Slashdot Mirror
Proposed Active-Defense Bill Would Allow Destruction of Data, Use of Beacon Tech (onthewire.io)
Trailrunner7 quotes a report from On the Wire: A bill that would allow victims of cybercrime to use active defense techniques to stop attacks and identify attackers has been amended to require victims to notify the FBI of their actions and also add an exemption to allow victims to destroy their data once they locate it on an attacker's machine. The Active Cyber Defense Certainty Act, drafted by Rep. Tom Graves (R-Ga.) in March, is designed to enable people who have been targets of cybercrime to employ certain specific techniques to trace the attack and identify the attacker. The bill defines active cyber defense as "any measure -- (I) undertaken by, or at the direction of, a victim"; and "(II) consisting of accessing without authorization the computer of the attacker to the victim" own network to gather information in order to establish attribution of criminal activity to share with law enforcement or to disrupt continued unauthorized activity against the victim's own network." After releasing an initial draft of the bill in March, Rep. Tom Graves held a public event in Georgia to collect feedback on the legislation. Based on that event and other feedback, Graves made several changes to the bill, including the addition of the notification of law enforcement and an exception in the Computer Fraud and Abuse Act for victims who use so-called beaconing technology to identify an attacker. "The provisions of this section shall not apply with respect to the use of attributional technology in regard to a defender who uses a program, code, or command for attributional purposes that beacons or returns locational or attributional data in response to a cyber intrusion in order to identify the source of the intrusion," the bill says.
I'm guessing that large businesses could get in on this too? If not now, just wait....
And, we've seen how well just take down notices work....often not even justified, but still...the party acted upon is now guilty till proven innocent.
What constitutes a valid victimization? Telling someone you don't like them? They small bad? That allows them to infiltrate your computer, destroy information...etc?
This sounds like a real pandora's box being opened here.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Time to hire some in house hackers and install the black ICE on the servers.
I was just "destroying my hacked data"
Facebook had hacked my browsing data...
The FCC was hosting my stolen data...
The "agencies" had hacked my communication devices....
Linkedin...
Tumbler...
Myspace...
IRS...
You are being ripped off every second of every day, so that advertisers can help rip you off even more tomorrow.
So this bill empowers me to attack Microsofts and Googles servers to destroy my data that they have taken?
So I have to tell the FBI that I'm going to hack the NSA to destroy my data?
Republicans have seen too many Hollywood hacker movies. They want people to believe that after someone steals their personal information, they'll be able to click a big red EXECUTE button on the screen and it will launch a counterattack and steal back their data.
In reality, the people who are victims of this type of data theft aren't going to have access to these "Beacon" tools. But copyright trolls and malware thugs almost certainly will. In the end, this will be just another corporate giveaway.
The cyber is hard.
You are welcome on my lawn.
What this is going to enable people to do is destroy zombie computers and devices under the guise of retribution. While this may seem good at first, it's just going to be the moms and pops of the world losing all their data because they got infected with a virus and somebody unleashed hell on their machine. It seems like it would be far more helpful to require ISPs to detect a DoS in progress and cut off the infected customer. A scorched Earth campaign will do little to change the world.
Anons need not reply. Questions end with a question mark.
So just exactly which tools will John Q Public be using to track and delete their data?
The "easy" tools, meant for the people who still have VCR's blinking midnight?
"Alexa, find and destroy all my hacked data!". thank you.
Since most people don't know how to implement such counter-measures, hackers will finally fill a niche of their own in the market.
Captcha: commence
I'm honestly asking. Something smells about it, but that's only from my experience seeing whatever gets penned by R- hands that even remotely touches technology.
The idea of getting back at whoever hacked you is tempting, but, how do you even tell? What's the timeframe? And I guess what are the restrictions, really?
Is this one of those things where the average joe will be completely unprotected and unsupported, but various large companies will be able to use the letter of the law to completely screw over journalists or complaints or something of the sort?
The analogy is if you suspect someone of stealing your wallet, you are allowed to break into their house, search through it to find and take back your wallet, destroy a few things here and there to prevent them from pickpocketing in the future, and then call in the police to arrest the guy.
Oh, but if you made a mistake and destroyed some random person's stuff, well, you were still acting within the law.
Can someone point to definitive mainstream tech media explanation of what this 'beacon' tech/nique is about? Certainly it has nothing to do with the 802.11* beacon frames, or does it?
Is it just the decriminalization of ping and traceroute?
I get the distinct feeling that the spooks are playing word redefinition games here.
Republicans have seen too many Hollywood hacker movies.
speaking of movies...
In reality, the people who are victims of this type of data theft aren't going to have access to these "Beacon" tools. But copyright trolls and malware thugs almost certainly will.
Yup, the movies are definitely going to be the thing best protected by this act.
Movie shown in theater tends to be fingerprinted. (the purpose being to try to trace back where a copy was first leaked).
This act basically gives authorization to the industry to install a backdoor (either forced through legislation, or unknowingly deploy in the style of Sony root-kit), that will nuke an user computer if it ever detects such type of fingerprints.
(and make it also report back to the MPAA mothership in preparation of subsequent copyright lawsuits - of course claiming bazillions of revenue loss due to piracy)
This is definitely the evil twin of Digital Restrictrion Management (as if the original DRM wasn't evil already enough).
Copyright trolls are going to have a great day.
The people affected by false positives that wrongfully b0rked their computer : not such a great day.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Well, one good thing, I love bacon of any kind so far.
We know how BrickerBot works and how bad that can be. This would be much, much worse.
Yup. Indeed.
this time instead of Smart LED bulbs staying dark or showing the wrong color, you're going to have the database server holding the important financial information getting broken.
