6 ms·

>>Why is this "sending a chill through the security community"? because a lot of legitimate security research when viewed through the myopic and cynical lens o

by syshum 9y ago

>>Why is this "sending a chill through the security community"? because a lot of legitimate security research when viewed through the myopic and cynical lens of a Federal Agent can be seen as illegal, this is an ongoing and ever present fear for people in the field. The FBI claims he is a malware creator and arrested him for it, you seem to believe fully this narrative of the FBI with no room for the FBI to view completely innocent actions as something else. No room for the FBI to be in error, no room for the FBI to be wrong. The government has routinely, time and time again, over extended and prosecuted several people wrongly under CFAA, which is a terrible and broad law that can be applied at will to many innocent every day computer actions.

tptacek 9y ago
What legitimate security research are we talking about? I work in vulnerability research and not malware research, but: can we name anyone who has been prosecuted for what turned out to clearly be benevolent research work?
- comex 9y ago
  It depends how you define “research”. - Weev’s harvesting and publication of iPad owners’ email addresses was far from benevolent, but it also wasn’t exactly hardcore hacking; IIRC he just changed a URL parameter. As you know, it’s not that far from what white hats sometimes do, in terms of probing public websites - with the obvious exception that they’d usually responsibly disclose the vulnerability to the site owner, rather than publishing people’s data! - Barrett Brown was charged with (among other things) republishing a link to data someone else had leaked. That falls more into the category of journalism than research, and ultimately the charge was dropped, but it still fits a theme of overzealous use of <s>the CFAA</s>. edit: that wasn’t the CFAA, but same idea.
  - tptacek 9y ago
    I follow what you're saying, but look at these cases: Aurenheimer was confronted with IRC logs in which he discussed selling the information he got from the website, and Barrett Brown was accused of actively assisting the people who breached Stratfor. What ever you think of the actual prosecutions here, neither of those are cases of security research being mistaken for something else. The most you can say, for instance, about Brown is that he is not as closely connected to an extraordinarily serious crime as the DOJ believed he was.
    - DuskStar 9y ago
      Regarding Weev, should planning on selling the data really affect the legality of his behavior? I mean, there are services that sell data they scrape from websites after all.
      - tptacek 9y ago
        Yes? Of course it would?
        DuskStar 9y ago
        I guess I'm looking at it like this: 1. Someone physically breaks into factory, steals a list of customers for the purpose of (selling to competitors/personal interest) 2. Someone drives around the country and records locations of $company infrastructure, in an industry where optimal placement provides a major competitive advantage, for the purpose of (selling to competitors/personal interest) In both cases, the person now has information that the target would rather keep private, and in both I would assume that their plans for the data would be irrelevant to the legality of gathering that data. (I'd assume case 1 would be illegal either way, and 2 legal either way) So if Weev's actions are akin to breaking into/hacking a system, then case 1 would apply - but if it was closer to looking at publicly exposed information, then the situation would be like case 2. But either way, I don't think his reasons for taking the actions (or after the fact plans on what to do with the data) would affect the legality of what he did. Of course, IANAL and US computer law seems to be completely screwed up so maybe it would matter. I just don't see how.
        tptacek 9y ago
        There are two elements to almost every crime in the US criminal justice: conduct and intent. Without provable intent, inappropriate conduct is often excused. Without inappropriate conduct, predatory intent is almost never prosecutable. Your first case has both prohibited conduct and intent (actually, with or without the intent to sell the data, I think deliberately breaking into a factory is itself criminal). Your second case does not.
  - marcoperaza 9y ago
    As to your first example, there seems to be this pervasive idea in tech culture that something shouldn't be a serious crime or tort because it is so easy to do. I see the argument very often in cases of unauthorized access and copyright infringement. Murder is also rather easy, and we execute people for it.
    - tptacek 9y ago
      That's not what he's saying. He's saying that independent of how easy it is to do, it's also something that professional security people do routinely. And he's right. But that's not the basis of the charge against Aurenheimer.
      - marcoperaza 9y ago
        >That's not what he's saying. He's saying that independent of how easy it is to do, it's also something that professional security people do routinely. And he's right. But that's not the basis of the charge against Aurenheimer. It's certainly part of what he said: >but it also wasn’t exactly hardcore hacking; IIRC he just changed a URL parameter. The difficulty of carrying out an action is completely irrelevant to its legality.
        tptacek 9y ago
        I agree with you that the "hardcoreness" of what Aurenheimer did is a red herring.
        Ilurkyeahsowat 9y ago
        Even if he did attempt to sell the data, is it illegal to sell data that is freely available on the internet (honest question, I couldnt find a solid answer via googling)? It might be against TOS.
- syshum 9y ago
