Slashdot Mirror

← Back to Stories (view on slashdot.org)

Security Researchers Threatened With US Cybercrime Laws

Posted by Soulskill on from the building-inspectors-threatened-with-arson-laws dept.

An anonymous reader writes "The Guardian reports that many of the security industry's top researchers are being threatened by lawyers and law enforcement over their efforts to track down vulnerabilities in internet infrastructure. 'HD Moore, creator of the ethical hacking tool Metasploit and chief research officer of security consultancy Rapid7, told the Guardian he had been warned by U.S. law enforcement last year over a scanning project called Critical.IO, which he started in 2012. The initiative sought to find widespread vulnerabilities using automated computer programs to uncover the weaknesses across the entire internet. ... Zach Lanier, senior security researcher at Duo Security, said many of his team had "run into possible CFAA issues before in the course of research over the last decade." Lanier said that after finding severe vulnerabilities in an unnamed "embedded device marketed towards children" and reporting them to the manufacturer, he received calls from lawyers threatening him with action."

156 comments

  1. OK, Whatever... by Frosty+Piss · · Score: -1

    industry's top researchers are being threatened by lawyers and law enforcement over their efforts to track down vulnerabilities in internet infrastructure.

    Yes, it's surprising when companies get bent out of shape when random "security researchers" hack into their systems uninvited.

    Sure, it's nice to know if you are vulnerable, but still, it is difficult to take at "face value" when some random "security researcher" claims to have altruistic aimes when caught hacking your network...

    --
    If you want news from today, you have to come back tomorrow.
    1. Re:OK, Whatever... by Anonymous Coward · · Score: 0

      You didn't read the article.

    2. Re:OK, Whatever... by sinij · · Score: 4, Insightful

      Not "caught hacking", this implies you know about the problem or had a way to detect this post-fact. Most of the times it is "hey you have a problem" followed by OMGLAWYERS idiotic response. Last time I checked lawyers were rather ineffective at patching vulnerabilities, doing root cause analysis, or improving your organization's security posture and/or practices.

    3. Re:OK, Whatever... by Frosty+Piss · · Score: -1, Troll

      Most of the times it is...

      No, that's not so, and you know it. Usually it's some basement dweller who hacks into some system, downloads a shit-ton of data, and after getting no response from the bottom tier Help Desk, publishes it in the Intertubes in an attempt to get "street cred" as a "security researcher".

      --
      If you want news from today, you have to come back tomorrow.
    4. Re:OK, Whatever... by thaylin · · Score: 4, Insightful

      So you should have to be invited to test to ensure that the systems are secure from exploits? Under that philosophy the black hats will win almost every time.

      --
      When you cant win, ad hominem.
    5. Re:OK, Whatever... by Anonymous Coward · · Score: 0

      Putting scare quotes around "security researcher" or adding the adjective "random" does nothing to convert first class security researchers such as H. D. Moore into a script kiddy. Seems to me that reporting a discovered vulnerability to the manufacturer is pretty good evidence that the researcher's motives are pure.

      You learn a lot about people and organizations when you point out their own fuckups to them.

    6. Re:OK, Whatever... by sinij · · Score: 1

      First, if anyone can get to your "shit-ton of data" you are not doing it right, and in your organization's CIO is a honorary title.

      Second, the act of publishing is problematic, maybe even the act of downloading, no the act of accessing your system in proof-of-concept.

      Third, if someone trying to report a problem to your organization and does not have an easy way to do so, then it is yet another failure that you should address.

    7. Re:OK, Whatever... by Anonymous Coward · · Score: 0

      Maybe he should get a few babies killed instead - anonymously of course. Maybe they'll listen then.

    8. Re:OK, Whatever... by MightyMartian · · Score: 1

      Remember the old days when motive was a substantial part of a court's consideration of an alleged illegal act.

      But that was in the days before lawyers became gods on earth.

      --
      The world's burning. Moped Jesus spotted on I50. Details at 11.
    9. Re:OK, Whatever... by geekmux · · Score: 1

      industry's top researchers are being threatened by lawyers and law enforcement over their efforts to track down vulnerabilities in internet infrastructure.

      Yes, it's surprising when companies get bent out of shape when random "security researchers" hack into their systems uninvited.

      Sure, it's nice to know if you are vulnerable, but still, it is difficult to take at "face value" when some random "security researcher" claims to have altruistic aimes when caught hacking your network...

      Why, because it's so difficult to believe these days that any system would have vulnerabilities that need to be addressed?

      Perhaps I would question the source a bit, but being alerted via email isn't exactly the standard Way of the Black Hat. They prefer you find out the hard way, and given that fact alone, I'd probably put some value on the face of the notification.

      The legal reaction described is quite pathetic. Hiding behind your lawyers instead of trying to look into an identified problem isn't going to bode well long-term. And hiring a dozen more of them isn't going to get customers to buy your shitty, broken product you refuse to fix.

    10. Re:OK, Whatever... by Jawnn · · Score: 1

      but still, it is difficult to take at "face value" when some random "security researcher" claims to have altruistic aimes when caught hacking your network...

      Why bother? The script kiddies are rattling the doors all day, every day. That noise is always there. One more visitor, or ten, isn't going to make a difference in our threat posture. And if one of those visits results in a discovery that we all benefit from, so much the better.

    11. Re:OK, Whatever... by Anonymous Coward · · Score: 1

      These are all business decisions. Fact of the matter is that every business owner needs to make a calculated decision on whether or not to fix a known security problem (or any bug for that matter) based on the cost/benefit. They may decide that the likelyhood of being attacked, cost of damage, value of data that could be stolen, or otherwise is simply too low in comparison to the cost of fixing the issue. This may or may not be true, but any ethical "security researcher" should allow that company to make that decision without holding them hostage with the damaging information. Every system is vulnerable. It's aways a question of how much money is it worth spending to make it less vulnerable.

    12. Re:OK, Whatever... by Anonymous Coward · · Score: 0

      So you should have to be invited to test to ensure that the systems are secure from exploits?

      Do you really need to ask? Should I need to be invited to find out if the locks on your front door are sufficienty resistant to being picked? The door is locked. Leave it alone.

    13. Re:OK, Whatever... by sinij · · Score: 3, Insightful

      All of this is valid, but also myopic In most vulnerability situations, especially involving data at rest, you have costs to the business and costs to general public that usually exceeds first figure. Just because your organization is not held financially liable for compromise, does not mean that such compromise did not cause significant damage to third-party.

      For example, a SCADA system that your organization maintains got compromised. Fixing such system vulnerability will be inevitably expensive, and simply sending out a technician to reset it would generate billable hours. Your business interest are to ignore this problem, but imagine if this system is part of water treatment system for large residential neighborhood.

      Business needs worship is a flavor of 'market will fix it' fallacy. It only works if all players are forced into making moral decisions.

    14. Re:OK, Whatever... by Anonymous Coward · · Score: 1

      Your business interest are to ignore this problem, but imagine if this system is part of water treatment system for large residential neighborhood.

      This was exactly my point. It is a business decision of cost/benefit. If that SCADA system is just part of your office building's HVAC control, you would probably be wise to leave it be since the likelyhood of anyone attacking your air conditioning is low and any fallout cost would be relatively low. If it's controlling a nuclear power plant, that's another story. It is the responsibility of the business to make that call.
      Let me put it another way. If you tell a homeowner that their front door lock is unusually vulnerable to being picked, first of all they should sock you in the face for trying to pick their lock (before they call the police), and second you should not go publishing that information if they choose to not fix it.

    15. Re:OK, Whatever... by Jason+Levine · · Score: 5, Insightful

      Last time I checked lawyers were rather ineffective at patching vulnerabilities, doing root cause analysis, or improving your organization's security posture and/or practices.

      They're very effective. To paraphrase Futurama:

      Documentary Narrator: Fortunately, our most expensive lawyers sued the security researchers and shut them up. Of course, the security holes are still there, we just sue anyone who talks about them. Thus solving the problem once and for all.
      Suzie: But...
      Documentary Narrator: Once and for all!

