could be broken into is simply an analogy that helps us to think about it; it does not correspond to anything real.

While I agree with what you wrote before this, it starts to fall apart here. Bank vaults, homes, and automobiles don't have minds either, so that's clearly not the deciding factor in your anti-analogy. Cracking a system without abusing the contents in any way really falls somewhere between "breaking and entering" and "unauthorized use of property." What is needed is a new concept.

In some legal contexts, a person's automobile is considered an extension of the person's home. It's a legal fiction that allows prior legal concepts to extend to previously (at the time) unknown areas. In some cases, that's a good thing. For example, it allows the extension of illegal search and seizure protections to a person's car rather than declaring the car the legal equivalent of "something they left lying around in public."

If someone leaves a car unlocked and the keys in it, many jurisdictions still consider it illegal to drive off with the car or even get into it. It's still unauthorized use of someone else's property, even though the car's owner was "just asking for it."

The difference, of course, is that a car's normal function doesn't include providing an interface to services which are intended to be accessible to the public. So while there are similarities to prior concepts, any attempt at a one-to-one comparison is doomed to failure. Clearly, the concept of "unauthorized use" is heading in the right direction, but something needs to be defined as the demarcation between what the system can do, and what the owner intended for the public to be able to do. Just because XYZ server can deliver root access to anyone who shoves a 5k packet to a particular port (for example), it clearly wasn't the owner's intent.

If we need a new descriptive, we need to dump all analogies and start fresh from the basic concepts. It's been done before. There's no reason it can't be done again.

Re:Does this work for offline crime?

[Yvanhoe]

In fact, thanks to bank robbers, safes are safer today than they were 100 years ago.

Re:Does this work for offline crime?

[john83]

Perhaps there should be an official quota of licensed murders so people don't get too lax about their own safety?

You clearly don't read enough Pratchett. ;)

Re:Does this work for offline crime?

[Dagmar d'Surreal]

Your analogy is simply broken and does not apply to this situation in the way you want it to.

It's not good for banks to be robbed, but it is good for honest people to be thinking about how their bank might be robbed and to go to the management and say "Hey, I've noticed that you've got this weakness that would let me walk off with a lot of money". ...provided, of course, that they're not summarily charged with conspiracy and sentenced to a few years in jail.

Re:Does this work for offline crime?

[gidds]

a far better example would be the instances of journalists repeatedly and successfully smuggling weapons through TSA security, onto commercial flights. Absolutely no real harm is done by it

Is that so? Hmmm. "No, officer, I'm a journalist, honest. I know I'm wearing a turban and have a foreign-sounding name, but I wasn't going to use these explosives strapped to my chest. It's just for a newspaper story. Sorry, what? 'Press card'? Er, no, I left that at home, sorry. But I really wasn't going to set these off. Honest."

Exactly the same applies to computer hacking. If an intruder was good enough, you might not be able to tell whether any serious damage was done; which means you must always assume the worst. Grey-hat hacking just doesn't seem justifiable.

Anyway, doesn't this whole story boil down to "We need hackers, because if there were no hackers we wouldn't know how to protect against, er, hackers..."?

Re:Does this work for offline crime?

[Archtech]

Bringing the "mind" element in was a tactical error, I admit; I was broadening my assault on comparisons of computers with any physical form of property whatsoever.

A computer is an abstract machine for manipulating information. As good /.ers, we all understand that implicitly, but it's amazing how many people don't. They think it's a machine for running Office, or a machine for browsing the Web, or for email, or for playing games. Whereas it is actually all of the above and infinitely more, just as "the natural numbers" are not just 1, or 2, or 3 although it includes them.

Re:Does this work for offline crime?

[PyroPenguin]

This is where the analogy breaks down catastrophically. There is no simple, familiar motivation for anyone to try getting into a house as an intellectual exercise, or even as a challenge. Either the house is wide open - in which case it would be legal to enter in some jurisdictions, while in others the householder could legitimately shoot an intruder anyway - or it is secured, in which case any attempt to gain entry is almost certainly of a criminal nature.

Slightly off-topic, but there is a quite funny program on The Discovery Channel called 'It Takes a Thief'. The premise is the same; a non threatening crime to show the victim where they need to improve their security.

"So how safe is your house? Enter It Takes a Thief, a unique new Discovery Channel series that offers viewers something they've never seen before: a home burglary performed by convicted former thieves that is taped as it happens, followed by a lesson in what steps to take to prevent such a violation from occurring again."

Re:Does this work for offline crime?

[Antony.S]

Think you meant assassins?

Re:Does this work for offline crime?

[Mojojojo Monkey Inc.]

Should I be penalized if I go to your house, find out how to break into it, and tell you what I found?

I hate these kinds of analogies, but can't help but play along...

How would you feel about having someone hanging out outside your front door playing with the locks, going to your windows and seeing if they open, trying to peep in your bedroom blinds, tracking what time your kids leave and come home from school, and sitting in a parked car across the street for a few days staring at you?

Would it make you feel any better if he knocked on your front door and said "Hey, your deadbolt is a little weak, you should spend a few hundred dollars and a couple hours of your time and get a newer model. If I was actually a bad person (but I'm really a good person!) I could just kick it down and steal all your stuff. I also may or may not have seen some kinky stuff going on in the bedroom since your blinds weren't closed all the way, but you'll never know for sure. Have a great day!"

Could you respond positively to something like that?

Re:Does this work for offline crime?

[Anonymous Coward]

no, it doesn't cause physical harm but it does cause economical harm. it's no different from organizing alot of people to walk down the streets so noone can reach the stores (ddos attack), or robbing individuals (stealing credit card infos and such), or well, robbing a bank (hacking into a bank). Of course their i degrees of these events and damage ranges from nothing to something big since it's such a general catagory, you can't deny that it doesn't do harm. worms and viruses to me just seems like a natural extension of society (ie, human nature based off on normal life). some people seek to take advantages of others while other people try to prevent it. it's niether good or bad depending on your point of view.

Re:Does this work for offline crime?

[skiman1979]

That's a good point. I don't think I COULD respond positively to a statement like that. I wouldn't want someone to be that involved in my home's security, monitoring my family's activities, playing with the locks, etc... but if someone was driving by and noticed my front door was open all day, or saw that I had a rope hanging out one of the bedroom windows for someone to climb, I'd want them to let me know. I wouldn't want someone to constantly be brute forcing my ssh server, or hitting my web server with PHP exploits all day to see if there is an exploitable hole, but if someone is legitimately using my server and notices a problem, I'd like to know about it.

Re:Does this work for offline crime?

[MECC]

Actually, thanks to people designing better bank vaults. That they are motivated by bank robbers shouldn't mean you give credit to the bank robber. Give credit to the engineer building the bank vaults. Bank robbers don't design safes. At least, not yet.

Re:Does this work for offline crime?

[drb_chimaera]

Nope - he meant Thieves' Guild. At least I assume he did :)

Re:Does this work for offline crime?

[egarland]

We already have laws that make stealing illegal, there's no reason for making doing it "with a computer" special. If you break into a computer and steal money, you stole money, go to jail.

If I break into a computer and play a prank that hurts no one, why should I be facing hard jail time where if I had just broken into a building and played a prank the police would probably not even bother tracking down who did it?

Somehow people in the technology world have gotten it in their heads that people being curious and testing boundries deserves ass pounding federal prison time. This is incredibly destructive to some of the most important qualities in people: curiosity, cleverness, inventiveness all get squashed by this concept of "if we didn't intend for you to be able to do something and you do, you're a criminal".

