Slashdot Mirror
Dutch Gov't Offers Guidance For Responsible Disclosure Practices
An anonymous reader sends this quote from an IDG News report:
"The Dutch government's cyber security center has published guidelines (in Dutch) that it hopes will encourage ethical hackers to disclose security vulnerabilities in a responsible way. The person who discovers the vulnerability should report it directly and as soon as possible to the owner of the system in a confidential manner, so the leak cannot be abused by others. Furthermore, the ethical hacker will not use social engineering techniques, nor install a backdoor or copy, modify or delete data from the system, the NCSC specified. Alternatively a hacker could make a directory listing in the system, the guidelines said. Hackers should also refrain from altering the system and not repeatedly access the system. Using brute-force techniques to access a system is also discouraged, the NCSC said. The ethical hacker further has to agree that vulnerabilities will only be disclosed after they are fixed and only with consent of the involved organization. The parties can also decide to inform the broader IT community if the vulnerability is new or it is suspected that more systems have the same vulnerability, the NCSC said."
"Responsible disclosure" is nice. But what about holding banks and businesses responsible for the harm they are causing when their security practices fail? What about the worry and wasted time they cause to customers? What about compensating the victims of identity theft due to sloppy security practices? Businesses seem to be able to screw up arbitrarily without a lot of consequences right now.
"Responsible disclosure" means "We don't want to bother fixing it." If the vulnerability is not make public, it is never fixed. This has been done many times before. The only way to get them fixed is to make them public.
Don't stop where the ink does.
There are only two things I hate in this world:
People who are intolerant of other people's cultures... and the Dutch.
To all you virgins: Thanks for nothing.
Seriously? Who's going to consent?
Also, where's the responsibility on the part of the organization to show that they *HAVE* a secure coding practice, they don't simply outsource $2 coders, and they have a program in place to review security issues?
Fewer dope heads than in the US!
You crazy Dutch bastards!
http://www.youtube.com/watch?v=lITBGjNEp08
Do they have any suggestions for what to do if a vulnerability is discovered and reported to the involved organization, and the organization ignores it?
That seemed like one of the trickier things to work out with regard to responsible full disclosure. Organizations are often opaque about their security priorities and it can leave researchers on the outside wondering about whether a fix is in the works for a reported problem or not. As vulnerabilities tend to affect more people than the organization itself, whether because they publish software or manage private information, it sometimes presents an ethical dilemma to security researchers about when to go ahead and report a problem to the public without the blessing of the organization involved.
The only way I'd accept the "only disclose to the owner" condition is if it included a time limit within which the owner must either fix the vulnerability or disclose the vulnerability to the public, and if the owner fails to meet the limit the confidentiality is lifted and the hacker is free to disclose the vulnerability himself. If software makers want their mistakes kept confidential then the cost is a binding commitment to fixing those mistakes, and the penalty for failing to meet their commitment is that the hackers are freed from theirs.
Most likely scenario for Security, Dick:
1) Criminality. Failure to ensure funding from reputable companies forces these folks into blackmail or abuse of disclosure process. Eventually, they end up behind bars.
2) Corrective collective: Companies never give out freebies, but well-behaved security researchers have far more fun not being chased by police and get all the chicks. This creates a role model. You should see Bruce Schneier at rave parties.
And what about a discovered social engineering v11y.
The problem is that the definition for hacking is overly broad. If you enter an URL in the address bar, and change just a serial number in the URL, it is considered hacking. Like finding Queen Beatrix's Christmas speech before it was officially published http://www.nrc.nl/nieuws/2012/12/25/hacker-kersttoespraak-van-geen-kwaad-bewust-tijdens-strafbare-actie/ (in Dutch). Or proving access to medical files by MP Henk Krol http://nos.nl/artikel/447718-krol-vervolgd-om-hacken-dossiers.html (in Dutch).
IT journalist Brenno de Winter calls the guidance useless. "If hackers first have to report the vulnerability, they lose their anonymity without having a guarantee that they will not be prosecuted. And even if a company promises that it will not press charges, the Public Prosecutions Department can start a case." Link here: http://www.trouw.nl/tr/nl/5133/Media-technologie/article/detail/3372108/2013/01/04/Richtlijn-ethisch-hacken-lost-niets-op.dhtml (in Dutch).
But not running the country. Instead, they are in the gutters, and in your house while you are away working hard. They migrate to cities like Portland and Seattle. Many sickos. Disgusting. I can't imagine a whole country like that, no matter how small, how insignificant, or how odd the footwear.
That's the only thing that really counts, and it's missing. The Public Prosecutions Department has absolutely no obligation to follow these guidelines.
Companies will never give consent, and will only use that, to hide from customers, how shitty their software is! In other words: FRAUD!
And I want to know that there is a security hole, and close it, *right when it is found*! Not half a year later, when the fix is out, after some Russian kid used it for his botnet for *months*! That is *deliberately* endangering me! Another CRIME. (And on top of it, assistance in the botnet operator's crimes!)
NOT ACCEPTABLE! From the security standpoint of the customer.
The article lists a number of actions that the hacker shall not do. Most are to be expected, such as not modifying the system, not bringing it down, not exposing private information. The first and last points in the list are strange though:
Eh? Why are these not valid attack vectors?
I think you can see the effects of these guidelines after a company decides to prosecute an ethical hacker (provided the hacker has followed the directive) and the court of justice has favored the ethical hacker. After that _first_ directive-following ethical hacker has a favored court ruling a general consensus in the commercial world will make it's first mentality swing among ICT dept's. I agree these guidelines do not solve anything, but they can at least service the community of companies and ethical hackers that are open to this way of 'doing business'. At least now there are guidelines to hold on to (or shoot at).
I wonder which directive-following ethical hacker is brave enough to willingly to put him/herself out on the line and which company is encouraged enough to decide to prosecute that hacker.