      Sadly, too many companies don't see this as a joke, but as a valid security vulnerability response strategy.

      --
      My sci-fi novel, Ghost Thief, is now available from Amazon.com.
    16. Re:OK, Whatever... by sinij · · Score: 2

      What happens if lock picking the front door in your hypothetical example also has a chance to unlock everybody's front door or would make it harder to lock all neighbor's door? Should the homeowner in such scenario be allowed to make decisions for the rest of the neighborhood?

      Flaw in your examples and analysis is that you view each individual networked system in isolation. This is not how Internet works. Every compromised system makes it less safe for the rest of us.

      Fix it or take it offline.

    17. Re:OK, Whatever... by NatasRevol · · Score: 1

      And by companies, you mean the US gov't in this case.

      --
      There are two types of people in the world: Those who crave closure
    18. Re:OK, Whatever... by pr0fessor · · Score: 1

      If you want to research how a deadbolt fails buy one test it and send the results to the manufacture. If you break into the manufactures warehouse to test the deadbolts or someone's house you are going jail.

      Yes, either you are invited as a consultant or you do your research in a controlled environment but not on someone else equipment without permission.

    19. Re:OK, Whatever... by NatasRevol · · Score: 2

      Black hats are always ahead already.

      Everyone else is just trying to keep up, or at least not drown.

      --
      There are two types of people in the world: Those who crave closure
    20. Re:OK, Whatever... by Anonymous Coward · · Score: 0

      If you set up your door to be potentially unlocked by mine, that's your problem. And it is definitely not the problem of some stranger. If I set up my door to unlock yours without asking, you should sue me. If I did it with your permission, you're foolish if you didn't require that you would be allowed to audit me regularly and cancel the agreement whenever. Now get off my lawn.

    21. Re:OK, Whatever... by sehlat · · Score: 2

      Consider that lovely phrase cost/benefit. We're talking *perceived* cost/*perceived* benefit.

      As far as TEPCO executives were concerned, the cost of protecting Fukushima Daichi
      was enormous, while they could pooh-pooh the possibility of an earthquake which might
      need such protection.

      Such costs can be reasonably estimated, so perceived cost closely equals actual cost.
      However, earthquake probabilities are much easier to dismiss, so it is easy to have
      perceived benefit MUCH lower than actual benefit when the earthquake shows up.

      Security costs have much the same problem. You can't say for certainty that someone
      WILL find a way in if there is one,, so...

      "Son, the guards we hire for our caravans look like a loss on the books. But the books
      don't show the losses we'll take if we're hit by bandits."

    22. Re:OK, Whatever... by LifesABeach · · Score: 3, Interesting

      "...embedded device marketed towards children" and reporting them to the manufacturer, he received calls from lawyers threatening him with action."

      It's OK, it's for the children!.

    23. Re:OK, Whatever... by Anonymous Coward · · Score: 0

      Incorrect analogy.

      More like only one of these locks was ever produced. You're not invited to test it or make suggestions about it or even see it but it's used to lock up a warehouse that contains copies of your financial records and naked pictures of your mom. The lock happens to be a broken off twig shoved through a shackle.

    24. Re:OK, Whatever... by clovis · · Score: 2

      I think it is OK if someone drives down the street and identifies houses that leave the front door open and report on what they see.
      That is, so long as they do not go through the door. That would be a crime.

      People who leave the door open are enabling and encouraging criminal activity. Oddly enough, I was in a museum just this morning reading some translated Sumerian cuneiform. It was some laws that addressed just this problem. If someone leaves a property unmaintained and it attracts criminals, then that property owner becomes responsible for any thefts occurring next door.

      People who have vulnerable systems on the Internet similarly are responsible in some degree to the huge botnets that are often such a plague.
      People who identify vulnerable systems are doing us all a favor, and as far as I can tell, they are not committing a crime. The law has a concept called "mens rea", which I do not fully understand, but the concept seems to be that if you do not intend harm and do no harm, then there is no crime.

    25. Re:OK, Whatever... by ArhcAngel · · Score: 3, Funny

      First, if anyone can get to your "shit-ton of data" you are not doing it right

      Then my company is doing it right...Not even the employees can access their own data.

      --
      "A person is smart. People are dumb, panicky dangerous animals and you know it." - K
    26. Re:OK, Whatever... by Anonymous Coward · · Score: 0

      Do you really need to ask? Should I need to be invited to find out if the locks on your front door are sufficienty resistant to being picked? The door is locked. Leave it alone.

      Then it becomes a question of practicality. There are people out there who will probe your vulnerabilities (oo-er) for fun and profitssss, and others for the Kudos of finding the vulnerability.

      The latter will tell you about it (and possibly attracting the negative attention of the law) and the former will take your database to bed without first buying it dinner, and probably try and make it do the dishes on the way out (if it can still walk).

      So, persecute the thrill-seekers and you will fall foul of the pleasure-takers.

      Just because something is illegal, doesn't make it wrong and vice versa - there is such a thing as uncommon sense*.

      *re-named for the 21st Century

    27. Re:OK, Whatever... by Anonymous Coward · · Score: 0

      mens rea: "of a/having a guilty mind", it is a sad state of affairs but mens rea is only required for conviction of some crimes. Much of the criminal code requires no mens rea for being guilty (I heard the percetage of crimes requiring mens rea for guilt was only 40% a few years ago, I've no idea if that's true or even verifiable), this is a real problem, because things like intent don't matter for things like possession of child porn, people are literally serving time for downloaded something that was not what it purported to be, immediately deleting it, and in some cases reporting it to the authorities, all because mens rea wasn't required to convict them. It's asinine.

      But you're right, intent should matter, and in cases where a judges' hands aren't tied by how the statute is written, will often come into play. Too many "tough on crime" legislators simply don't care though, they're buying votes at the price of gross miscarriages of justice.

    28. Re:OK, Whatever... by Cammi · · Score: 1

      AKA Script Kiddy AKA Bubba's Toy (as they deserve).

    29. Re:OK, Whatever... by Scarletdown · · Score: 1

      Let me put it another way. If you tell a homeowner that their front door lock is unusually vulnerable to being picked, first of all they should sock you in the face for trying to pick their lock (before they call the police), and second you should not go publishing that information if they choose to not fix it.

      Who says you actually tried to pick their lock. There is a decent chance that your house has the same make and model of lock that theirs does, and when you accidentally locked yourself out, you discovered how easy that particular lock was to pick. Wouldn't warning them about the risk be the right thing to do?

      --
      This space unintentionally left blank.
    30. Re:OK, Whatever... by sjames · · Score: 1

      That depends on who it costs if the security is breached. If it is JUST the company that stands to lose, fine. But if their customers also stand to lose (for example, credit card info, medical records, etc), then no. It is no longer the company's risk to take and their customers have every right to know how poorly their data is being guarded.

      The latter is more common than the former.

    31. Re:OK, Whatever... by sjames · · Score: 1

      Once third parties can be damaged, it is no longer the business' call. Sure, it's their right to ignore the risk that their A/C could get shut off, or that their corporate bank account could be hoovered. However, if the hack could flood neighborhoods with sewage, it is no longer their call, it's up to the people who might get flooded.

    32. Re:OK, Whatever... by SteveTheNewbie · · Score: 2

      Let me put it another way. If you tell a homeowner that their front door lock is unusually vulnerable to being picked, first of all they should sock you in the face for trying to pick their lock (before they call the police), and second you should not go publishing that information if they choose to not fix it.

      How about if I owned the lock and found it was easy as pie to pick, then went to your place and said "oh hey, this is easy to pick, see", pulled my front door out of my pocket and demonstrated to you how easy it was to pick.

      Would you still punch me in the face and call the police on me?

      And how about I then tell the lock maker, give them six months to fix their locks so people have an alternative to upgrade to and then publish my paper I was writing for university (I was doing a thesis on how shitty locks on every day homes are), which, while highlighting the problem, doesn't give exact details on how to take advantage of said shitty lock, would it be fair for the lock company to sue the pants off me instead of fixing the locks to make everyone safer?