This is highly destructive to real network security, the kind of security where even if people want to do something you didn't intend them to do, they can't. We need to go back to making tinkering with interfaces provided to you legal. The rule should be, if you don't want me to be able to tinker with the interface, don't provide it to me.

If hacking is a crime only criminals will hack.

Re:Does this work for offline crime?

[JasonKChapman]

A computer is an abstract machine for manipulating information. As good /.ers, we all understand that implicitly, but it's amazing how many people don't. They think it's a machine for running Office, or a machine for browsing the Web, or for email, or for playing games. Whereas it is actually all of the above and infinitely more, just as "the natural numbers" are not just 1, or 2, or 3 although it includes them.

Exactly. They're also becoming pervasive in areas that have little to do with either generic office work or traditional Internet services. There are microwave ovens that can "phone home" to look up recipes now, based on UPC code product scans. I'm waiting for the first exploit--maybe the "RoastToast Worm" or something that includes the phrase "All your HotPocket are belong to us."

Clearly, whatever definition is developed is going to have to be abstract enough to get away from the traditional concepts of "computer" in common, public parlance. Otherwise, it will have to be updated every twenty minutes or so, as the landscape changes.

Re:Does this work for offline crime?

[Anonymous Coward]

I've broken into 10 houses- 9 purely as an intellectual and physical exercise. I do it without breaking or harming anything, without picking locks, and without bringing any special tools. I'd never steal anything. Two had burglar alarms.They were all homes of people I knew whom I knew were away, but that's not to say they might not have minded if they'd ever known, although they probably wouldn't have called the cops on me.

The tenth house, I was visiting friends who were supposed to be house-sitting for their parents, but they had accidentally locked themselves out. That was supposed to be a high-security home, as they owned some very expensive art. That was one of the two houses with security alarms, and it's a good thing I didn't have to bypass it (I just had to gain physical entry without breaking anything, letting the alarm go off, and then they rushed in and turned it off), because I couldn't have, it was a very fancy system.

Anyway, I'm just saying, you're wrong to say "There is no simple, familiar motivation for anyone to try getting into a house as an intellectual exercise, or even as a challenge." I've done it, and I'm sure others have too. In fact, I think your argument really breaks down when you get to Feynman. He was gaining illicit entry to restricted areas and vaults. To me, that's a whole lot more like breaking into houses, and a whole lot less like hacking computers. I'm not condeming computer hackers, but I don't believe your basis for differentiating computer hacking from testing other security systems.

Re:Does this work for offline crime?

[Archtech]

If what you say about breaking into houses is true, I think you are rather unusual in that respect. I would not be amazed if it were true, because people enjoy all sorts of challenges. But I don't think there are anything like as many people who would break into a house for that reason as people who enjoy pitting their wits against computer security.

As for Feynman, my description of his activities was rather inaccurate. As I recall, he specialized in two things: getting into locked filing cabinets, and finding the combinations of safes. The latter usually boiled down to seeing the first few digits by simple observation, and - where possible - getting the others by elimination.

Viscious Circle

[mcai8rw2]

Its a bit of a viscious cirlce this idea though...

The reason Virii and Worms etc are good for the security of a network, is because they prompt us to tighten security for future attacks based on historic ones.

"Nessesscity is the mother of invention" But the irony is...if the Virii/Worms didn't exist in the first place, then we wouldn't NEED to improve security against such attacks.

Oh the confusion.

Re:Viscious Circle

[skiman1979]

We would still need to improve security, not against automated attacks, but against manual ones.

Re:Viscious Circle

[NeilTheStupidHead]

And if such a cause and effect development of anti-virus software hadn't occured, the computers on our mothership could be hacked and implanted with a virus by a mac-using, alien Jeff Goldblum after SUV driving Bush supporters use up all the oil and we are forced to steal from other planets.

Re:Viscious Circle

[Anonymous Coward]

... viscious cirlce ... Virii ... Nessesscity ... Virii

Too bad grammar isn't an evolutionary advantage!

Re:Viscious Circle

[ichigo 2.0]

But the irony is...if the Virii/Worms didn't exist in the first place, then we wouldn't NEED to improve security against such attacks.

I think the article is about worms in the wild evolving our security to better withstand against intentional attacks from hostile nations/aliens/whatever, not from the worms themselves. I didn't really RTFA though. :P

Re:Viscious Circle

[JudgeFurious]

No confusion, it's simple really. If assholes didn't exist then there would be no need to worry about having to deal with assholes. There would also be no need to argue with them when they try to claim that the shit they do contributes to a better computing experience for everyone.

Re:Viscious Circle

[mcai8rw2]

Well, I forget where, but i read a very interesting paper on how the adaptation of grammer, spelling and language use in the last 20 years.

Basically since some clever-dick invented computers, and our efforts to instil the 'three r's' in children went all to cock, we are paving the way for a unified language. An interesting thoery, that nearly exists now.

Latin is a language, as dead as dead can be. First it killed the Romans, and now its killing me. English followed later, nations came undone...computers stepped up to the bench...010101

I, for one...

[Anonymous Coward]

I, for one, wellcome our friendly inmunicers hax05ss :D

Wait, I am hacker soo.. I am now overlord! niiiiice..

My first command will be.. all womens of slashdot serve me and go here at once!.

Taquila Sunrise

[Joebert]

How I learned to stop worrying & love the worm.

Looks like I found a new Taquila drinking buddy.

Re:Taquila Sunrise

[rehashed]

What is it with Slashdot and people consistently misspelling "Tequila"!
I would pull up some stats but the search seems broken?

Re:Taquila Sunrise

[nacturation]

Looks like I found a new Taquila drinking buddy.

Or perhaps you have too many Tequila buddies already.

Re:Taquila Sunrise

[Joebert]

I'm drinking a bottle of rotted juice, with a worm in it, & you expect me to know how to spell it ?!

Re:Taquila Sunrise

[rehashed]

Best response ever.
Wish I had mod points :D

Re:Taquila Sunrise

[thePowerOfGrayskull]

If you're drinking taquila, what's the "tequila" stuff I've got here?

Re:Taquila Sunrise

[Joebert]

My guess is an unopened bottle since you spelled it right.

Yeah...

[Dieppe]

...and current law that arrests tresspassing and burglary don't reward people for learning to lock their doors for fear of a breakin.

I'm sorry if I don't buy the whole "we're writing viruses and trying to break in to teach you people to do better" excuse. If someone's tresspassing I'm going to shoot them anyway, regardless of whether they think they're teaching me a lesson.

Used to be the world was a friendlier place, and there are parts of the U.S. where you still can leave your door unlocked at night. Doesn't mean that robbers are to be rewarded though...they're still bad guys.

Re:Yeah...

[CRCulver]

If someone's tresspassing I'm going to shoot them anyway, regardless of whether they think they're teaching me a lesson.

Uh, before you start stocking up on ammunition, you might want to look at case law for people who have shot trespassers. Except for when the trespasser was threatening physical harm, those who shot them usually got indicted for murder. You can't shoot someone just because they are on your property, especially if they are hundreds or thousands of feet from any houses. The whole "Trespassers will be shot" sign meme doesn't really mean anything in court.

Re:Yeah...

[Anonymous Coward]

I think you fail to see the distinction here.

Virii, worms and the like, are products of malicious intent from malicious people motivated by a desire for destructive and harmful ends.

The article in question, at least to me, appeals to people that have the technical knowledge to be able to find these vulnerabilities, and implores them to apply those skills in a positive manner. They're not encouraging these people to exploit said vulnerabilities to any detrimental end. The idea is to foster an environment where people that possess the talent to find security holes do so, and report them to developers so that these potentially damaging flaws can be fixed.