But hey, at least the infected zombie bot won't disturb *you* anymore.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
"Beacon" tools? WTF? Is that like honeypotting your own executables in order to catch the subset of thieves that are stupid enough to run those programs from their own internet connected networks?
In reality I imagine this is dual-crap. Half of the crap is that it is trying to attract political support with as you mentioned, a fantasy for ordinary users to somehow fight back against the cyber criminals (which is only necessary because the law enforcement authorities are some combination of too corrupt, too incompetent, too underfunded, and too lazy to police the new frontier that their slow evolution culture will need another couple centuries to catch up with). The other half of the crap is that what this is really for is to allow the billionaire cyber corp club to basically do as they please, and not be liable when they happen to accidentally hack into 100 innocent people's computers for every guilty party's computer they hack into.
Is the beacon path back to the US the ip range of interest? ... ...
Automated or will some US gov worker have to click a gui everytime to allow a beacon to be respond to?
Hope that the user is on a desktop computer, has one hard drive that has the OS, has the data, is connected to the net, has the same ip for a while?
How perfect is the "techniques to trace the attack and identify the attacker" going to work in every computer network before someone with skills finds something in the wild?
Or does the beacon encrypt ip changes it gathers deep in the "computer of the attacker"?
Create a fake beacon and place it deep into some other interesting network.
Watch as the US reaches out and injects code deep into some other network.
The owner of that network then states that the US is attempting to alter their vital computer system...
The fake beacon is then found and the US has to do paperwork about the event.
A new beacon is detected deep in another network
How will the US ensure each and every beacon is a real event? Advanced crypto per beacon and code per event that nobody will ever see in the wild?
Once discovered in the wild and reverse engineered all the altered IoT could send out the same beacon like messages?
The US would be induced to swamping the internet trying to push code down random networks globally.
How is the US going to detect the "computer of the attacker" if the beacon code reports an altered, compromized or faked ip range?
The US will be back to reporting on code litter, ip ranges, time zones and finding language fragments.
The "beacon" reported an evil ip range so it must be that evil nations clandestine services.
Domestic spying is now "Benign Information Gathering"
A person with their own home computer using a modem downloads beacon ready US data to that desktop computer.
That special US data sends out a secure fully encrypted beacon message about the ip and type of computer its has been downloaded to.
The US tracks down that home computer with one hard drive, a consumer OS and a connected modem.
The data then has no value after the US has fully "disrupted" that computer.
The once rare and advanced 1980's dial up network and expensive desktop computer is now a global consumer product in 2017.
Everyone interesting has one desktop computer, a common US brand consumer OS, a modem and one hard drive on that computer in 2017...
Domestic spying is now "Benign Information Gathering"
What constitutes an attack? Is Facebook an "attacker" because they hold data I didn't authorize?
What, besides deleting the offending data, counts as disruption? This is a loophole giving all copyright trolls a licence to delete everything, or install adware, on a suspect's computer: IOW, vigilante justice.
Will this create an arms race with AV software blocking beaconing technology? Most AV publishers exist outside the USA and won't have to obey any backdoor-ing legislation.
I am curious how this is going to not constitute destruction of criminal evidence when the first court case goes before a judge...
HA! I just wasted some of your bandwidth with a frivolous sig!
Retarded bullshit from the Trumpniks. Why on Earth would you notify a compromised administration of your attempts to defend against Russian active measures?
Better defense is to move your servers out of the United States and ignore this garbage non-thinking legislature while America sorts of her bad boyfriend.
If someone has the skills and is being attacked... it wouldn't matter if there is a bill or not.
[($)]
Wild Western in the Digital Age. Retardation seems to be a qualifier and requisite for american politicians. Instead of order, they are trying to make the wild western out of internet?
The police don't hold a monopoly on justice.
Since the US doesn't have jurisdiction outside the US, attacking any foreign computer will likely remain illegal under foreign law. If the US courts protect them they'll become modern day privateers, state-sanctioned thugs. Like a loose cannon version of the NSA, this will not end well.
Live today, because you never know what tomorrow brings
This can easily change a Cyber Attack into a Cyber War.
The next time AT&T decides to force an update on my phone that I OWN, and it destroys my data, then I could retaliate against their network.
Or if my device was enslaved via virus and a corporation responded by wiping out my device that also happens to contain the cure for cancer on it.
The "beacon" exception is interesting. Someone went to the extra trouble to pay somebody to add that. Who did it and why? What's the imagined scenario?
"Believe me!" -- Donald Trump
and it's pointing way over to the right.
must be maintained forever
I remember watching the episode and thinking Gee--it would be great to be one of the people with the active immune system.
Of course it would suck for my neighbors, friends, and family--but that's their problem.
Right?
"Reality is that which, when you stop believing in it, doesn't go away." - Philip K. Dick
And after you finish with them you can eliminate the second most violent and oppressive religion in the world by getting rid of all the christians... it's only smart and an enlightened approach to national security.
"downloads beacon ready US data"
Whatever that means
"That special US data sends out a secure fully encrypted beacon message about the ip and type of computer its has been downloaded to."
traditionally computer scientists and engineers don't talk about "data sending out a message". We call that non-sensical. Is the data of a format that induces a bug/segfault/etc in common media players and has an executable payload and thus the computer/media-player-program then sends out the message? Over the internet, over the ether, over subspace, via passive reflecting usb port bug to a microwave emitting predator drone? So after the first few people fall prey to this, the pirates start watching their booty movies from non internet connected systems, perhaps in faraday cages. Then what? This sounds really stupid.
It really is that silly AC for the executive summary.
A solution that expects a home computer with a modem to be direct downloading a "file" that reports back the ip.
That users computer is then "disrupted".
Domestic spying is now "Benign Information Gathering"