    33. Re:OK, Whatever... by Anonymous Coward · · Score: 0

      Here's the failure with this stupid analogy. The lock on the door isn't guarding your stuff in your house. It's guarding my stuff in your house and you're failing to properly secure my stuff in your house, and everyone who has stuff in your house. That's a public issue, not a private one. You've been careless, and you can either fix it, or you should be forced to compensate EVERYONE for your failure to perform adequate security.

    34. Re:OK, Whatever... by jc42 · · Score: 4, Interesting

      First, if anyone can get to your "shit-ton of data" you are not doing it right

      Then my company is doing it right...Not even the employees can access their own data.

      Heh. That doesn't even mean you're safe. I recall a project back in the late 1980s, when I was part of a team hired by a big company (who shall remain unnamed so you'll suspect it was your company ;-). We'd had a few discussions with "top management" who'd hired us, about their problems with the DP department. Their computer folks effectively owned the data, and all access was mediated by the DP department. There was a lot of information that was there, but management couldn't get at it, because the DP folks feigned an inability to provide it.

      One evening, a bunch of us decided to stay around after hours. We went to work on their big (IBM of course) mainframe, and in the morning, we demoed to management that we could read any file on their machine. Our demo included a few reports we'd printed out that got wide-eyed reactions. We'd given them access to all of their own data, and they were very happy with us. We stuck around and provided them with a lot more reports ("over the dead bodies" of some of the DP department ;-).

      Some time later, we discussed in private the question of what we should tell the IBM folks about what we'd done. Our decision was essentially "Nah; they'll just block our current clients' access to their own data and give control back to the DP priesthood. And we have other customers who'll pay us to similarly break into their own data."

      The fact that your own employees can't access their own data doesn't necessarily mean it's safe from outsiders.

      (We never did discuss with them the implication that other outsiders might as easily access their data, if they happened to know the things we did. In the late 1980s, managers at corporate computer installations generally had no concept of a "network" other than as a way to connect remote terminals to the mainframe. There's no way we could have got them to understand the wider implications of the security holes we knew about and exploited for their benefit. It's not obvious that most of today's "management" class has such understanding, either. The current story pretty much demos the extent that understanding. ;-)

      --
      Those who do study history are doomed to stand helplessly by while everyone else repeats it.
    35. Re:OK, Whatever... by Darinbob · · Score: 1

      When you get an email saying you have an exploitable bug in your web site, it becomes extremely difficult to tell if that is someone genuinely caring about your wide in a free and altruistic manner versus someone shaking your down for money or trying to drum up business. If it's a "security researcher" then presentation of credentials will help (ie, name the university being worked at plus peer reviewed papers, not the name of a consulting company).

    36. Re:OK, Whatever... by HiThere · · Score: 1

      Were I to accept that argument, I would be accepting it as a valid argument for assassinating business owners whenever a life threatening problem was discovered. Is that the argument that you want to be making?

      --

      I think we've pushed this "anyone can grow up to be president" thing too far.
    37. Re: OK, Whatever... by Anonymous Coward · · Score: 0

      Mens really is a constitutional prerequisite for any serious crime. But our modern courts have become too deferential to the legislature. In the case of child porn, courts wrongly admit as evidence of mens rea the simple fact that it existed on your computer, and allow the jury to fill in the blanks with a wink and a nod.

      100 years ago people routinely were acquitted of murder--committed in front of dozens of eye witnesses--because courts and juries were much more concerned with your moral guilt--which is what mens rea gets at.

    38. Re:OK, Whatever... by Anonymous Coward · · Score: 0

      If you make sure that the public costs of a breach (say, a messed-up water treatment system) are applied to the company, and through them, to the owners - then yes, the market should fix it.

      To make this happen, we'd need to have hefty government fines applied to the responsible party, as well as eliminating the legal rights of limited-liability companies and bankruptcy.

  2. As it should be by Anonymous Coward · · Score: 0

    Break the law then pay the price.

    1. Re:As it should be by Anonymous Coward · · Score: 0

      Except they aren't breaking any laws.

      Do you think Google was breaking the law when they found the Heartbleed bug? No? Then shut the fuck up and read the article for once.

    2. Re:As it should be by Opportunist · · Score: 3, Insightful

      Now try to explain why it was A-OK for the border patrol to kill the people trying to flee from East Germany because it was the law.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    3. Re:As it should be by Anonymous Coward · · Score: 0

      Wasn't it OK? Is it any different than USA killing afgans with drones? Will you convict the operator?

      Double standards, how nice and comfy they are.

    4. Re:As it should be by Anonymous Coward · · Score: 0

      Death penalty?

    5. Re:As it should be by just_another_sean · · Score: 1

      Where did he say it was OK? I'm an American, and no, I don't think what we're doing with drones is OK. Just because it's a law doesn't make it right.

      --
      Creationist Textbook Stickers Declared Unconstitutional by CowboyNeal
    6. Re:As it should be by Anonymous Coward · · Score: 0

      Where did he say it was OK? I'm an American, and no, I don't think what we're doing with drones is OK. Just because it's a law doesn't make it right.

      As an American, if it was the law, I'd like to see it on unredacted paper. The reasoning and methods for such action, specifically for the US Citizen that was struck, has always been under a veil of vagueness. At least during war time it makes sense, but we haven't officially declared war (done by Congress) since something like WW2.

      A nation is (read "should be") formed under the pretense of protecting its members, or citizens. Everyone else comes second. The death or attack on a foreign enemy is just that, as a nation it does not matter internally and falls into the sphere of foreign politics. A citizen, that has not renounced their citizenship, should have an open court session and best attempts to contact if over seas for court summons. If this had happened and then they declared a death sentence on the person, then the drone strike would be fine. Vagueness can only mean a desire to circumvent the law.

    7. Re:As it should be by Anonymous Coward · · Score: 0

      but we haven't officially declared war (done by Congress) since something like WW2.

      They have declared war "ON DRUGS."
      So if you are friends with anyone who has/uses DRUGS then you are consorting with THE ENEMY, and they have a right to watch you without warrants. /jk

    8. Re:As it should be by Anonymous Coward · · Score: 0

      While changing the discussion from merely "execution and abuse of bad law" to issues like war crimes didn't really help illuminate things, you're making a big assumption. Plenty of people are opposed to the drone war, and would indeed "convict the operator" and the people who gave the orders.

    9. Re:As it should be by HiThere · · Score: 1

      Have they? A declaration of war requires a 2/3 majority vote in the Senate. I don't think they even got that for the "war on terror".

      --

      I think we've pushed this "anyone can grow up to be president" thing too far.
    10. Re:As it should be by Anonymous Coward · · Score: 0

      After 9/11 they overwhelmingly voted for the "war on terror". They did the same for the NSA and other agencies with bills like the Republican led "Patriot Act" which by the way was cleverly named the bill to be more appealing to Americans. And only now are you seeing exactly why people outside of politics were opposed to these types of "exemption laws/bills". Worse yet is there is no war on terror from all the findings and in-depth analysis on the collect data.

      You seem you should've have been old enough to been around over the debate (there really was no debate) in Washington during the most recent Bush Admin,. When they all voted for this. With little to no discussion because they were to worried if they didn't go along with it and vote on Yea on it, people of the country would have voted them out. Again we the people never learn, anything politicians do is solely for their own gain, and to put on a puppet show for the American people "hey kermit, lets pass this half-assed poorly thought out law/bill to make the people rejoice and vote for us and our party"

    11. Re:As it should be by Opportunist · · Score: 1

      For trying to get out of your country?

      Sounds like a good law?

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    12. Re:As it should be by HiThere · · Score: 1

      Sorry, but I don't think those count as "declarations of war". OTOH, after checking the Constitution I see that I was wrong about it requiring a 2/3 vote in the Senate. It seems that no particular procedure was specified. As a result you have a viable argument...just one that I don't accept.