There is a very large difference between uncovering and exploiting new vulnerabilities for personal gain, as opposed to uncovering them for the sake of improving the general state of security. Your analogy is entirely flawed, as it assumes anyone that has the knowledge to uncover these security holes only does so for the sake of personal gain and cannot operate in an ethical fashion.

I did my fair share of 'hacking' when I was younger, and when I found critical security flaws in my school's network, I demonstrated them to the system administrator and worked with him to try and get the problems fixed. Those security issues affected me just as much as anyone else, and with a sizable student body such as the one that school housed, I wanted to see to it that my data, along with everyone elses' was going to be safe. It's simply a matter of encouraging the right people with the right motivations to identify problems and assist in solving them before the wrong people can discover and leverage those vulnerabilities to do any serious damage.

Re:Yeah...

[smoker2]

If someone's tresspassing I'm going to shoot them anyway, regardless of whether they think they're teaching me a lesson.

And when that trespasser is having to break in because you are ignoring them or the phone line's down and you can't be reached, or the house is on fire and the smoke has knocked you unconcious, should you still shoot first and ask questions later ?

Even to take your statement as it stands, you will have learned something from their "attack" - if you notice it and even get to *shoot* in the first place.

I think the saying - A fool and their money are soon parted - can be adapted for use here. An idiot admin and their computer are soon rooted.

Shooting the messenger soon leads to getting no messages.

Re:Yeah...

[Detritus]

There's a difference between trespassing on someone's land and breaking in to a house or apartment. If I hear someone breaking in to my residence, I'm going to get my shotgun. Look up the "Castle Doctrine".

Re:Yeah...

[Macthorpe]

Yay, spelling nazi to the rescue!

It's "viruses", not "virii". Virus is not a noun in latin and has no plural. "Virii" is the plural of vir, and means a lot of men.

No, really.

I hate myself for posting this.

Re:Yeah...

[Knuckles]

If you do it (and thanks for that), do it correctly. Virus very much is a noun . It means slime, poison, etc. It's just that its gender is neutral, and its plural is virus. And if you don't want to be looked at funnily, its possible to correctly anglicize it to viruses.

Too often companies ignore problems until it's....

[Anonymous Coward]

.... too late. It doesn't even have to be a real security issue. It can be something as simple as good security practices. Here are ideas I would recommend e-mail providers, for example, to implement.

Dual passwords. A master password which can change anything in the account, and a secondary password which can change anything but the master password. The idea is that if your secondary password is stolen, you clean your machine (just incase you were infected), log in with your master password, change your secondary password, and everything is fine.

Freezing expired accounts for 10 year periods to prevent someone from grabbing it up and gaining mail-forgotten-password privledges from other sites. Got a bank account? Got online banking? Got an account which you can easily send your password to your e-mail address? Oh wait! Your e-mail address expired! Someone else registered it, went to a bunch of bank websites and such, just to see if your former e-mail address has an account there.

Hey, it works for living creatures

[hapoo]

Keep someone in a clean room all their life and then one day let them out. With an immune system that has never had the chance to "practice" they guy wouldn't last a week. On the other hand its been proven that eating your own boogers will boost your immune system. Just extend the same logic to a network.

Re:Hey, it works for living creatures

[zaphod_es]

Well, if eating your own boogers is so good for you, just imagine how much better it would be to eat other people's.

open source hacking

[joe 155]

does anyone know where you can get open source hacking tools to use against your own system? I would like to know if my password could stand up to a traditional brute force crack, or if it would be possible to use remote ssh login to get contol of my computer...

Re:open source hacking

[smoker2]

How about here ?

Re:open source hacking

[nacturation]

Sheesh... http://www.google.com/search?q=open+source+hacking +tools

Re:Student from where ?

[OverlordQ]

Taking 2 seconds to view their hompages tells you this:

The Harvard Law Review is a student-run organization whose primary purpose is to publish a journal of legal scholarship. ... The organization is formally independent of the Harvard Law School.

What's with people being lazy? Or is it just an attempt at some karma whorage?

Article summary - rewritten...

[jkrise]

Hackers, worms, and viruses are good for network security ("Security Software firms such as Symantec) and that the law and public policy should encourage 'beneficial' hacking (Legislation must ensure we keep such firms running). From the article: 'Exploitation of security holes prompts users and vendors to close those holes (Makes people believe that such defects are inevitable, and can only be solved by continuous updates) , vendors to emphasize security in system development, and users to adopt improved security practices. This constant strengthening of security (reliance on vendors for updates) reduces the likelihood of a catastrophic attack -- one that would threaten national or even global security (any negative impact on suspect business practices OR bottom-lines)

Makes sense now, don't you think?

Why Shouldn't it :-P

[sakahna]

Harry Harrison makes exacly this argument in his Stainless Steel Rat series. As long as no-one gets physically hurt, the banks pass on the loss to their insurers, the police have what to do, the media what to report, the general public is entertained and the money is put back into circulation. So in theory, "everybody benefits".

Of course, real-life doesn't work like that. Just look how every little imaginery threat is currently used by the PTBs to further clamp down on the innocent general public.

Re:Why Shouldn't it :-P

[Anonymous Coward]

"the banks pass on the loss to their insurers"

Yeah, because we all know that insurers are not part of the system at all; unlike the rest of us, they have access to magic money-making machines powered by pixie dust.

Re:Why Shouldn't it :-P

[badfish99]

No, it's trickle-down economics in action. The banks recover the cost from their customers, who are mostly rich businessmen. So some of the wealth of those rich people ends up having trickled down to the poor robbers. Isn't that how things are supposed to work?

The rich people were probably just going to donate their spare wealth to charity to help the poor: robbery saves them the trouble of having to do that, too. It's a win-win situation!

Re:Why Shouldn't it :-P

[Anonymous Coward]

Except its not tax deductible if you are robbed/mugged/bashed!

Good idea, but doesn't work out

[Opportunist]

The idea that finding a hole and reporting it leads to more security works in a "perfect" setup. Perfect in a sense that the one finding it reports it instead of abuses it, and the one informed about it fixes it instead of ignoring it.

The reality looks different.

In reality, people don't want to be bothered with this pesky thing called security. They want their machines to do the magic by themselves and not worry about it. So they created laws where it becomes illegal to even look for a security hole. Because, what you can't see isn't there.

Take you average user. Just enough smarts to turn on the PC, updating with an automatically generated and even transfered script is beyond their capabilities. When (not if, when) their computer is turned into a spamslugger, who will they blame? Themselves for not being able to keep their machines secure?

Keep on dreaming.

The laws are a reflection of the general unconsciousness. People don't want to be hacked, so it must not be done. Yes, the machines are insecure, yes, there are billions of trojans and viruses out there trying to break in (and succeeding, most of the time), but as long as we don't see them, they're not there.

La la la, I can't hear you...

Re:Too often companies ignore problems until it's.

[Anonymous Coward]

I forgot to mention IP flags. When someone logs into their account, list the last 3 IP addresses.

Lawmakers out of touch

[pubjames]

I think this raises a fundamental issue - most of our lawmakers and enforcers are people who have not grown up with these new technologies and have little understanding of them, both from a technology point of view, but also their social context.

Most judges, seeing a bank had implented very poor physical security - so poor that a lone teenager could fairly easily get into the bank without help - would be lenient on the teenager for breaking into that bank and bank would be in lots of legal trouble for having lax security. But when the internet is involved the teenager becomes an evil hacker in the eyes of both our lawmakers and much of society, and it's off to jail for the teen and no punishment for the bank.

I really worry about the next generation. All kids do stupid stuff and talk about stupid things as they are growing up. Only now, much of that stupid talk is done via electronic communications, and much of the stupid stuff is easier to trace.

