Slashdot Mirror
Hacktivists, Tech Giants Protest Georgia's 'Hack-Back' Bill (threatpost.com)
lod123 shares a report from Threatpost: As Georgia Governor Nathan Deal considers whether to sign a controversial piece of legislation that would allow companies to 'hack back' with offensive initiatives in the face of a cyberattack, companies from across the tech spectrum are lining up to protest the measure. Also, a hacktivist group has targeted Georgia Southern University, two restaurants and a church to protest the bill. Opponents have twin beefs when it comes to Senate Bill 315: Some are questioning whether legitimizing offensive attacks will open the door to a new kind of corporate warfare; and others are concerned that the law will have a chilling effect on cyber-research by criminalizing white-hat activity like vulnerability research and pen-testing.
Google and Microsoft are in the former camp, and have asked Deal to veto the bill, which was passed by the Georgia General Assembly in March and which is nearing its deadline for signing into law. The two giants take issue with a provision in the bill that allows "active defense measures that are designed to prevent or detect unauthorized computer access." In a letter to the governor, the two argued that S.B. 315 "will make Georgia a laboratory for offensive cybersecurity practices that may have unintended consequences and that have not been authorized in other jurisdictions," and that "provisions such as this could easily lead to abuse and be deployed for anti-competitive, not protective purposes." They added: "On its face, this provision broadly authorizes the hacking of other networks and systems under the undefined guise of cybersecurity... [B]efore Georgia endorses the 'hack back' authority in 'defense' or even anticipation of a potential attack with no statutory criteria, it should have a much more thorough understanding of the ramifications of such a policy." Tripwire also filed a letter with the governor's office: "[A]ccording to the wording of S.B. 315, well-intentioned ('white-hat') researchers could be subject to civil or criminal prosecution when following industry best practices in investigating a website for protection from a potential cyber-attack. It is our firm belief that an explicit exception is required to exclude prosecution when the party in question is acting in good-faith to protect a business or their customers from attack. Without this exclusion, S.B. 315 will discourage good actors from reporting vulnerabilities and ultimately increase the likelihood that adversaries will find and exploit the underlying weaknesses."
Google and Microsoft are in the former camp, and have asked Deal to veto the bill, which was passed by the Georgia General Assembly in March and which is nearing its deadline for signing into law. The two giants take issue with a provision in the bill that allows "active defense measures that are designed to prevent or detect unauthorized computer access." In a letter to the governor, the two argued that S.B. 315 "will make Georgia a laboratory for offensive cybersecurity practices that may have unintended consequences and that have not been authorized in other jurisdictions," and that "provisions such as this could easily lead to abuse and be deployed for anti-competitive, not protective purposes." They added: "On its face, this provision broadly authorizes the hacking of other networks and systems under the undefined guise of cybersecurity... [B]efore Georgia endorses the 'hack back' authority in 'defense' or even anticipation of a potential attack with no statutory criteria, it should have a much more thorough understanding of the ramifications of such a policy." Tripwire also filed a letter with the governor's office: "[A]ccording to the wording of S.B. 315, well-intentioned ('white-hat') researchers could be subject to civil or criminal prosecution when following industry best practices in investigating a website for protection from a potential cyber-attack. It is our firm belief that an explicit exception is required to exclude prosecution when the party in question is acting in good-faith to protect a business or their customers from attack. Without this exclusion, S.B. 315 will discourage good actors from reporting vulnerabilities and ultimately increase the likelihood that adversaries will find and exploit the underlying weaknesses."
2 Wrongs DO Make a right! :-D
It's in the BIBLE.
Read IT.
Defending oneself from an attack by using reasonable force isn't a 'wrong'. It's a perfectly sensible thing to do, regardless of how much the leftist elite of Silicon Valley and elsewhere suggest otherwise. It's understandable why those with leftist ideologies dislike the concept of self-defense: it empowers the individual, and allows these individuals to be self-sufficient. That's exactly the opposite of the individual weakness and 'victimization' that those on the political left seek to create. They don't want people and organizations that stand strong on their own. Rather, they want weak, lazy, dependent cogs that are controlled by the state apparatus.