      --

      I think we've pushed this "anyone can grow up to be president" thing too far.
  3. This is what happens... by Ynot_82 · · Score: 4, Insightful

    ...when ill thought out laws are passed.

    In the UK, it is a crime (under the computer misuse act) to test a 3rd party system for vulnerabilities.

    The Heartbleed incident caused a lot of people to break the law testing whether websites were affected.

    1. Re:This is what happens... by Frosty+Piss · · Score: -1, Troll

      In the UK, it is a crime (under the computer misuse act) to test a 3rd party system for vulnerabilities.

      As it should be. You have no right to hack systems that don't belong to you unless you are asked to do so by the owner.

      --
      If you want news from today, you have to come back tomorrow.
    2. Re:This is what happens... by sinij · · Score: 4, Insightful

      If I have no right to access your public-facing system via public channels, then you have no right to be absolved of responsibility of how your system is used by malicious hackers.

      When your infrastructure spams me, or get zombied into DDoSing me, you will be held responsible for spamming and DDoSing me.

      Now, would you like to reconsider your position?

    3. Re:This is what happens... by Opportunist · · Score: 5, Insightful

      So security researchers and/or security reporters in the UK cannot warn about a lot of unpatched webpages in the UK, but hackers all over the globe can hack and abuse them.

      Yeah, makes a damn lot of sense.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    4. Re:This is what happens... by plover · · Score: 1

      Look who you replied to. YHBT. HTH.

      --
      John
    5. Re:This is what happens... by kwiecmmm · · Score: 2

      As it should be. You have no right to hack systems that don't belong to you unless you are asked to do so by the owner.

      And what happens if that system has some of your personal information from a previous order or interaction?

      I guess we should just throw all of these "security researchers" in jail and anytime an internet vulnerability is announced everyone should just get new logins, new credit cards and just reinvent themselves online. That sounds like the best plan.

    6. Re:This is what happens... by thaylin · · Score: 2

      And why should it be that way? The owner is not the only person who uses that system, every person with an account uses it. If you cannot find out if there is a security hole in the system then it leaves everyone open to a black hat wanting to steal stuff. It should be illegal to steal data while doing so, or to ransom said bug, both of which are already crimes. It should not be illegal to hack to find and report vulnerabilities.

      --
      When you cant win, ad hominem.
    7. Re:This is what happens... by jedidiah · · Score: 1

      > As it should be. You have no right to hack systems that don't belong to you unless you are asked to do so by the owner.

      Sure you do. You have a right to ensure your own safety. You have a right to know whether a device is likely to harm you. Doesn't matter if this is a physical thing or something mostly governed by software.

      This includes things "hosted in the cloud".

      --
      A Pirate and a Puritan look the same on a balance sheet.
    8. Re:This is what happens... by Travis+Mansbridge · · Score: 2

      "Hack" is a pretty ambiguous term. If I discovered that I could log into any account on your service with the password 12345, would it be amoral to report this? Would it be amoral to have even discovered this? Personally, I would say it was only amoral if exploited for one's own gain or to others' detriment.

    9. Re:This is what happens... by sinij · · Score: 2

      Yes. I invoke Poe's lawn in my defense.

    10. Re:This is what happens... by Anonymous Coward · · Score: 0, Interesting

      "Researchers" are generally just dicks looking to make a name for themselves or can't get gigs.
      I work as a penetration tester in the UK. if someone pays me and signs an authorization for me to attack their systems then fair play. if there is no authorization it is against the law full stop.

      These muppets will end up having us licensed. There is no justification for scanning the internet for vulnerabilities on systems you have no authorization. It is not their job. They are NOT the internet police!

    11. Re:This is what happens... by thaylin · · Score: 1

      There is plenty of justification, such heartbleed and other vulnerabilities that pop up all the time. It is your job so you are biased against these people from the start because it takes POTENTIAL revenue from your company, but to claim it is not their job is a load of BS.

      I would be willing to bet when you penetration test you use known vulnerabilities and not zero day vulnerabilities, after all it is your job to test, not to research. And that right there would be why your statement is flawed. If they wanna license, go for it, but done block what the researchers are doing.

      --
      When you cant win, ad hominem.
    12. Re:This is what happens... by Opportunist · · Score: 1

      Wonder what that license would be like. Think my CISSP cert would do as a stand in?

      Gagging people has never really been the solution to anything. Especially not in a world where your local laws mean jack. Unless you can not only get every government on the planet to agree with some kind of law concerning the internet AND get them to actually care to enforce it (good luck trying to get a malware server shut down somewhere in east Asia...), whatever law you conjure is pointless and will ONLY affect and limit the ability of your own people.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    13. Re:This is what happens... by Anonymous Coward · · Score: 0

      You are an unethical "I Got Mine" tea begging Libertarian, obviously. Fuck You.

    14. Re:This is what happens... by Anonymous Coward · · Score: 0

      I do pen testing and the AC above does not speak for me. What we do relies on good will and effort of white hat researchers.

    15. Re:This is what happens... by Anonymous Coward · · Score: 0

      You are not allowed to deface public-facing buildings either - not all uses of the system is equal.

      You are not allowed to go vigilante on people in meatspace even if they hurt your feelers - two wrongs do not make a right.

      No. why?

    16. Re:This is what happens... by NatasRevol · · Score: 1

      There is no justification for scanning the internet for vulnerabilities on systems you have no authorization.

      Other than to see what hackers are trying to do.
      Or see how secure your personal data is on someone else's site.
      Or curiosity.
      Or learning.
      Or lots of other reasonable justifications.

      --
      There are two types of people in the world: Those who crave closure
    17. Re:This is what happens... by Anonymous Coward · · Score: 0

      Can you afford to get into a legal battle with the companies spamming you? No? How shocking.

      It's not about right or wrong or the morality of it all. But simply if it's legal or not. If it were illegal, then Microsoft would've went bankrupt ages ago ...

    18. Re:This is what happens... by arshat · · Score: 1

      These muppets will end up having us licensed. There is no justification for scanning the internet for vulnerabilities on systems you have no authorization. It is not their job. They are NOT the internet police!

      By the same token doesn't that call into question the legality of honey-pots to assess current attack trends? Surely that's entrapment? One day (I'm ever hopeful) people will realise that words on a piece of paper do not make things either right or wrong. Moral judgements trump laws every day all over the world, yet the persecution continues - I wonder why (well, I don't wonder; I know why, and so do you).

    19. Re:This is what happens... by cbiltcliffe · · Score: 0

      You are an unethical "I Got Mine" tea begging Libertarian, obviously. Fuck You.

      Please, can I have my tea? I need my tea! Pleeeeaaaaase?!

      --
      "City hall" in German is "Rathaus" Kinda explains a few things......
    20. Re:This is what happens... by rmstar · · Score: 1

      I would say it was only amoral if exploited for one's own gain or to others' detriment.

      So if a hack gives reputation to a security researcher while embarrassing the website owners - how is this not exploitation for the researchers gain to the website owners detriment? You go there and pull off an I-am-smart-and-you-are-a-moron on these folks that are trying to make a living. How is that different from being an asshole?

      The argument that security researchers are actually doing good is just an unsubstantiated assumption that needs closer scrutiny, and it is quite likely not true in many situations. For example, the SCADA vulnerabilities have not led to any major or even minor problem, yet they have generated a lot of FUD and maybe even given ideas to criminals and terrorists. Researchers have gotten their nice reputation out of this, but what has the world gained? And look at how the credit card industry works. A lot of their shit is fundamentally flawed from a security point of view, yet it works and is quite convenient. How can that be?

      Security researchers make a nuisance of themselves in many situations, and don't even realize it. Their "told you so" can be extremely costly to a company when there is trouble, because of how it affects liability issues. Most companies would not be viable if they had to fix every bug unearthed by researchers or face full liability claims when their unfixed code fails. The kind of talent needed to get security stuff right is just not available in the needed quantities at a reasonable price (i.e. hourly rates comparable to that of a janitor) so it is unreasonable to expect things to be secure. The alternative to insecure stuff is no stuff. Everybody who's not a propellerhead knows this.