I can see in the near future (maybe it's happening already?) that when a misdemeanour with a youth occurs one of the first steps a law enforcer will take will be to get access to the youths electronic communications. Then they'll uncover all kinds of stuff that will look terrible in the eyes of a law enforcer and the parents - and be extremely embarrassing or worrying for the youth. But in reality will just be the stupid things people do and say when they are growing up. We'll have youngers going to jail and being ostracized by their parents and society just for doing and saying the stupid things that we all did when we were young.

Re:Lawmakers out of touch

[Oligonicella]

"Most judges...would be lenient on the teenager for breaking into that bank..."

Bullshit. The teen would have gone to jail. Just because the window's open don't mean it's ok to enter.

Re:Lawmakers out of touch

[pubjames]

I didn't say the teen would go unpunished. But the judge could understand the temptation of the open window and that the kid just climbed through it, and would likely be lenient in his sentence. Using the same situation as a metaphor on the internet, the judge wouldn't be able to understand if the window was open or not, and is less likely to be lenient in his sentence.

Re:Lawmakers out of touch

[Anonymous Coward]

Your stupid.

Re:Student from where ?

[Joebert]

Hey pal, I had quite a few funnies over the last week, I can be lazy for a day. :)

What is the special magic about technology

[Animaether]

Imagine if this was the so-manieth discussion about music or video copyright infringement. Now ask again: "What is the special magic about technology". I think you'll find your answer.

I don't agree with it, for what it's worth, in either case.

And

[Joebert]

Perhaps paying attention to actual people & not their stereo types for awhile might do you some good.

oh, there should be penalties

[m874t232]

They should be against companies running buggy or insecure servers and end up exposing customer data or causing hassles to their customers.

As for "hackers", they should be held responsible under existing fraud laws if they commit fraud; the mere act of "breaking into" a computer system should not be a violation of law.

Re:oh, there should be penalties

[speculatrix]

the mere act of "breaking into" a computer system should not be a violation of law.

if there was no security, are you actually breaking in? so, in which case, are you violating the law by attempting to discover if there is any security in place?

in meatspace, if you walked up to a building and try and open the door, but it's locked, as I understand it you've committed no crime. If the door is locked and you pick the lock without damaging it, you are committing a criminal offense of trespass. If you break the door down, you add criminal damage. But if the door was unlocked, what crime is it - surely a minor one provided no damage is down, nothing is touched or taken.

Duh should have previewed

[ndg123]

Buggers ? I thought the term was boogers (USA) or bogies (UK). Buggers has a http://dictionary.reference.com/browse/buggerssome what different meaning where I come from. Apologies in advance if I'm just not familiar with your local dialect.
Some of your post may still be true.

A little knowledge is a dangerous thing...

[trims]

The paper (or article, or whatever) is actually quite well-nuanced and fairly even-handed. However, it suffers from a fatal flaw of many legal articles: a fundamental ignorance of the subject matter itself.

It's a paper written by (wannabe) lawyers, who, while they site large rafts of supposedly corroberating papers and "experts", don't understand what they (the exports and sited papers) are talking about.

This kind of approach is eminently practical (and effective) when attempting to try a case, or negotiate a settlement. However, it is absolutely the wrong way to do things when attempting to write a Public Policy piece. If one is attempting to educate the populance (or some subsection of it) about an issue, you have to actually understand the subject, not just quote others' ideas.

They are correct in the supposition that cybercrime has a different nature than that of "real world" crime. But they completely misunderstand how this difference affects people.

A classic example of not really understanding the subject matter occurs when they claim that a compromised system actually causes very little economic damage, as the system itself is not physically damaged, and the effort to repair it is theoretically comparable to a periodic security audit/update of the machine. What they perceive is a JoyRide in a "stolen" car - someone took my car out for a whirl, and if they've returned it in good shape, all I (the owner) have to do is sweep out a few of the crumbs (and maybe fix the door lock) before it is ready to go again. This isn't the true case. Rather, it is closer to the case that I, the owner, would have to completely dissassemble the entire car, and put it back together again from its component parts, just to make sure that the kids didn't screw something up (or wire a bomb to the ignition). There is a HUGE economic cost to cleaning up after even a minor intrusion. Because, frankly, there is no way to determine if something was a minor or a major intrusion, until a complete postmortem is done. And the risk associated with keeping a compromised system working is far too great to NOT do the full rebuild. In many ways, the risk analysis looks a lot like empidemiology: when a herd of cows is found to contain one case of Mad Cow, we kill the entire herd and check them all, rather than just kill the sick cow, and say "oh, we found the problem, and it is fixed now".

The real solution is not to allow "ethical hackers", but rather to provide economic incentives for companies to protect their data. If this were the case, then companies would take security seriously, and there would be a whole thriving sector of legal security probing companies (which exists in a very tiny manner today). If companies were held to multimillion dollar fines every time private data was compromised, you could be damned well sure that security would rank somewhere above "oh, and empty the trash before you leave tonight", which is where it currently resides. And security checks would be done by true professionals, complete with after-incident reports and improvement suggestions.

-Erik

Re:A little knowledge is a dangerous thing...

[floWing]

You seem to be the only one to mention this problem: on most systems, an intrusion means that you need to completely reset (at least) the invaded machine. Quite often, although, also possibly compromised passwords, authentication files, etc. must also be reset on a global scale.

This measure of loss is overinclusive, however, because much of the cost of restoring system integrity is money that one should reasonably expect users to spend anyway. Whenever security flaws are discovered, users spend time and money to patch them, regardless of whether their systems have been attacked. Yet these same costs, when borne by the actual victim of a breach, count as losses under the current Guidelines even when the hacked system suffers no damage. It is as if a mere trespasser who entered a doorway with no lock were held liable for the cost of installing a lock afterwards.

So this statement indicates that a patch is as expensive as restoring a system? And as others mentioned, this shows how people love to create real-world examples about things those simply do not work in the IT world that way.

Finally, as discussed above, an attack's benefits generally correlate with its novelty. Exploitation of a known security hole usually offers little benefit beyond raising awareness. A novel attack, however, reveals much more valuable information that could preempt a more damaging surprise attack. Therefore, a redesigned system might punish attacks that are novel more lightly, and punish attacks that are not novel more harshly.

Great, any real intruders, who will most likely not rely on old exploits, get less punishment. Nice perspective: hack a few systems, do nothing obvious but set up a backdoor allowing another attack to be even more untraceable, and claim you are a "benevolent hacker". Therefore, you are getting less (or no?) punishment (and possibly making the victims prone to leave the system[s] unchanged apart from patching what you do not care about any longer), and finally complete the real crime later. Great concepts in this work, really. But he (they?) should have asked some security guys first, I guess.

Re:A little knowledge is a dangerous thing...

[makomk]

Of course, there's one slight flaw to your logic - if someone has broken into a computer system and hidden something malicious, they're unlikely to tell the system administrator about it (and risk a security audit). Instead, it's far more likely that someone would break in, hide something nasty, and conceal the fact that they were there in the first place. In fact, maybe any serious security hole should trigger at least a thorough check for any evidence that it's been exploited (if not a full audit) - unfortunately, it's probably totally impractical.

Honest, officer, I was just checking the doors

[davmoo]

So to use this same idea, y'all have no problem if I discover your back door to your house is unlocked and I come in just to look around and make sure there are no other 'security issues', right? I promise I won't steal or damage anything, I just want to look around...

Sorry, it don't work that way, and just because computers are computers doesn't make it any different. If you want to come in to my computer and inspect, I expect you to ask, just like I would for my house.