An ip will be discovered.
An ip that can only be connected to one user and their desktop computer.
Follow the ip back and discover one user with a modem in front of their desktop computer.
Every ip is only ever given to one user in front of their computer by an ISP. The ISP ip can only end with a modem.
So every ip can only be a direct connection to one persons desktop computer connected to their modem.
Once that ip is discovered in the wild follow the ip back to the user's computer.
Stop that users desktop computer and their one ISP connection from doing bad things in real time.
Wonder how that will work in the real world with greedy ISP and networks having a lot of users and not wanting to pay for much for fancy "networking"
Follow the bad ip back and discover a suburb is online using one low cost network?
That ip in the wild turned out to be the ISP not the user?
Domestic spying is now "Benign Information Gathering"
Well, I guess they'll just have to post, Anonymously... BWAHAHAHA!
I'm just a soul whose intentions are good
Oh please, don't let me be misunderstood...
Basically what is happening here is that a legal right to defend yourself is being considered. However these companies opposing the measure are doing it for a very particular reason, under the covers they are engaging in what would be called hacking on a massive scale against the american population. What they do not want is that if uncovered it would be open season upon them with no legal consequences. They do not want an organized attack against them whereby social media fuels it, it grows and it becomes a national or international past time to take pot shots at the big names.
Scared little guilty bastards
is a good guy hacking back.
another example of why we need to have informed legislators in gov't. This won't solve anything but to allow companies to attack proxied hosts who have either been compromised themselves or are sitting in public clouds. The latter is the bigger issue which cloud providers struggle with. It may also be true that companies that avail themselves of fighting back may themselves be targets for violation of US Federal law where it comes to illegal computer access.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
... that this Georgia statute-in-waiting could potentially be held to be superceded by 18 U.S. Code 1030 (the section added by the Computer Fraud and Abuse Act of 1986).
CFAA specifically covers unauthorized access to U.S. government computers and computers belonging to or containing information belonging to a "financial organization" - although that definition, in practice, has been considerably stretched charges brought in a number of criminal cases. That broadening of its applicability could, I suspect, theoretically cause an appeal of any conviction under the yet-to-be-enacted Georgia law to be upheld on grounds that it represents an unwarranted overreach by Georgia.
OTOH, IANAL, and how Federal courts might react is going to guesswork on anybody's part (including actual lawyers, and people who play them on TV), until it's both signed into law and challenged at the Federal level ...
Check out my novel.
Have gnu, will travel.
So they want to give vigilante attack powers to entities that are already known for misusing and abuse other less violent forms of activity where they tend to use the shotgun in the room approach without even decent target verification...
Just look at how companies abuse the DMCA and attack innocents already using the law, you give them cyberassualt authority and it will only get much worse for everyone else!
When you go online you open yourself up to data being sent from whoever. This is how the internet works! If you don't like that don't go online. If you don't want data from certain regions, people, etc, or in certain circumstances it's up to you to discard that data. It's up to you not to run buggy software. Your security is up to you. Nobody else. You may be able to thrust your beliefs on a lot of the world. But good luck thrusting your beliefs on everyone everywhere. It's just not going to happen and there is simply no way to secure the internet. You however can secure your own computer and internet via various means not excluding not running proprietary buggy shitware- and having servers setup behind DDoS systems.
So, I spoof the source address of a port scan against a bunch of Georgian companies with some innocent victims address, and being "attacked" they attack innocent victim.
Popcorn time.
Maybe call it cyber swatting :)
Someone willing to break the law can knock innocent businesses and individuals off of the internet with practically zero fear of getting caught or stopped. That's the state of the internet right now. Truly fixing that situation is impossible without a degree of frightening fascism that would be the end of the internet as we know it. I'd love to see a world where there weren't millions of stupidly insecure devices connected to the internet, not to mention the hundreds of thousands of devices with reasonable security still managing to have vulnerabilities that haven't been patched yet. Without a single country controlling what is allowed to connect to the internet (a bad idea,) it's not a solvable problem.