    21. Re:This is what happens... by Anonymous Coward · · Score: 0

      Think my CISSP cert would do as a stand in?

      Let me honestly ask you: what weight do you think a CISSP has with true-blue security researchers? Hint: none. A mile wide, an inch deep and no real skills needed.

      Gagging people has never really been the solution to anything.

      Totally agree with you here.

    22. Re:This is what happens... by Anonymous Coward · · Score: 0

      So security researchers and/or security reporters in the UK cannot warn about a lot of unpatched webpages in the UK, but hackers all over the globe can hack and abuse them.

      Yeah, makes a damn lot of sense.

      Actually it does. If the Internet was secure and vulnerabilities patched in a timely manner then criminal organizations such as the NSA and GCHQ might not be able to break into your computer systems and steal data from you.

    23. Re:This is what happens... by Anonymous Coward · · Score: 0

      In the UK, it is a crime (under the computer misuse act) to test a 3rd party system for vulnerabilities.

      As it should be. You have no right to hack systems that don't belong to you unless you are asked to do so by the owner.

      if you're going to respond to a comment, please respond to the actual comment.
      "test a 3rd party system for vulnerabilities" is not "hack systems".

      How about this:
      As it should be. You have no right to test a 3rd party system for vulnerabilities that don't belong to you unless you are asked to do so by the owner.

      Well, that's the law and a poorly thought out one.
      I disagree with that section of the law. it should be repealed.
      You should be able to check for flaws in devices attached to the Internet. The Internet is a shared resource - some of it is publicly owned and some privately. You should not be allowed to do anything you want, but you should be able to spot and identify stupid behavior such as placing vulnerable devices on the public side of the Internet. These systems are a menace to us all, no government is trying to do anything about this menace. It should be allowed for private entities to try to help clean up the mess.

    24. Re:This is what happens... by gstoddart · · Score: 1

      You go there and pull off an I-am-smart-and-you-are-a-moron on these folks that are trying to make a living. How is that different from being an asshole?

      It's probably not.

      But in this case, the asshole is doing it to tell you that someone who is going to play much less nicely could also do it.

      However, the problem is, any sufficiently advanced form of "just looking" is indistinguishable from "I'm in your interwebs, and I'm stealing your data".

      --
      Lost at C:>. Found at C.
    25. Re:This is what happens... by Anonymous Coward · · Score: 0

      This has nothing to do with ill-thought out laws and everything to do with government spying.

      Law enforcement doesn't want the public to know where the back doors are, plain and simple.

    26. Re:This is what happens... by Opportunist · · Score: 1

      Well, let's see, what else have we got... OPST? CISA? CASP? Oh, I know, CEH/CNDA! That should do it.

      Then again, it doesn't really matter which one you require. Why? Because EVERYONE has them all. Because to keep them, you have to collect more and more certs.

      I can't help but ponder whether a certain well known Cult that also enjoys selling very expensive courses to its members acts as the role model for the whole crap...

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    27. Re:This is what happens... by Opportunist · · Score: 1

      And if your grandma had wheels you could ride her to school.

      Sadly the world doesn't work on would've and should've. The internet IS NOT secure and vulnerabilities ARE NOT patched in a timely manner. So we have to find a solution for this imperfect world.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  4. Times change. by Anonymous Coward · · Score: 3, Funny

    1990 - 2000 - "Script Kiddie"
    2014 - "Security Researcher"

  5. See... by bbroerman · · Score: 2

    This is why we can't have nice things. Companies won't audit themselves, and they get bent out of shape if others do it for them...

    --
    Logic is the beginning of reason, not the end of it.
    1. Re:See... by Frosty+Piss · · Score: 0

      This is why we can't have nice things. Companies won't audit themselves, and they get bent out of shape if others do it for them...

      You discovered my credit card number. You think it is now OK to run a program to try random PINs until you find the correct one?

      Why would you do that?

      --
      If you want news from today, you have to come back tomorrow.
    2. Re:See... by Anonymous Coward · · Score: 2, Insightful

      I would say that this is more like:

      You leave your credit card on a table under a wet napkin. I look at the napkin and think I can read the number. I look closer and can indeed read the number and exp date. I tell you that your credit card is easily readable, and you should probably do something about it. You then report me to the police for stealing your credit card number.

    3. Re:See... by thaylin · · Score: 1

      That is in no way what is being reported here. Possibly the initial discovery of the number because of a poorly designed application, but not the trying pins.. Do you like to come up with fallacies?

      --
      When you cant win, ad hominem.
    4. Re:See... by Anonymous Coward · · Score: 1

      If you are reading my credit card number while it is under a wet napkin on a table inside my house then you can be sure I will call the police.

    5. Re: See... by Simon+Brooke · · Score: 1

      That's a really bad analogy. Peering at someone's credit card - even if it is under a napkin - is quite obviously very bad manners indeed. If you're saying unauthorised penetration testing is like peering at someone's credit card, then it's clearly wrong.

      And speaking as someone who has his own little toy server out in the cloud, I'd very much prefer to do my own damn penetration testing, thank you.

      --
      I'm old enough to remember when discussions on Slashdot were well informed.
    6. Re: See... by arshat · · Score: 5, Insightful

      That's a really bad analogy.

      It is. It's more like the wet napkin has retained an imprint of the credit card and you have left the napkin behind on the bar. Someone then takes the napkin, hands it to you and says "you want to be careful with these wet napkins, look". You call the police because someone you don't know has your credit card details.

    7. Re: See... by denis-The-menace · · Score: 1

      And we have a proper analogy.

      Somebody give this guy some points.

      --
      Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
    8. Re:See... by Darinbob · · Score: 1

      More like you left a note on my kitchen table that I shouldn't leave my key under the doormat.

  6. Fuck America by Anonymous Coward · · Score: 1

    In America any good intentions are met by defensive idiots

    fuck them don't even try to help them anymore use your research to secure the rest of the world and let them rot in the festering cesspool they created

    1. Re:Fuck America by Anonymous Coward · · Score: 0

      Because america is full of offensive idiots pretending to have good intentions.

    2. Re:Fuck America by NatasRevol · · Score: 1

      And that's not just the government!

      --
      There are two types of people in the world: Those who crave closure
  7. This is the problem with the CFAA. by Anonymous Coward · · Score: 0

    First weev, now this.

  8. NSA by BradMajors · · Score: 5, Insightful

    The NSA and other security services will not want security researchers to find and fix vulnerabilities the security services are exploiting.

    1. Re: NSA by ComputerKarate · · Score: 2

      That was my initial reaction. It is not a secret the NSA has a database of ready made exploits that would be thwarted if people fixed their broken gear.

      --
      "The urge to save humanity is almost always a false front for the urge to rule." --H.L. Mencken
    2. Re:NSA by stewsters · · Score: 1

      +1 Sad But True.

    3. Re:NSA by Anonymous Coward · · Score: 0

      "That's our turf."

  9. Makes sense... by Anonymous Coward · · Score: 0, Redundant

    Authorities don't wanting them finding all their backdoors.

  10. Company Assets by just_another_sean · · Score: 3, Informative

    Yeah how dare they ask these companies to take their heads out of the sand and do something about their customer's security/privacy!

    I'm appalled at the amount of "Good, they broke the law" comments in this thread...

    --
    Creationist Textbook Stickers Declared Unconstitutional by CowboyNeal
    1. Re:Company Assets by Darinbob · · Score: 1

      Many of these people are essentially trying to get the company with the vulnerabilities to pay for the service of fixing them. People who've gotten the sorts of emails that say "I broke into your system and I can help you fix it" probably don't end up as fans of these drive-by services.

    2. Re:Company Assets by HiThere · · Score: 1

      Consider who is issuing the posts. Or just assume that they come from astroturfers...you won't be far wrong.