When Microsoft is caught sniffing around anyone's computer without permission, even if they don't damage or alter anything, everyone here wants Bill Gates' head on a pike for public display and criminal charges against Microsoft. But if its a white-hat hacker, that's okay, and we should have the law allow them in. Funny how that works.

Re:Honest, officer, I was just checking the doors

[DJ Rubbie]

Equation to that may be slightly different if your house happens to be in a warzone, where other crooks can use your house as a staging ground to attack _my_ house. The Internet is more like a warzone to me than a quiet residential district. As for Microsoft sniffing around your computer, it's most likely covered under their EULA, if not, buyers of Windows got what they paid for.

Re:Honest, officer, I was just checking the doors

[Jboost]

So to use this same idea, y'all have no problem if I discover your back door to your house is unlocked and I come in just to look around and make sure there are no other 'security issues', right? I promise I won't steal or damage anything, I just want to look around...

We have different laws for that.
I can't speak for the rest of the world but over here the Dutch constitution says:

Article 12 [Home]

(1) Entry into a home against the will of the occupant shall be permitted only in the cases laid down by or pursuant to Act of Parliament, by those designated for the purpose by or pursuant to Act of Parliament.

I can imagine other countries having these kind of restricitons as well.
So the real-world-house-analogy doesn't work.

Re:Honest, officer, I was just checking the doors

[Anonymous Coward]

"y'all have no problem if I discover your back door to your house is unlocked and I come in just to look around and make sure there are no other 'security issues', right?"

Well, in my apartment building, it's _extremely_ unusual for people to leave their doors open for extended periods of time. If one of my neighbors saw that my door was open for a long time, and took a moment to make sure that nothing unusual was going on...that wouldn't be a problem. The solution lies not in criminalizing everything, but whether there is a suitable reason.

Re:Honest, officer, I was just checking the doors

[CounterZer0]

But using your unlocked home analogy, should I be arrested for knocking on the front door and having it swing wide open?

Parallels in Biological Systems

[D.A. Zollinger]

From another perspective, the author's ideas have some merit. In biological systems, it is only after one has been infected and their immune system fights off a disease that they are impervious to repeat infections. In this way entire societies build up resistances to deadly diseases. For example, Jared Diamond believes 95% of Native Americans were killed off by diseases carried by European settlers who were largely immune to said diseases. (link)

In a way, as different portions of the computer systems and software are attacked, the flaws that allow for such attacks are, in general, corrected. Problems identified in one attack can be applied to other areas, and as such, can affect system-wide changes toward a better system (think buffer overruns), as well as more security-minded design (think security developments in IE7 and Vista).

I'm not advocating that the world governments should let virus writers and crackers have free reign of the Internet. A balanced response would allow for leniency for those who have no malice in their intentions. Of course, this is difficult to prove, and from personal experience, I have yet to meet a virus writer with purely altruistic intentions. Also there are corporate interests to deal with as well. How embarrassing must it have been for Symantic to have their flagship product meant to help secure a computer be the source of insecurity? While Symantic handled the situation extremely well, many other companies do not have a large security minded staff on hand to deal with security problems. For them it is easier to accuse the attacker than acknowledge a problem they cannot deal with.

Re:Parallels in Biological Systems

[D.A. Zollinger]

Consider the avian flu (H5N1). The World Health Organization has found evidence that this disease has mutated and is now starting to transmit from human to human, where previously it was only transmitted from bird to human. (link) The chance for a world pandemic has greatly increased with this revelation, yet people and communities who have prepared themselves, and are in good health to begin with will most likely survive the infection, or avoid becoming infected in the first place.

Similarly, it is the computer networks and systems that are focused on security that tend to be the best protected when it comes to zero-day exploits. Good network and system administrators know the general weaknesses of the computers they are responsible for, and work to protect those weaknesses from exposure. Good administrators that have planned well, tend to monitor an attempted attack on their network, while poor administrators tend to find themselves recovering from a successful attack.

Re:Full disclosure is a necessary evil

[Anonymous Coward]

... but going in jail is may be a worse option.

It is true that bad hackers will pretend to be ethical hackers but by putting everone in jail you end up creating a less secure world. Only the bad hackers will find the security hole and they won't tell anyone.

Full discolure is the only solution and it is not popular: companies get bad press for having security holes, they might loose some business and thus try to shoot the messenger ... with success so far.

However, full discolure is a necessary evil it we want to have a safer online life.

As Good As It Gets

[Joebert]

I don't think the world can ever be truely secure.
The world is always in a sort of "Ok on the count of three, we all drop our guns" state.

Re:As Good As It Gets

[Anonymous Coward]

The term you're looking for is "Mexican standoff."

Good Idea

[friedman101]

While we're at it let's make bankrobbing legal because of its role in beefing up safe security.

So what *are* you allowd to use the Internet for ?

[Anonymous Coward]

So many people depend on 'the Internet', and assume it will 'just work'. But it's rapidly coming to the point where you can't use it, without someone getting upset about what you're doing and sending the police round to lock you up.
And of course it doesn't 'just work'. It's a 'best-effort' network for carrying sequences of 0's and 1's around, which neither knows nor cares what the 0's and 1's mean.
Just because *you* think it's a virus, doesn't mean *I* think so. It might be 500 DVDs per second of 'star noise' from the radiotelescope, just doing its job in the normal way.

the internet is a communicationsnetwork

[NotInTheBox]

Breaking in to something is a physical act as far as I am concerned. So it would cover the act op opening the computer or something like it.

This whole metaphor has gone to far. People don't break in to computers, they communicate with them.

If I ask someone (or a computer) for a copy of X and the other side sends me this is this then a crime? Was the sender authorized to allow me access?
if I send something to someone and they accept it is this a crime? Maybe, if the thing, I was sending was a bomb or something else equally nasty.

Re:Full disclosure is a necessary evil

[Anonymous Coward]

Exactly, but there is a time and a place for full disclosure, and the situation is easily complicated. Even just the act of disclosure is uncertain. Publish to widely and be accused of helping hackers. Publish too narrowly, and be accused of not informing the public. Its a messy job.

Right....

[Anonymous Coward]

Right right..just like having someone try to break into your house makes you safer. I swear, do liberals just get up in the morning and leave brain cells on the pillow?

Get the terminology right...!

[welshwaterloo]

Yeesh.. from the article:

Even old-fashioned e-mail worms, which rely primarily on user ignorance, can spread to hundreds of thousands of computers.

Now, I always thought a worm is "self-contained and does not need to be part of another program to propagate itself. They are often designed to exploit the file transmission capabilities found on many computers."

Geez people - if you can't cromulize your terminology, I have little faith in your article..

Certified Ethical Hacker

[Flying pig]

There is a possible way...

Introduce a properly run certification scheme for "Certified ethical hacker". Base it on a course taking in relevant law, security techniques etc., and make damn sure it is vendor-agnostic. Only make the course available to persons who have no criminal convictions, are on the voter's list, member of a professional body, and pass FBI checks or your national alternative. It will be free to qualified applicants.

Now issue those people with a set of official paper forms, with proper security marking and tied to the individual. When they encounter a security issue, they issue a paper based advisory (because it is still traceable, and because you do not then leave a trail on the net that might enable the black hats to find and target you.) copy to some official body who every year will report the statistics, and list the companies that failed to respond to security advisories.

So now you have it on your resume when you write in for the bank job: Certified Ethical Hacker, 42 confirmed alerts (or whatever).

Before anybody tells me this is simply fantasy, consider that there are already volunteer public security forces. In the UK we have Special Constables and the Territorial Army, and there are equivalents in many other countries. We have a Health and Safety Executive who can walk into any company at any time it is operating and demand immediately to observe what is going on. So why not a properly trained volunteer Internet security force?