  Actual prosecutions of malware creators are exceedingly rare to almost none existent. As such I believe there are extreme pressure on law enforcement to "Make an example" of some malware creator, or anyone they can even remotely connect to the creation of malware. This pressure I believe will lead them to over reach on CFAA like they have in the past in other "hacking" cases https://www.wired.com/2015/10/cfaa-computer-fraud-abuse-act-most-controversial-computer-hacking-cases/ https://www.wired.com/2015/10/cfaa-computer-fraud-abuse-act-... So while I can not point to an example right now, that is simply because there is a general lack of case law in the field to begin with, nor does that support a position that the FBI is correct in this case, or would never go after a innocent security research, their history defies that completely.
- zippy 9y ago
  "can we name anyone who has been prosecuted for what turned out to clearly be benevolent research work?" Randal Schwartz https://en.wikipedia.org/wiki/Randal_L._Schwartz https://en.wikipedia.org/wiki/Randal_L._Schwartz
  - tptacek 9y ago
    Yeah, I think you'll find when you dig into the details that that case is not a great example for you.
    - syshum 9y ago
      https://w2.eff.org/legal/cases/Intel_v_Schwartz/schwartz_case.intro https://w2.eff.org/legal/cases/Intel_v_Schwartz/schwartz_cas... Seems to be clear example to me
    - sqeaky 9y ago
      Instead of doubt, can you give us concrete reasons?
      - tptacek 9y ago
        This is from memory, but it's been discussed on HN before, so you can also consult the search bar. Schwartz had a contract to do sysadmin work for Intel. In the course of doing that work, he backdoored some of the systems he worked on. After his employment with the firm that had staffed him at Intel concluded, he continued to use those backdoors to access Intel's systems. His claim is that it was necessary to do so, in order to complete work Intel had asked him to do. But from what I recall, he was caught using those backdoors after any relationship he'd had with Intel had been severed. It's not the crime of the century, but it's not a case of someone doing benevolent security research getting caught. Nobody practicing today would backdoor a client computer, use the backdoor after their engagement had ended, and expect anyone to find that action defensible.
  - nl 9y ago
    That isn't a great example. He managed to get his conviction overturned because of the lack of criminal intent, but what he did was pretty stupid. Rather ill-advisedly, the Perl-programming guru (who's written several books on the subject) tried to prove his worth by running a password cracking package after he'd left in order to produce evidence that security practices had deteriorated since his departure. Instead of re-hiring Schwartz, as he hoped, Intel called in the police and he was charged with hacking offences. http://www.theregister.co.uk/2007/03/05/intel_hacker_charges_quashed/ http://www.theregister.co.uk/2007/03/05/intel_hacker_charges...
watty 9y ago
But he wasn't arrested for any normal thing a security researcher would do - he's arrested for creating and selling malware... big difference. The FBI could be wrong and that'd suck. I'm just assuming that the FBI and their resources have enough evidence to reasonably believe he's the creator. And again, your last comment doesn't fit this article. They aren't overextending and arresting a security researcher (although he is one), they're arresting someone whom they believe is a malware creator and distributor.
- syshum 9y ago
  The FBI claims he created malware, an unnamed co-conspirator is charged with selling it So you generally believe people are guilty until proven innocent, and I always believe people are innocent until they are proven guilty. I never take the government word for anything, and generally assume the government is lying at all times. History supports my position. I find it extremely alarming how quickly people just believe the FBI's assertions as fact with almost no actual evidence being presented
  - watty 9y ago
    Correct, I don't think the FBI is making up evidence about Marcus and they actually believe he's the creator of Kronos. Sounds crazy, I know.
    - syshum 9y ago
      >> Sounds crazy, I know. At least you admit that believing the FBI is crazy, maybe there is hope for you.
  - comex 9y ago
    > So you generally believe people are guilty until proven innocent, and I always believe people are innocent until they are proven guilty. “Innocent until proven guilty” is a legal standard applied where “guilty” means having one’s liberty taken away. And in that context it’s a perfectly appropriate standard. But as mere spectators, where the harm caused by mistakenly believing he’s guilty is minimal, I think we should feel free to simply believe in the most likely possibility (aka preponderance of the evidence). You may disagree on that point, and that’s your right. However, if we agree to apply that standard, I don’t think it’s reasonable to believe that the FBI’s allegations being false is actually more likely than the alternative. > I never take the government word for anything, and generally assume the government is lying at all times. History supports my position. [citation needed]
BinaryIdiot 9y ago
> because a lot of legitimate security research when viewed through the myopic and cynical lens of a Federal Agent can be seen as illegal, this is an ongoing and ever present fear for people in the field. While I tend to agree that this is possible, the parent's point was how unrelated this was to WC and to any research occurring in the field. It's strictly a case of "this guy wrote malware and sold it". > you seem to believe fully this narrative of the FBI with no room for the FBI to view completely innocent actions as something else. No room for the FBI to be in error, no room for the FBI to be wrong. I'm confused. The parent simply stated he was arrested for that. How does that translate into "Parent believes 100% what the FBI states with no room for the FBI to be wrong"?