      --

      I think we've pushed this "anyone can grow up to be president" thing too far.
  11. Good bye US, hello Russia! by Opportunist · · Score: 2

    Odd as it may sound, for security research, you have WAY more liberties there.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  12. An odd idea. by Anonymous Coward · · Score: 0

    From what I understand the primary way they can prosecute under the CFAA is a device is being used other then the manner in which it is intended.

    Why not have the companies liable for releasing a device that has undocumented exploitable features that fall outside the realm of intended use?

    My plan won't work (For anyone thinking logically), but it'd shut up the CFAA lawyers.

    1. Re:An odd idea. by Anonymous Coward · · Score: 0

      From what I understand the primary way they can prosecute under the CFAA is a device is being used other then the manner in which it is intended.

      Why not have the companies liable for releasing a device that has undocumented exploitable features that fall outside the realm of intended use?

      My plan won't work (For anyone thinking logically), but it'd shut up the CFAA lawyers.

      Hey, that would be the final nail in IE's coffin.

    2. Re:An odd idea. by Scarletdown · · Score: 1

      From what I understand the primary way they can prosecute under the CFAA is a device is being used other then the manner in which it is intended.

      If that device was a general purpose computer, then any task it is capable of performing can in no sensible way be classed as a use in a manner for which said general purpose computer was not intended.

      --
      This space unintentionally left blank.
    3. Re:An odd idea. by drinkypoo · · Score: 0

      If that device was a general purpose computer, then any task it is capable of performing can in no sensible way be classed as a use in a manner for which said general purpose computer was not intended.

      If the device was intended for illegal use, then the device is illegal, possibly even if it has substantial legal utility. The maker isn't putting in features specifically to make illegal activities easier, and therefore it can be argued that the device was not intended for illegal use and any use which is already illegal would be grounds for prosecution.

      Obviously, IANAL. But I can twist and screw with the best of them.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    4. Re:An odd idea. by Scarletdown · · Score: 1

      Yeah, it is a twisted and convoluted system. That is for sure.

      And thanks for giving me a Beavis and Butthead moment by your declaration that you anal and can twist and screw with the best of them. Huh-huhhuhhuhhuh...

      --
      This space unintentionally left blank.
  13. No good deed by Kevin+Fishburne · · Score: 2

    Why, with all the plenty of cheap resources, technology, entertainment and knowledge, are people still complete assholes? There must be an asshole gene that natural selection has yet to make dormant.

    --
    Buy your next Linux PC at eightvirtues.com
    1. Re:No good deed by arshat · · Score: 1

      There must be an asshole gene that natural selection has yet to make dormant.

      It must be closely related to the 'have lots of money and power' gene.

    2. Re:No good deed by Kevin+Fishburne · · Score: 1

      LOL. Agreed.

      --
      Buy your next Linux PC at eightvirtues.com
  14. Good by nurb432 · · Score: 4, Funny

    Everything is going according to plan.

    --
    ---- Booth was a patriot ----
  15. There are no white hats by russotto · · Score: 3, Interesting

    And it's about time the so-called "ethical security researchers" got off their high horses and realized that. There are far too many laws for there to be white hats. If you want to do useful research into vulnerabilities other than those of the company you are a security researcher for, you're going to have to put on the black hat.

    1. Re:There are no white hats by MightyMartian · · Score: 3, Interesting

      Which is the technical equivalent of allowing only researchers in the employ of the tobacco industry to research the risks of smoking.

      --
      The world's burning. Moped Jesus spotted on I50. Details at 11.
  16. Here's my reply to the lawyers... by Anonymous Coward · · Score: 0

    You were given notice that your product has vulnerabilities. I had no intention of letting others know about these vulnerabilities until they were fixed.

    I did not have to do this and could have anonymously released the vulnerabilities into the wild.

    Unfortunately, after your stupid-assed fucktard move of sending me this threatening letter, it seems that the Anonymous group has hacked into the device of yours that I was using to store all of the exploitable vulnerabilities and have released them into the wild.

    Maybe next time you'll pull your head out of your ass before sending stupid assed shit like this.

    I am releasing a public announcement with full data, full vulnerabilities as well as the full context of your letter(s) and threats to let the world know that you prefer to threaten people who try to help you rather than fixing your problems.

    Way to go retards.

    BTW - you cannot touch me in any way shape or form as your laws do not apply to me,as I am a citizen of Moldavia and sit on the Mutant Jedi Council and have full diplomatic immunity.

    So go fuck yourself

    Yours truly,

    Anon Y Mous

  17. No Knock Flash Bang for Bayb's FACE by Anonymous Coward · · Score: -1

    And WHY do they spy, so they can....
    Throw Stun Grenade into Baby's Face.
    http://www.activistpost.com/2014/05/swat-throws-stun-grenade-into-toddlers.html

    For each incident, the problem reaction, solution applied.
    Boston Marathon = Gun Ban Bills
    San Diego College = GUN BAN Bills

    But, if you step back, might this be an opportunity as well?
    Baby's face burned off = Flash Bang Ban Bill, or The Actually Get a Warrant Bill, or the Actually know your target bill, or the Obey your Oath vs Life in Ft Leavenworth bill... I can think of a lot of things, and I am just a dummy.

    So instead, let the Corporate Media Steer this issue again? Maybe more bills to crack down on the guy they were after? Ignore accountability, responsibility?

    And instead, in the Alternative we can talk about how we have prepared and hardened our homes for Civil War?

    I got to tell ya, I'd rather Go Experiment with my solar panels and Hydrogen Generation/Use/Heating/Cooking that to spend more time on this. It's what I should be doing, instead of wasting years of life reading all the bad news the oath breakers actions have caused. Getting stressed by it and then labelled ODD and lose all your firearms via the Obamacare+DSM 5+NCIC database+SPIES breaking the Oath and targeting Americans business.

    Cause See, maybe there is something to Browns Gas... Maybe there is a new field of energy. I heard last year a lot of cold people (ya know global warming and all like poor economy bla bla.) What if that guy that shows us we could heat strips of tungsten or a Catalytic converter to generate heat, or re-purpose some of the Propane powered ones that already exist as camping space heaters.

    I can generate Hydrogen and electricity ALL DAY, Every Day. You can too! But for every moment I WASTE HERE, is one moment I can't do any experiments.

    If your not goin to make the future have new things, at LEAST -- Start correcting the media!

    When they say things like maybe another smart gun control bill, counter it with "You mean you want anti-Flash Bang and Anti-No Knock bill"

    When they repeat their steering, interrupt, and say NO and propose a Anti-Flash Bang bill. And Anti-No Knock bill" (I know that's a double negative, but actually it can be a POSITIVE if everyone had no tolerance for this tyranny .)

    We can throw this damned Rothchild / Zionist crap off, but you have to be responsible for your own LIFE! Obamacare.. DSM-5.. Good God...
    Aren't you sick of Dual Israel/US Citizens trashing the Bill of Rights and Constitution yet?!
    Or your still PC?? e.g. It's just coincidence, all jews controlling all the main things, finance, spying, security, dhs, on and on.

    I say there ought to be a bill to remove all DUAL CITIZENS from intelligence commitee, and hold Office in the US. Until they DROP the non US country. And even then I still don't trust em to hold Senate Seats, Congress Seats. I base my Security model starting there. But, they'll whip out that I am anti-semite
    Look at Feinstein.... Good god. She hates the Constitution.

  18. the way it should be for TOFC type stuff by RobertLTux · · Score: 1

    mock up a few copies and then dare folks to hack it (sort by remote and physical access type hacks)

    when you get something that can stand up to a decent number of hacks (remote hacks that require you to be on the same subnet on a blue moon with Big$ tool between the hours of 22:00 and 23:59 and the product needs to be in mode X and physical hacks that would be obvious don't count) then you as a last check put up a BIG$ bounty on hacks.

    Then you can release a cyber product targeting children.

    --
    Any person using FTFY or editing my postings agrees to a US$50.00 charge
  19. Yep, like usual by Anonymous Coward · · Score: 0

    The NSA are a bunch of jealous, obsessive, insecure bitches.