Re:Student from where ?

[Purist]

^^^^^ As evidenced by the very naive points brought out in the summary - the article may be interesting, but lacks any practical insight.

If you want to hack into systems to make the world a better place, hack into your own systems and report your findings or get a job with an organization that hacks into systems for pay.

The predictable liberal-nonsense point that has been wrenched from the article is that people in general are too stupid to figure things out on their own and in order to protect them from theselves we must strip them of their rights (temporarily, mind you) so we, the brilliant ones, can shine the true light on things. Unfortunately, this is a viewpoint many Shlashdotters embrace.

Open doors vs Closed doors.

[Tei]

Imagine a white hat h4xo that found a dangerous hole, send info about that to admins, and that hole is fixed.

Its that good?

I think yes. but need:

1) The white hat attitude. Complete morons are discarded.
2) Its a hole, and not a feature. Maybe the users want the system this way, and know enough about the tradeoff.
3) The hole being fixed. If is imposible to fix holes, maybe because lack or resources, this help nothing. Of course, the problem here is the lack of resources.

On real world, some people want to live with his doors unlocked, mostly on rural areas. Its that a "hole"?. Its not. What safety expert AND ha4xors fail to realice, its that the world is not about of safety for everyone. Some people like his doors unlocked, thanks. Other people dont know about that, and will love to know about a hole, and fix it.

Ethical Hacking

[DarkYang]

Actually, most major corporations nowadays, especially banks, hire ethical hackers to try to break into their systems to prove how safe it is, and if they can get in, mke recommendations on how to fix it, or have them fix it themselves.

Too late

[MECC]

Microsoft has 'educated' an entire generation of users that you have to run with full root privileges to get anything useful done at all. This is completely independent from how they respond to security issues raised by third parties. The damage is so pervasive that it can't be undone. MS stands as the village idiot of software companies for such a stupid design paradigm, and the single biggest problem on the Internet, as well as the single biggest problem in the IT industry for so completely dumbing down so many people. I wouldn't look to vista to cure the ill either. The more MS talks about security, the more evident it is that they can't pull their head out of their ass, and they'll keep dumbing down their 'customers'.

Re:Too late

[dbIII]

Microsoft has 'educated' an entire generation of users that you have to run with full root privileges to get anything useful done at all.

As a result we've ended up with a situation where security problems exceed that of bad science fiction. The break into the facility and hack the control systems SF is being replaced by the reality of getting in from anywhere over the net. Idiots have already connected bank automatic teller machines and electronic voting machines to the public internet with poor security - who knows what is next.

Here is an example of a break in

[shis-ka-bob]

I am quite in agreement with the parent poster about the problems with analogies. You bring up bank vaults. During WWII, there was no secret more valuable than the work of the Manhatten Project. General Groves, the commanding officer, had a safe for his top secrets. Richard Feynmann, a physicist on the project, is famous for 'cracking' the safe. Feynmann didn't end up in prison, he got a Nobel Prize for some of his later work. Feynann's method was very simple. 1) He read the f***ing manual, 2) he tried the default password, 3) he left a note suggesting that they change the password. This is an almost perfect analogy to the white hat hacker. In a perfect world, I would argue that Gen. Grove should have been severely repremanded, with the understanding that similar elementary security failures would result in dismissal or even court martial. He should be allowed to learn from his mistake, but he darn with better not do it again.

The intent of Gen. Grove's safe was to protect the data of the Manhatten Project. By breaking in, Feynmann improved security.

Re:Here is an example of a break in

[NMagic]

Am I the only one that thinks this is just a silly comparison? Just because 1 guy broke into something with a good outcome to it, doesn't mean safe cracking should be made legal. it's the same damned thing with computer security.
  That said, I truly believe there's nothing wrong with a CONTRACTED professional coming in and testing the limits of systems. there are definite, good alternatives to this form of hacking, and thinking this is the only way to improve security is ludicrous...

Amazing... Student written huh?

[sarlos]

Does no one else here see the glaring hole in this person's argument? There is no such thing as a beneficial virus, worm, or trojan, period, end of story, thank you, have a nice day. Information Security is commonly accepted as a three-part problem: Confidentiality, Integrity, Avalability. Even seemingly innocuous viruses carry huge costs, mostly in the form of hindering Availability. Further, as a System Administrator, how can you ever be completely sure a virus that compromised a system was 'benign?' Answer: You can't. The only safe bet is to restore the system from the last safe backup.

The problem is akin to the broken window problem in economics. Sure, exploiting security holes leads to more fixes, but you have to take into account the costs. Further, this does not mean Information Security itself is improving, it simply means virus, trojan, and worm writers have to become more creative.

In short -- if this is what Harvard is producing these days, maybe it's time we re-asses the "Ivy League."

Wait...

[andrewman327]

So you're saying the the DMCA might go a little too far? Impossible! The TV man told me it was good that those evil hackers were getting in trouble.

[Puts on tin foil hat to keep war drivers from reading his thoughts.]

Congress doesn't like us

[andrewman327]

I worked for a congressman who is very interested in tech issues. Sadly, he was (and is) outnumbered by politicians who seem to think that everyone who can code or ping is inherently a threat. As much as I love America, the government has a lot to learn about technology. Case in point: Howard Dean should not have been one of the first candidates to leverage the Internet over a decade after the invention of the WWW!

This is an actual quote from another member of congress: "What gives consumers the right to choice?" This was followed by a rant about people not deserving choices in telecommunications.

It's easy to immunize the internet...

[Rich7ejr]

... just kick all the homeless people off of it.

Re:No, but it doesn't mean to be a stupid victim

[vertinox]

So bank robbery is good for their security and should be encouraged? Everyone who moves to a new city should be immediately mugged so they can learn valuable lessons about personal security? Perhaps there should be an official quota of licensed murders so people don't get too lax about their own safety?

Look... I live in a city which has had over 300 murders last year, god knows how many rapes, and roberies are common place.

Not to exscuse the criminal, but these things happen and that is why most banks here have bullet proof glass, houses have bars over them, and you are going to be called a fool for walking around town at 2am with more than $100 of cash on you.

Think of it like this. You can't control the criminals if and when they strike, but you can minimize the damage if they try. Its like installing anti-virus programs before you get the virus or maybe just using OS X.

Uninvited entry should be punished.

[x-vere]

This whole debate about black hats, grey hats, etc. is ridiculous. I don't give a crap about itension for the intrusion. If I didn't invite you to break into my system, then you're trespassing and should be punished. I don't care if you've told me about it or not. Now, if you stumble and only stumble (As in not go any farther than to point out a potential weakness and not go snooping), that's different. You haven't actually hacked. When you cross that line, you've screwed yourself and should be punished.

Re:Uninvited entry should be punished.

[dodobh]

Will you (and your employer) take responsibility for all criminal breaks into the computer systems? As in, serious jail time?

Because if your systems get broken into, and my identity gets compromised, I will want to hold you responsible for all damages resulting from your negligence. This includes financial payments to the full extent of any financial and/or social loss suffered by me (and everyone else who has had their identity compromised), and jail time for the administrators who failed to secure their systems and the managers responsible for the implementation, starting from the board. Personal liability for all shareholders.

This includes people violating your policies and taking work home on unsecured laptops. Data loss from laptop thefts as well.

You want to see people breaking in punished? Fine by me. I want to see you punished for failing to implement sufficient security. Would that be an acceptable compromise?

Re:Uninvited entry should be punished.

[x-vere]

And for this you would yourself compromise a system, grab a few vunerable records for proof and then send it to me or just assume that I'm too arrogant to listen to my own short comming and post the vunerablility on a forum somewhere so everyone and their brother could check it out...