People think that securing your own systems is sufficient to protect your company, but it isn't. In order to protect your business from malicious activity you need control of the fabric outside of your company. A typical small company can't protect the ISP routers that connect them to the internet, and so can't protect themselves against a DDOS. How many hops are between your customer and your website? Unless you're running your website through CloudFront, Azure, or Google; you won't have the resources to absorb the attack without losing business. I remember watching Microsoft get DDOS'd off of the internet, and Google. Even Amazon has had outages, so no matter what you do, your website isn't bulletproof.
The internet gives freedom, enormous freedom, to people, but it's disproportionate. Malicious attackers who don't have to follow the law have more power than people and companies required to do things legally. Bringing balance to that equation, by allowing victims to fight back, could have huge repercussions. They could be great or terrible, but I believe most organizations and people would do less harm than the current law breakers, if they had the freedom to fight back.
I understand the arguments against legalizing fighting back, but honestly the "innocent" people likely to be harmed are the people who were negligent in securing their own equipment. I have a hard time feeling bad for those people.
Some ISP is going to have routers with insecure firmware. Those routers are going to be roped into a DDOS attack that takes some sleezy spamming company's website down and the spammer company is going to kill thousands of innocent consumer routers, who couldn't have secured their routers even if they'd been interested in security and knowledgeable of their options. But what's the result of that?
It's evolution. The free market can solve this problem, but not if the government is so focused on protecting innocents that they protect the law breakers at the expense of those who have to follow the law. The criminals have freedom. I am in favor of giving law abiding people a limited subset of that freedom.
I can argue either side of this argument, but I choose this side to represent. See my user ID.
The law itself looks as strange as. I did not know it could be considered a criminal offence to disclose a password, seriously, what twit put that in there. Freedom of speech means, you are fully entitled to release passwords not necessarily keep your job but certainly claims of a criminal offence are insane. Also you can only access a computer for business purposes, like WTF, social media not allowed, workers social contacts a criminal offence. Let alone an empty 'active defence measures' without defining what an active defence measure are and what are acceptable and what are not and clearly the law is tied to one state. No matter how nuts they try to get with location of the crime, tying it to the residence of the business, regardless of the location of the attack, apparently anywhere in the world or the source of the attack anywhere in the world but it only refers to counties and not states or nations.
You can claim legal what ever you want in what ever crazy state of the US but it will get interesting when it affects other states and countries and whose law applies when, regardless of silly claims about the residence of the owner of the network and ignoring location of the network under attack and or the location of the attacking network.
Chaos - everything, everywhere, everywhen
This will just clog the larger infrastructures who will happily pull the plug on the lot of you.
The major transporters already protect their networks from DDoS, etc.
If you're a supposed "White hat hacker" doing "research" than "best practices" or what I might call "common courtesy" might be that you notify a company of your intentions so as to not raise "undue alarm".
If your intentions are pure than being rebuffed may be disappointing but not alarming or really negative. And with the proper approach you may find that a lot of companies won't mind provided your doing it for no charge, won't publish their names and give them an early viewing of your findings before publishing...after all if you're only doing "research" and you're a "good guy" (white hat hacker) you have no monetary incentive to lie, be cagey or otherwise negatively exploit your findings...right?
Of course this is a fairy tale. Supposed "white hat hackers" are in it for the money (or fame leading to money) and if they happen to find a vulnerability in a "big name" company (for sufficiently large values of "big") I have no doubt they'll exploit that knowledge for their better outcome not the target.
The only difference between "White hat" and "black hat" hackers is their clothing (how they present themselves) and the company they keep.
Could you imagine the idea of a "white hat burglar" breaking in to your company without being hired or at least announcing their intentions for "free" under the guise of "research" or "testing your security", they'd be laughed out of the courtroom as they are carted away for jail time.