    Typical, and yet so predictable.

  20. In an unrelated story, by idontgno · · Score: 4, Funny

    the mayors of several crime-plagued cities release a joint announcement that reporting apparent crimes in progress to police would result in the arrest and summary punishment of the person making the police report.

    "If you losers would stop reporting crimes, we wouldn't have so much crime," one prominent mayor stated to this reporter. "We're going to push down crime rates the only way that works: make it impossible to report a crime."

    When asked for a comment, the aforementioned mayor's Chief of Police muttered "Whaddyawant, I'm busy here" through a mouthful of donut while pocketing a thickly-stuffed brown paper envelope proffered by an unidentifed man flanked by several apparent bodyguards.

    --
    Welcome to the Panopticon. Used to be a prison, now it's your home.
    1. Re:In an unrelated story, by Joe_Dragon · · Score: 1

      sounds like a chief wiggum move.

    2. Re:In an unrelated story, by Scarletdown · · Score: 1

      I was thinking that sounded like these mayors are the result of interbreeding between Vogons and Ravenous Bugblatter Beasts.

      --
      This space unintentionally left blank.
  21. Lawyer point of view by ArcadeMan · · Score: 2

    I suppose lawyers don't have locks on their homes because there's laws about illegal entry.

    --
    Get free satoshi (Bitcoin) and Dogecoins
    1. Re:Lawyer point of view by Anonymous Coward · · Score: 0

      there's laws about illegal entry.

      What do locks have to do with rape?

    2. Re: Lawyer point of view by Anonymous Coward · · Score: 0

      duh: chastity belts.

  22. Outsource Security Research Now by Anonymous Coward · · Score: 0

    We should totally leave our vulnerability research up to professionals and foreigners. Our government has teams and teams of computer scientists working to make the world a better place who will tell us if there is a problem we should know about. And China, North Korea, Iran, and Russia will let us know if they find problems on their end so they won't recieve so much SPAM.

  23. Solution is Transparency? by silvermorph · · Score: 1

    Identifying the good guys is a question of trust, so you can imagine why lawmakers are hesitant to throw trust around willy-nilly. Building a system that shows how that trust is reciprocated and enforced would be a good start.

    Seems like there could be a law that tries to differentiate "Research Hacking" by setting requirements to qualify as a researcher. They must provide full transparency to prove they have no malicious intent. They inform law enforcement authorities of their activities before and after the exercise and constantly upload logs of their actions and any data transactions they execute. Maybe on a virtual "research sandbox" machine that deletes itself at the end of the session as an added layer of protection. Then if the vulnerability gets out before it's been reported, maybe that researcher (or people with access to their machine) is a good place to start the investigation, so there's incentive to report vulnerabilities quickly. Overly simplistic, probably not quite workable as-stated, but you get the idea.

    1. Re:Solution is Transparency? by Anonymous Coward · · Score: 0

      They should sell them to third parties directly, it's probably less hassle, easier to defend in court and probably more profitable.

    2. Re:Solution is Transparency? by Darinbob · · Score: 1

      But how do you trust people? Someone sending you a threatening email that they found a vulnerability that their consulting company can fix for you is not the sort of person likely to be trusted. Just saying "I'm one of the good guys" isn't good enough, as the mafia uses the same argument when selling protection services.

    3. Re:Solution is Transparency? by silvermorph · · Score: 1

      Determining who to trust is the goal of the system I described, because the only real trust is reciprocal trust. Researchers trust an authority with full record of their activities, and thereby earn the trust of the people they're ostensibly trying to help.

      Today this would be done by the owner of the system choosing a security firm to audit their system, but we know that doesn't happen because it's expensive and people are lazy. Still, it needs to be done, so today's researchers just do it without getting permission, which results in vulnerabilities exposed (good), but sometimes also results in lawsuits (bad).

      In my proposal, the law defines the terms of that initial agreement, which lets researchers find security flaws without having to get the system's owners' permission.

    4. Re:Solution is Transparency? by Darinbob · · Score: 1

      Actually, where I work we do have a security firm that is auditing all the code. It's being paid for by a customer though (who is unknown to the devs). As in we sell the products and services to a customer for a very large amount of money over a period of time, the customer demands that we have top notch security in the products and as a condition of sale we agree to be audited with results shared between us and customer only.

      The approach seems reasonable: we win because we''re not paying but still get benefits, customer wins because they have additional security and peace of mind.

    5. Re:Solution is Transparency? by silvermorph · · Score: 1

      Cool, that's great, and I don't think you should stop doing that, but you aren't really the case the story is talking about. Although you could be, if the security firm you hire fails to catch all of the vulnerabilities and some white hat somewhere reports something to you. Then it'd be better if you could have some assurance that they were trustworthy.

      I don't think we disagree on any specific points so far. I'm not trying to replace security audits, just to encourage people who do the right thing without being paid to do so.

  24. Is this like picking random locks? by Anonymous Coward · · Score: 0

    I don't understand what the security researchers are doing. It sounds like they're doing something analogous to physically picking random locks that don't belong to them. It should not be surprising that the lock owners would be annoyed.

    1. Re:Is this like picking random locks? by sinij · · Score: 1

      Yes and no. This analogy only holds if unlocking random lock also has a chance to unlock your front door.

    2. Re:Is this like picking random locks? by PPH · · Score: 1

      picking random locks that don't belong to them.

      I'm assuming that any competent researcher would purchase their own "unnamed embedded device marketed towards children" and crack that. Otherwise, 'Duh.' I don't want you hacking my kid's toy.

      But if you pick your own lock, it belongs to you. And so long as the purpose is research, DMCA and other laws do allow for some limited R&D exceptions.

      --
      Have gnu, will travel.
  25. Finding and reporting vulnerability is one thing by Stan92057 · · Score: 1

    Finding and reporting vulnerability is one thing, making working programs to exploit the vulnerability to the mass public is the main problem. They don't belong in the public domain. If a hairdresser needs to get a license to cut hair why in hell do we not demand security researchers be licensed as well?? the answer they should be required to get one and making of tools to exploit vulnerabilitys should only beavailable to licensed researchers. Stop handing over tools to the criminals and stupid teens. That is IMO

    --
    Jack of all trades,master of none
  26. Naturally by PopeRatzo · · Score: 1

    Of course security researchers are being targeted by US cybercrime laws.

    Who do you think they were designed to stop? Security researchers, whistleblowers and anyone who wants to see the nation's security apparatus held accountable were always the intended targets of these laws. And anyone who believes the Internet should be free and research that impacts the public welfare should be readily available to all.

    You didn't think these laws were about Estonian hackers, did you?

    --
    You are welcome on my lawn.
  27. License researchers like investigators by dave562 · · Score: 3, Insightful

    I work for a company that does a lot of forensics work, including collections activities and incident response. The company has to be licensed as a "private investigator" in all of the states that our employees do collections in.

    It seems like a similar licensing regime would be a good place to start for computer security researchers.

    It might also be worth considering making the researchers or their employer carry a bond as collateral against any potential damage that they might inadvertently cause.

    It has been my experience that when people and organizations have something to lose (like forfeiture of a bond or loss of a license / ability to do business), they tend to act in a more predictable manner, and within well established guidelines.

    There might also be some lessons to be learned from maritime law. In a way, researchers are sort of like privateers on the digital oceans. (So yes, once again, pirates ARE better than ninjas. Just in case there was ever any doubt.)

  28. NO, treat researchers like experimenters by Anonymous Coward · · Score: 0

    If they "act in a more predictable manner, and within well established guidelines", then how do do they find the vunerabiities? Unpredictable behavior tests the system.

    1. Re:NO, treat researchers like experimenters by arshat · · Score: 1

      I think the OP was referring to their personal behaviour, rather than the behaviour of their code :)

    2. Re:NO, treat researchers like experimenters by Darinbob · · Score: 1

      But you must first establish a business relationship and get permission in order to be ethical. You don't need to say when your test will be only that you will be doing it. There are legitimate security companies that do this.