This is like checking to see if your neighbor's door is open, entering (without permission) because it's unlocked, and grabbing a twenty off my table just to makesure no one else took it. Doesn't make sense.

Your comment about unsecured laptops etc. is fine and dandy, but you make an assumption that adaquate security measures aren't already attempted to be in place.

Instead however, how about we insist on the importance of system security and the importance of a pofessional security analyst in an IT shop and if a company is illegally negligent, charge their asses.

Re:Uninvited entry should be punished.

[dodobh]

My point is that you are barking up the wrong tree in the first place. As an end customer, I only care about you delivering real security. As an admin, I only care about delivering real security.

See, I don't care about the money you spend on securing Windows, or Linux, or other operating system of choice. If I don't see code and configuration audit results, you are pretty much screwed.

Grabbing data and making it public? That is wrong. However, if I find that your site is vulnerable to SQL injection, and I don't notify you, that would be wrong of me. I don't go about directly attacking sites, but I do use special characters in a lot of places. If one of those makes it likely for me to see something which results in me suspecting such a vulnerability, I would like to be able to prove to myself that the site is secure (or not).

I don't want to be paid, I just want you to fix your configuration. Threatening to sue me only makes it likely that I won't report such issues to you at all.

Note that my employer treats all reports seriously (I have seen two in two years, both patched within hours).

It's a good point...sufficient?

[HiThere]

The problem is that threat analysis judges people by what they can do, not by what they are assumed to want to do. So someone who knows about a hole in your system is a threat! They must be STOPPED!

I can see that it might well be more rational to judge people by the damage they do or can be shown to have been attempting to do, but that requires judgement. And it's always safer to say "It's HIS fault!", then to acknowledge that you may have made a mistake.

So I don't see things getting better or saner. People with power always want to make the scape-goats suffer publically. And there are MANY who deserve no better. Commercial and espionage groups (including criminals) making use of spyware, viruses, etc. don't deserve ANY sympathy. This doesn't mean that most users fall into this category...but these days if I see an unlocked car with it's lights on...I quickly walk past. I no longer try to either turn off the lights or contact the owner. It's (seen as?) too dangerous.

So it's not just an internet phenomenon. This is happening throughout society.

Filtering trojans and zombie traffic at switch?

[mattr]

When I saw this headline I was thinking. While it is impossible to get every host clean, it is certainly possible for a quickly reacting organization to do the following:

1.detect malware, viruses, crackers, zombie traffic, etc.
2.define an identifying pattern and critical data segments to be destroyed
3.diffuse this info to major routers and other servers on the net around the world
4.ISPs and smart individuals can also subscribe to the data feed
5.Routers and firewalls use this feed to filter out (or rewrite with random info) dangerous packets, effectively defanging all known dangerous files or communications.
6.A common ontology and method for distributed discovery and reporting is implemented to accelerate the whole thing and federate all the antivirus companies and anti-espionage agencies to try and solve the problem transparently.

This way the infrastructure becomes first line of defense,
The ISPs are the second line,
Individuals' PCs and maybe firewalls in businesses/schools/dwellings are the third line.
Researchers who have a reason to send dangerous things to each other can encrypt them.

I am eagerly looking forward to one of those forms about why this can't be done. It seems like the obvious answer to these totally disorganized, unfederated Internet storm centers and virus advisory sites.

Whatever zombie communication and malware is left on the net will then likely be focused near where it was injected, so if nothing else a filter on outgoing data could possibly even detect the workstation from which it was injected in the first place! (though this is probably a wifi hotspot anyway.)

Maybe the government is doing a little of this already? Too much to hope for, I expect they are more interested in reading people's email and using malware to engineer entry points for themselves, than to actually defang the wild. But it's a thought.

Author voluteers for medical treatments....

[Anonymous Coward]

in order to make his immune system stronger because HIV, and West Nile Virus are good for him in the long run!

Not TRUE immunization

[Spy der Mann]

As computers in China and other asian countries are infested with botnet software, DNS servers and ISPs in general still don't block IP-spoofed packets.

This makes the US a perfect target for a massive DDOS attack. And don't get me started on pirated windows machines in the US, with no patches applied .

Rural versus City versus Transopolis

[abb3w]

On real world, some people want to live with his doors unlocked, mostly on rural areas.

Which may not be a bad thing... in rural areas. If the system is connected to the internet, it's like an apartment in a city with a total population larger than that of the top twenty worlds largest cities combined together with the entire population of India. Oh, and with rampant street gangs, a red light district that can be seen from orbit, and residents whose average manners make a Bronx taxi driver look like Emily Post.

If wishes were horses...

[abb3w]

But the irony is...if the Virii/Worms didn't exist in the first place, then we wouldn't NEED to improve security against such attacks.

Well... yes, but no.

There seem two equally obvious and unlikely counterfactuals that would preclude the existance of Virii/Worms. First, that computer systems security would be improved to the point where they were no longer possible. Second, that humans would no longer be motivated to develop them.

We could get a lot closer to the first state than we are at now; requiring the use of provably correct code in everything, zero defect tolerance in hardware, perhaps other measures. It's unrealistic, and you'd still have to do provable correctness of interaction each time you added a new software component to the system. Yes, hacker attacks can be expensive... but the probable cost-benefit analysis makes proven correct systems economically impractical.

As for the second... well, pigs are more likely to fly out of my butt, and I'm not going to invest in pork futures on that basis.

TFA is trying to distinguish from the sort of mischief-makers that create the digital equivalent of the Common Cold (annoying, but seldom serious) from those who work to create the digital equivalent of Ebola. And yes, it might be worth having lower penalties for hackers who are not operating from economic motives, or for those operating from political motives who are more nuisance than harmful.

The largest part of the problem is that a lot of software is crap from a security standpoint (in part, because building good software is hard). Perhaps a set of Federal software whistleblower laws should be created for commercial products. My first pass at the idea: The law should guaranty buyers the right to reverse-engineer software to investigate it for security, regardless of any EULA (IE: you can look); create a federal clearinghouse for the reporting of any discovered security hole, with such reports being inadmissible as evidence for any civil or criminal case (IE: we won't threaten you with prosecution for reporting holes); have the federal clearinghouse report the nature of the holes found to software manufacturers; and require that for any product released within five years, manufacturers must (a) within 90 days of being formally notified, offer consumers without charge either a patch, an upgrade to a current unaffected version, or the option to return the product for refund of original purchase price, and (b) within 180 days of being notified, provide without charge a patch or a free upgrade to an unaffected version if such exists, or be required to issue a mandatory recall for the product and become legally responsible for consequential damages (IE: fix it or be f---ed, Billy).

taken from the 'Bantown manifesto'

[Anonymous Coward]

Now, let us say you have a machine connected to the Internet. It is impossible, by this computer's very nature, for it to do anything that is was not programmed to do. It takes in the data that it is given, processes it according to deterministic rules, and returns output that it could not possibly have deviated from. This process may be so complex that it appears to be stochastic, but it is nonetheless deterministic and we should not pretend it is anything but. This deterministic sequencing extends far beyond just your computer. If every element in a system is deterministic, then the whole system itself is deterministic. The entire Internet is a single, uninterrupted deterministic state machine.

I present to you the Eleatic school of hacker ethics.

The Internet is public property. No establishment has a right to own it, subvert it, subject it, or rule over it. It extends beyond race, nationality, religion, or geopolitical agreement. Now that we understand that the Internet is a single deterministic machine, we may approach this situation with logic and reason as opposed to knee-jerk reactionary idiocy. When connected to the Internet, your computer becomes a part of this deterministic machine. It is impossible for your computer to execute any code which it has not been programmed to execute. If your computer has been programmed to accept my arbitrary code, then there is no moral or ethical violation committed when I introduce my code to yours.