Once upon a time, I used to reach out to US-based hosting providers that spammers used. In the unlikely event I received a response back, it was to inform me they won't do anything about Canadian Pharmacy websites unless you can prove that they sent that spam email--being a mere beneficiary of spam is not enough. It took being one of the world's largest spamming operations for McColo to be shut down, and it was done by the upstream service providers. Feds don't have time for this. I propose we take a page from colonial-era maritime law and let private individuals petition the government for the right to seize equipment from bad actors. McColo wouldn't have lasted a week if you could round up about 20 guys to break in at 3 AM and start hauling off servers. Oh, you dealt with that spammer earlier? Take it up with the government when they have the award hearing. This changes the balance from removing spammers whenever someone finally compels you to, to accepting a considerable amount of liability for tolerating a spammer/leaving your infrastructure poorly secured.
Thus this state law is not legal, and the power for authorizing this sort of behavior falls to the Federal Government.
Unless the bill explicitly states that it works only within the state's borders and where all entities involved are within said jurisdiction, this will get struck down on any reasonable challenge.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Shit you not, tarp pit firewall rules are common but apparently some folks have landed in trouble because of it. I got booted off an ISP because someone attempting to brute force my port 22 complained to my ISP. Too 2 weeks and emailing their hacking attempts to explain the situation. Always remember the criminals have more rights then the victims.
If this becomes law, it gets fairly easy to eliminate the competition. Here's how:
1. Find out IP address(es) belonging to your competitor.
2. Find a company that uses "offensive security" to defend itself.
3. Spoof it ip of rival from 1. and attack company from 2.
4. Watch rival go down in flames from the counter attack.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
What sort of " Cybersecurity active defense measures that are designed to prevent or detect unauthorized computer access" would you consider?
If you could legally strike back at attackers, would you? How would you do it?
CEO: we were recently hacked and our customer data was exposed to the world due to our terrible security practices, so we hacked back and DDoS'ed the attackers website!
Media:: that sounds scintillating enough for a front page story, what happened next?
CEO: We're being sued by a hosting provider for the DDOS, and the hackers managed to switch my wifes insulin order with carfentanil, killing her instantly. But hey! hacking back right?
Good people go to bed earlier.
Reading the current wording on the current bill, SB315, states that access without authority is illegal, except when actively attempting to detect and/or prevent unauthorized access.
Basically it is saying is that a third party can access your network without authorization to shutdown a PC infected with malware (ie. a botnet), or trace the malware back to the point origin.
This law crafted to stop embarrassment after last year's public leaks of Georgia voting information over a public internet website.
The way it is written, changing https --> http would be considered an illegal attack.
There will be 50B illegal uses and 1-2 selective prosecutions after someone outside GA points out that some company based in GA left something unintentional on their public-facing servers.
* Equifax
* Cox
* Home Depot
* UPS
* Coca-Cola
* Aflac
* Delta Airlines
* NCR
* Spanx
* Zaxby's
* many others
We know that Equifax will sue first and ask questions later after their screw-ups are public. Same for the State of Georgia and the City of Atlanta. They will leak data, unintentionally, and blame others.
Stopping embarrassment, that is what this law is about.
All of you morons are doing the equivalent of telling a rape victim to just lay back and enjoy it.
And that Bullshit about White Hat Hackers? If you are a "White Hat Hacker", whatever the fuck that means, you will be working on conjunction with the target.
Breaking into someone's home and intending to just leave a note saying, "Hey, you better lock the side door", is still fucking breaking and entering and the home owner is still entitles to shoot your ass.
This bears the seeds of Gibson's dystopian vision of never-ending corporate cyber-warfare. Hard to see how companies could resist using this as a pretext for gaining commercial advantage.
So people are making a huge deal out of this but the reality is, no matter what Georgia state authorizes in terms of retaliatory action, etc, most attacks originate from outside of the state or outside of the country and if a company launched a retaliatory attack across state lines or even country boundaries it would be in federal jurisdiction not state, so this bill would be a moot point.