  29. Well that's ironic... by Anonymous Coward · · Score: 1

    I'm a student at Naval Postgraduate School, and every single "cyber" security course taught here could be renamed to "How to use Metasploit to [blank]". There are all of a half dozen of the CS students here that came from any kind of background involving coding, making it necessary to dumb things down to "How to be a script kiddie".

    So the makers of the primary tool taught to service members from all branches (Air Force, Marines, etc all attend there), many of which are absolutely dependent upon it, are also one of our law enforcement agency's take-down targets (or, to a lesser degree, is being told at least to not do the very thing that makes them useful to so many). Go figure.

  30. What's the issue here? by PPH · · Score: 1

    Law enforcement doesn't want researchers uncovering their backdoors put into consumer products? Or some sleazy manufacturer with defective crap getting a buddy in the FBI to lean on people who might go public?

    --
    Have gnu, will travel.
  31. Derp. No by Anonymous Coward · · Score: 0

    Lawyers don't "call" you to make threats. They send cease and desist letters via certified mail. Thus, the entire story is likely bullshit blown out of proportion. This is something that all security researchers are good at. Bullshitting and blowing things out of proportion.

  32. Re:Finding and reporting vulnerability is one thin by arshat · · Score: 1

    tools to exploit vulnerabilitys should only beavailable to licensed researchers. Stop handing over tools to the criminals and stupid teens. That is IMO

    Fair enough, but it's not particularly achievable is it? How would you go about stopping people getting hold of the software or, heaven forbid, from writing their own?

  33. Re:Finding and reporting vulnerability is one thin by ubrgeek · · Score: 1

    Simple: Classify GCC as a WMD.

    --
    Bark less. Wag more.
  34. Re:National Unsecurity Agency by Anonymous Coward · · Score: 0

    see title

  35. Obviously organized crime has paid off the Feds by Anonymous Coward · · Score: 0

    This is actually a kinder analysis than accusing them of intractable stupidity.

  36. Re:National Unsecurity Agency by s.petry · · Score: 1

    National ScrewYou Agency would be better because the acronym would remain the same.

    --

    -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

  37. Re:Finding and reporting vulnerability is one thin by Stan92057 · · Score: 1

    I don't claim to have all the answers but common since says what is happening right now is because of bad researchers.Those who give no notice like the Google employee. If a hair dresser can have thee industry licensed I don't see why researchers cant be also. And Companies Like Target who don't follow the standard rules must be held accountable as well I don't think placing all the blame on the researchers is fair at all either. The whole world shouldn't be held hostage by a single unaccountable person as it is now

    --
    Jack of all trades,master of none
  38. Basically by Ol+Olsoc · · Score: 1
    They are not finding vulnerabilities.

    They are finding features.

    --
    The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
  39. Even in computer by Anonymous Coward · · Score: 0

    You cant fix stupid. So stop let the hacker win and let the Corporations pay the legal defense from pissed off users.
    Only loss of money will ever do. Put your time into a security type hardware device.

  40. Also, employees WILL bypass unreasonable restricti by raymorris · · Score: 1

    I would say that unreasonable restrictions on employee access make data less safe. Many people WILL get access to whatever they need to do their job effectively. There is always a way, whether it's a technical bypass or having friends in the right department. Where I work, three of us are good friends. There are almost nothing that isn't accessible to one of us. If I needed access to something to get done what needs to be done, I'd get access. The only question is whether or not I'd be allowed to tell the security team that I was accessing the data.

    Suppose an organization decides that they've had enough of trojans, so they l decree that everyone gets the approved desktop image and noone may install the software they need to do their job effectively and efficiently. To enforce this, employees get only a very limited account on the machine, similar to the default Guest account in Windows.

    The result? The IT department no longer knows what software is being used since employees have to keep it secret (or be unable to do their job effectively). They don't know how the software got there. Maybe a lot of people are doing their work on personally-owned laptops, so company data is now handled on the same system their kids use to play online games.

  41. It's all part of a general trend by Anonymous Coward · · Score: 0

    The trend is stupid people runing the show, bringing the hammer down on smart people. My wife had to go through security training recently, and was graded on answers that identified people as likely spies in an organization. Top of the list are "people who travel abroad and criticize the US government," which is exactly not what a spy would do, but who am I telling this, right? So, I'm beginning to think that the US is fast becoming what we always thought the Soviet Union to be, some sort of ultra-paranoid and self-consuming organism (rather than the reality: an economic system that ran itself into the ground because it eliminated the incentive to work).

    In the end I am far more terrified of where our government is pushing us, than I am of those violent idiots with a misguided penchant for blowing stuff up. It makes me sad, but of course, we have always been at war with the terrorists. Haven't we?

    Wait a sec, someone at the door . . .

  42. WTF! by Anonymous Coward · · Score: 0

    Wht do slashdot INSIST that I should read this thread using the *crap* beta version?

    Read my lips: I DONT WANT TO USE THE BETA VERSION. THAT'S WHY I ENTER SLASHDOT WITH THE NOBETA TAG IN THE URL. Was that clear?
    Your beta version is *really really bad*.

    Bye. me --> Hacker News.

  43. Is Your Antivirus Tracking You? by Anonymous Coward · · Score: 0

    "Is Your Antivirus Tracking You? You'd Be Surprised At What It Sends"

    by Chris Hoffman, 28th May, 2014, MakeUseOf.com

    ############

    PLEASE READ THE PDF. THE QUOTE FROM THIS ARTICLE DRAWS REFERENCE TO WEB URLs BUT IN ORDER TO PROPERLY COMPREHEND THE MAGNITUDE OF DATA COLLECTION, YOU NEED TO READ THE PDF. PREPARE TO BE FLOORED.

    DOWNLOAD THE PDF. STORE IT. CONVERT IT TO OTHER FORMATS. SHARE IT. MAKE SURE IT IS ALWAYS AVAILABLE SOMEWHERE ON-LINE OTHER THAN THE SOURCE BELOW. DON'T BLINDLY TRUST ARCHIVE.ORG TO KEEP IT FOR YOU.

    EVERYONE NEEDS TO READ THIS PDF BEFORE CONTINUING TO USE ANTI-VIRUS PROGRAMS.

    ############

            "Your antivirus software is watching you. A recent study shows that popular antivirus applications like Avast assign your computer a unique identifier and send a list of all web addresses you visit to the manufacturer. If the antivirus finds a suspicious document, it will send the document to the antivirus company. Yes, your antivirus company might have a list of web pages you've visited along with your sensitive personal documents!

            AV-Comparatives' Data Transmission Report

            We're getting this information from AV-Comparative's Data transmission in Internet security products report, released on May 8, 2014. AV-Comparatives is an antivirus testing and comparison organization.

            The study was performed by analyzing antivirus products running in a virtual machine to see what they sent to the antivirus company, reading each antivirus product's end user license agreement (EULA), and sending a detailed questionnaire to each antivirus company so they could explain what their products do........""

    ############

    Rest of article and comments here:
    http://www.makeuseof.com/tag/a...

    .PDF - The Study, dated May 20, 2014:
    http://www.av-comparatives.org...

    .PDF-To-Images Free 0n-Line Viewer:
    http://view.samurajdata.se/

  44. Re:Also, employees WILL bypass unreasonable restri by ArhcAngel · · Score: 1

    Suppose an organization decides that they've had enough of trojans, so they l decree that everyone gets the approved desktop image and noone may install the software they need to do their job effectively and efficiently. To enforce this, employees get only a very limited account on the machine, similar to the default Guest account in Windows.

    The result? The IT department no longer knows what software is being used since employees have to keep it secret (or be unable to do their job effectively). They don't know how the software got there. Maybe a lot of people are doing their work on personally-owned laptops or tablets, so company data is now handled on the same system their kids use to play online games.

    BINGO!
    That is exactly what they do. I stopped carrying a laptop a couple of years ago and just set up a VM I use to VPN in to the office from my home PC.

    --
    "A person is smart. People are dumb, panicky dangerous animals and you know it." - K