US cybercrime laws being used to target security researchers
theguardian.com
US cybercrime laws being used to target security researchers
1–10 of 94 posts
Re: US cybercrime laws being used to target security researchers
#2Monied interests want you to play in their safe playground without rocking the boat, the legal and technical enforcement is closing in. Slowly, but the ratchet only turns one direction. I worry that the only reason it hasn't closed in entirely is that smart people exploring is more beneficial to business than not. For now.
Over the last few weeks I've been wondering when the scale flips and general purpose computing will die outright. Things that were once considered forgone conclusions about tech are turning out to be accidents of the fact adoption starts with individuals. How long can tech empowering people continue to outrun the oldschool powers using tech to empower themselves?
Re: US cybercrime laws being used to target security researchers
#3Note that this concerns the subset of security research that involves actively talking to computer systems owned by other people, presumably in production, on the public Internet.
Most security research does not in fact work this way. Consider, for instance, virtually any memory corruption vulnerability; while it was once straightforward (in the 90s) to work out an exploit "blind", today, researchers virtually always have their targets "up on blocks", connected to specialized debugging tools.
I am a little surprised that we are only now hearing about high-profile researchers getting dinged for actively scanning for actual vulnerabilities in other people's deployed systems. It has pretty much always been unlawful to do that.†
(These are descriptive comments, not normative ones. My take on unauthorized testing of systems in production is complicated, but does not mirror that of the CFAA).
It's for this reason that you should be especially appreciative of firms, like Google and Facebook, that post public bug bounties and research pages --- those firms are essentially granting permission for anonymous researchers to test their systems. They don't have to do that. Without those notices, they have the force of law available to prevent people from conducting those tests.
(Background, for what it's worth: full time vulnerability researcher, started in '94.)
† Caveat: it does depend on the vulnerability you're testing for. There are a number of flaws you could test for that would be very difficult to make a case out of. But testing deployed systems without authorization is always risky.
Re: US cybercrime laws being used to target security researchers
#4Monied interests want you to play in their safe playground without rocking the boat, the legal and technical enforcement is closing in. Slowly, but the ratchet only turns one direction. I worry that the only reason it hasn't closed in entirely is that smart people exploring is more beneficial to business than not. For now. Over the last few weeks I've been wondering when the scale flips and general purpose computing…
This is both a comment on vulnerability research and a credible System Of A Down song lyric.
Re: US cybercrime laws being used to target security researchers
#5Monied interests want you to play in their safe playground without rocking the boat, the legal and technical enforcement is closing in. Slowly, but the ratchet only turns one direction. I worry that the only reason it hasn't closed in entirely is that smart people exploring is more beneficial to business than not. For now. Over the last few weeks I've been wondering when the scale flips and general purpose computing…
This is both a comment on vulnerability research and a credible System Of A Down song lyric.
Yeah, it felt kinda trite writing it. I just haven't found a way to articulate the idea without asking myself "Oh, so you're still a teenager getting stoned every day thinking you have thoughts about things, hows that working out for you?" Edit: Maybe I should just lean into it and write a phrack article. I'm sorry, that's a low blow, I enjoyed phrack even when the writing style wasn't my speed.
Re: US cybercrime laws being used to target security researchers
#6Note that this concerns the subset of security research that involves actively talking to computer systems owned by other people, presumably in production, on the public Internet. Most security research does not in fact work this way. Consider, for instance, virtually any memory corruption vulnerability; while it was once straightforward (in the 90s) to work out an exploit "blind", today, researchers virtually always…
So should someone find a remote exploit in OpenWhatever that gives them remote root access and they publicly disclose that (without having tested it on the Internet... just in their lab) then they are not subject to the CFAA?
Re: US cybercrime laws being used to target security researchers
#7this is dumb on many layers - threatening white hat who could be held accountable but could be hired to do further audit; failing to come to grips that if you are insecure enough to threaten someone, you know - internet will find out that you rather than fixing holes in your system rather use expensive lawyers to intimidate people who on the whole trying to a good thing for you.
The whole thing about unauthorized access - not sure about. If you get burglarized and live worse part of town - because you did not lock your front door - is this you fault or criminal's? Ultimately buck stops with you, you would look very stupid arguing that a stranger walked off the street and pinched your laptop, better yet, if you leave your laptop on your front lawn.
Re: US cybercrime laws being used to target security researchers
#8I think this article is misleading to British English readers.
> HD Moore, creator of the ethical hacking tool Metasploit and chief research officer of security consultancy Rapid7, told the Guardian he had been warned by US law enforcement last year over a scanning project called Critical.IO, which he started in 2012.
British might confuse "warning" for what's known in Britain as a "police caution", which is a extra-judicial criminal prosecution, judged summarily by police, and is also referred to as a "formal warning". Such warnings become part of their criminal record in the UK and effect things like employment, as they are in effect a criminal conviction (as I understand it, although the UK describes them as "not a criminal conviction but an admission of guilt [after being accused by the police]", which I view as an irrelevant distinction). There is no such system under federal law in the United States. A UK reader might rationally assume "police cautions" are just called "police warnings" or "US law enforcement warnings" in the US. Police cautions are not something most people in the US know about, and would probably be outraged to know of their existence. (In effect, the police say you admitted to a crime, so they go around telling everyone who asks that you're a criminal. Such as potential employers and landlords.)
At least, to me, that's the implication of the statement.
Re: US cybercrime laws being used to target security researchers
#9Note that this concerns the subset of security research that involves actively talking to computer systems owned by other people, presumably in production, on the public Internet. Most security research does not in fact work this way. Consider, for instance, virtually any memory corruption vulnerability; while it was once straightforward (in the 90s) to work out an exploit "blind", today, researchers virtually always…
"...testing deployed systems without authorization is always risky..."
While what you describe may be the sad reality, it makes zero sense. If a legit researcher, 'specially one that's being transparent about it, researches any domestic system, then that's got to be better than the Iranians, Russians or Chinese doing it (which they do anyway).
But hey, what do we know anyway. There's probably some benefit that makes it preferable for a foreign party to uncover our vulnerabilities without our knowledge.
Re: US cybercrime laws being used to target security researchers
#10Call your congress critter, form a PAC, and elected one of your own. If you are in a gerrymandered district, join the party that controls that district, and primary the congress critter out.