6 ms·
I would think not. For something bad to happen from registering the domain, there would have to be some kind of weird booby-trap in the malware. What's the moti
by ufmace 9y ago
I would think not. For something bad to happen from registering the domain, there would have to be some kind of weird booby-trap in the malware. What's the motivation for a malware author to do that? If they can do something worse, the incentive is to just do it, rather than wait for a security researcher to do something first that they may or may not ever do. It's not impossible, but it's a little ridiculous and wildly unprecedented in the field of malware analysis.
When there's a global infection spreading wildly and crippling essential organizations, you want everyone to act fast, not spend weeks making sure everything is perfect. If you see the malware connecting out to an unregistered domain, you just register it now. Whoever is first gets it, and the attacker could realize their mistake at any time. Even without knowing what this malware does with the connection, odds are 99.9% that the situation is better with the domain controlled by a security researcher than by a malware author. Punishing researchers if something done in good faith turned out badly would incentivize them to overanalyze everything and delay taking any potential beneficial action until it's too late.
- SomeStupidPoint 9y agoSecurity researchers absolutely should have liability for poking malware in the wild on their own initiative. If you're a bomb enthusiast or researcher, you'd absolutely be liable if you tried to defuse a bomb without being requested to by the police. This is no different because of the potential for massive collateral damage. You want to see what happens when the domain is registered? Resolve the DNS on your own network. It's only when acting under government direction that you should be immunized from liability.
- AmIFirstToThink 9y agoWhew, you almost got me. :-) Got all riled up and then saw the username. Enjoy!
- SomeStupidPoint 9y agoI was being serious. I am curious why you disagree with me, though.
- jldugger 9y agoFolks disagree with you for the same reason they pass [good samaritan laws](https://en.wikipedia.org/wiki/Good_Samaritan_law https://en.wikipedia.org/wiki/Good_Samaritan_law): intent. A bit more econo-mathematically stated: we expect more good than bad to come by us if we indemnify them from whatever liability they may have had by accidentally triggering the mechanism. Perhaps because there's more smart people outside the government than inside it, just as there are more smart people outside any corporation than inside it, or anywhere really, because human ingenuity is widely distributed.
- SomeStupidPoint 9y agoMy exact point was that this was closer to diffusing a bomb you happen across than a good Samaritan law because of the collateral damage potential, which we normally assess the tradeoffs of through collective means such as government, and because it's a non-emergency situation. Good Samaritan laws only apply to emergency care rendered to people in need of it (and only if they don't refuse). You wouldn't even be covered if you grabbed someone's broken arm and tried to set it without permission. (That would actually be assault, for which you'd be liable.) You definitely wouldn't be covered if you unilaterally released a protein in to the atmosphere because you suspected it would stop the flu. You'd probably get charged with using a WMD if it backfired and people got sick. I think people who are arguing that it's a good Samaritan situation are simply being selfish, because they don't want to have to consider how their actions might impact others or act with restraint and professionalism. There are plenty of ways to proceed with getting help from security consultants even if there is liability -- eg, confining their actions to a single network and being indemnified by the owner. Globally poking a widespread infection without a care in what the infected prefer is emphatically not what Good Samaritan laws are meant to protect and should carry global liability. Ed: To address the question under me, since I'm "posting too fast" -- My problem is that many of these FBI programs exist in a legal limbo -- the researchers are working with the government, but I'm not sure they have the kinds of immunization agreements that government contractors usually get (eg, that you have to sue the government not the contractor since the actions are taken under government authority because you're working for the government) nor that they have to observe the restrictions placed on government actions. Too much of cyber security exists in these (intentionally) gray areas. I dislike this Wild West state of affairs and want the matter of liability and restrictions/accountability to be directly addressed, even if it's just making de jure the de facto situation. I think cybersecurity, as currently practiced, is probably ripe for some nasty lawsuits if a researcher screws up a situation like this. Does anyone believe that if the registering the DNS address had bricked the NHS systems, the NCSC would've taken the fall?
- syshum 9y ago>>It's only when acting under government direction that you should be immunized from liability. Why? I 10000% disagree that the Government should be immunized from liability in the first place. This entire mess is a direct result of the NSA not being held accountable and hoarding Vulnerabilities. Your reliance on government == good, everyone else === bad is alarming to me. That said, I do not believe neither the government nor a Research should be held liable under the circumstance proposed in the hypothetical we are discussion. I do believe the NSA should be required by law and policy to alert any and all software vendors to vulnerabilities they discover.
- eterm 9y agoUnder that same assumption of assuming maximum damage, what was the motivation for the malware author to put in a killswitch?
- Natanael_L 9y agoSomebody else hijacking the c&c servers?
- tgb 9y agoThe end of the article suggests it's an attempt to detect sandboxed environments that fake all domains.
- 13of40 9y agoI don't think that's a thing. And certainly not a common enough thing to use as a sandbox evasion technique. The sandbox is either connected to the internet or to a proxy that replays past connections.
- 300bps 9y agoMany sandbox environments resolve whatever they're queried for with the same IP address. This is addressed in the article.
- 13of40 9y agoHow many ISPs spoof failed DNS queries so they can feed you ads? That alone would make this useless as an evasion technique.
- lmm 9y agoIt means the malware would not execute for users on those ISPs because they false-positive for being a sandbox; that doesn't make it useless unless every ISP is doing that.
- 9y ago