If you download and execute my code, you have done so willingly.

If your daemon executes my code after I introduce it in a manner that is innovative and unique, then your daemon has done exactly what it has been programmed to do.

You don't want me to execute my code inside your code? Then keep your machine out of OUR deterministic state machine. Keep it on your own private network, so that someone will have to commit a real honest-to-God crime like breaking and entering to have access to it. The minute you connect it to a public network, it becomes connected to all of us through the 0 and 1.

Re:taken from the 'Bantown manifesto'

[tomhudson]

Your original premise has a few flaws:

The entire Internet is a single, uninterrupted deterministic state machine.

No, its not. Its neither single, nor uninterrupted, nor deterministic.

Its not a single state machine, because its not a single machine. By definition, the Internet is a collection of machines.

If you tried to push that analogy in any other field, the BS quotient would set alarms off immediately. For example, if you tried to say that people are a single person because all their interactions are connected, people would go, "yeah, whatever ..."

Its not an uninterrupted state machine, nor a deterministic state machine

As an aggregate of hosts, it literally ceases to exist in its current form as individual hosts drop off or connect. The fashion in which this happens is far from deterministic, since its under the control of all sorts of people - from the bubble-gum-chewing pop-tart-wannabe on myspace to the parv stalking same. Since the individual components actions are non-deterministic, the Internet is non-deterministic. Noboday can determine, even with a snapshot of the WHOLE Internet at point T in time, what will be happening at T+5 seconds.

Your argument, on the other hand, is a good example of GIGO - start with a flawed premise, produce a flawed result.

You even make my point when you state this:

If you download and execute my code, you have done so willingly.

... that the actions of the Internet cannot be predetermined because the the presence of you - a human being, who does not work in a deterministic fashion.

... and since YOU have added people to the equation in your argument, then I am allowed to add the argument that your statement about "willingly" requires informed consent. Informed consent requires full knowledge aforehand, not what you get when someone tries to do an anal probe on a server.

Your last argument also makes the point that people are the true owners of the net - when you say "OUR" machine - and people have the right to say how they want their property to be used, even in public spaces. If you don't believe that, please give everyone your address - I'm sure someone will be happy to rob you when you're in public, then present your own arguments as justification that you gave implicit permission by your very presence in public.

"Responsible" disclosure is terribly shortsighted

[grosskur]

From the article: “Hackers should be given incentives to reveal the security vulnerabilities they find in a responsible manner.”

Responsible? The security vulnerability is not the fault of the person who discovers it! It is the vendor's fault. Security will not improve if we continue to keep information secret and shield vendors from their mistakes. Security holes are not some kind of naturally-ocurring phenomena, nor are they something to hide from. They are the fault of vendors who do not invest the necessary effort to develop secure software. Publishing security holes publicly punishes these vendors, and gives them an incentive to improve their practices. Yes, there may be short-term pain as a result. But it's the only way to improve security in the long-term.

Wow, I guess we all matter...some.

[AriaStar]

Except Rob Malda ("Remember the days when "getting Slashdotted" was every sysadmin's worst nightmare? Referrals from the "News for Nerds" website would send so much traffic to websites that many crashed. But for those that survived the flood, it was the online equivalent of a papal benediction. Today, the buzz has moved elsewhere. Slashdot's editor-driven story selection model is being supplanted by user-generated systems such as Digg. According to recent Alexa data, Digg already has more daily reach and generates more page views than Slashdot. Malda knows his subject, and he's a good editor, but in the end, he's just no match for the power of the multitudes."). He's on there. But the rest of us I suppose are a bit more important. Ain't it nice to be appreciated?

Err, not quite...

[Anonymous Coward]

It's true that what doesn't kill you may make you stronger. But that's not much consolation if it manages to kill you.

So no, I'm not going to go around stepping on rusty nails in the hope that it won't kill me and will make me stronger, thank you very much.

Wrong

[Kludge]

And claiming that a certain amount of malware going around helps security measures stay alert is silly. The analogy with living organisms and biological malware is way off. Computer malware doesn't thrive in the wild, mutating randomly. It is powered by misguided humans and by misguided blacklisting approaches to security.

The analogy with living organisms an excellent one. More and more research shows that immune systems or rats and humans (and probably other organisms) are stronger as they exposed to infections. Children and rats who grow up in conditions too clean are more likely to get allergies and asthma as adults.

Whether the malware is human created or mutated randomly in the wild is inconsequential. It makes our systems stronger.

Re:Wrong

[Crayon Kid]

The analogy with living organisms an excellent one. More and more research shows that immune systems or rats and humans (and probably other organisms) are stronger as they exposed to infections. Children and rats who grow up in conditions too clean are more likely to get allergies and asthma as adults.

I don't deny the validity of the theory when applied to living organisms, but I deny its relevance when applied to computers. Living macro- and micro-organisms react to each other naturally. As we get exposed to new bacteria and viruses, our immune systems adapt by themselves.

That's nothing like computer security and malware. They don't evolve naturally, they are both the result of human thinking and intentions. As a consequence, there's no natural balance involved. Either side could make a breakthrough at any time, all it takes is knowledge and determination.

One could argue that a living microorganism could make a breakthrough as well, and cause a pandemia, like the bird flu virus might. Except there wouldn't be any sense of purpose involved, no malice, only random mutation. If you want a 100% valid analogy then consider a biological weapon, developed by humans against humans, with an express purpose of distruction. That's how bad computer malware can potentially be.

the window

[John Frink]

And I believe that throwing a rock through a window is good for business too since it employs the windowmaker, the policeman, and also creates publicity for the store that has a broken window.

Re:Uninvited entry should be punished-- and me too

[Halvy]

how did you make it through life.

why don't you tell us your addy so we can break in, without telling you, since that would apparently please you as much as someone tipping you off about an open door.

your the kind of nut we'll read about, who shoots an innocent citizen neighborhood watch group volunteer, for trying your door, finding it open, with you having pieces of ham sandwhiches and potatoes chips bouncing off your humongous beer belly, while you quickly draw your penis extention (pistle) and shoot the poor bastard.

btw, don't answer, i'm not interested.

-- /. is digging its grave :(

Harvard must have low standards...

[reanjr]

Yes, just like giving someone small doses of poisons to build up immunities should be encouraged for their own safety. This guy is an idiot...

Re:Harvard must have low standards...

[chawly]

He is just slightly unwell, maybe. I hope so, for his sake.

Re:Right.... and RIGHT AGAIN!!

[Halvy]

Right right..just like having someone try to break into your house makes you safer.
NO it is NOT just like that... at all, child.

-- Sorry for feeding the troll everyone, someone has to :)

Re:A little knowledge is a dangerous thing...NOT.

[Halvy]

The real solution is not to allow "ethical hackers", but rather to provide economic incentives for companies to protect their data. If this were the case, then companies would take security seriously, and there would be a whole thriving sector of legal security probing companies (which exists in a very tiny manner today)

Uhhh, I thought companies, by nature, have an 'incentive' already? Called: Profit?

You are trying to say we need laws, even tho there already are laws!

And there IS already a 'whole thriving sector' of security probing people out there, but the Feds are trying to stop them!!

Well imagine that, companies WON'T handle security, the pigs (Feds) CAN'T, but they don't want white hat hackers showing the world this fact!!

Geee, another post that was mispelled when modded, should have been: Score: -5 InCiteful.

-- The Jewish-Mafia, must be and will be, stopped, at all cost, bar nothing.