by syshum 9y ago

tptacek 9y ago

What legitimate security research are we talking about? I work in vulnerability research and not malware research, but: can we name anyone who has been prosecuted for what turned out to clearly be benevolent research work?

comex 9y ago
It depends how you define “research”. - Weev’s harvesting and publication of iPad owners’ email addresses was far from benevolent, but it also wasn’t exactly hardcore hacking; IIRC he just changed a URL parameter. As you know, it’s not that far from what white hats sometimes do, in terms of probing public websites - with the obvious exception that they’d usually responsibly disclose the vulnerability to the site owner, rather than publishing people’s data! - Barrett Brown was charged with (among other things) republishing a link to data someone else had leaked. That falls more into the category of journalism than research, and ultimately the charge was dropped, but it still fits a theme of overzealous use of <s>the CFAA</s>. edit: that wasn’t the CFAA, but same idea.
- tptacek 9y ago
  I follow what you're saying, but look at these cases: Aurenheimer was confronted with IRC logs in which he discussed selling the information he got from the website, and Barrett Brown was accused of actively assisting the people who breached Stratfor. What ever you think of the actual prosecutions here, neither of those are cases of security research being mistaken for something else. The most you can say, for instance, about Brown is that he is not as closely connected to an extraordinarily serious crime as the DOJ believed he was.
  - DuskStar 9y ago
    Regarding Weev, should planning on selling the data really affect the legality of his behavior? I mean, there are services that sell data they scrape from websites after all.
    - tptacek 9y ago
      Yes? Of course it would?
      - DuskStar 9y ago
        I guess I'm looking at it like this: 1. Someone physically breaks into factory, steals a list of customers for the purpose of (selling to competitors/personal interest) 2. Someone drives around the country and records locations of $company infrastructure, in an industry where optimal placement provides a major competitive advantage, for the purpose of (selling to competitors/personal interest) In both cases, the person now has information that the target would rather keep private, and in both I would assume that their plans for the data would be irrelevant to the legality of gathering that data. (I'd assume case 1 would be illegal either way, and 2 legal either way) So if Weev's actions are akin to breaking into/hacking a system, then case 1 would apply - but if it was closer to looking at publicly exposed information, then the situation would be like case 2. But either way, I don't think his reasons for taking the actions (or after the fact plans on what to do with the data) would affect the legality of what he did. Of course, IANAL and US computer law seems to be completely screwed up so maybe it would matter. I just don't see how.
        tptacek 9y ago
        There are two elements to almost every crime in the US criminal justice: conduct and intent. Without provable intent, inappropriate conduct is often excused. Without inappropriate conduct, predatory intent is almost never prosecutable. Your first case has both prohibited conduct and intent (actually, with or without the intent to sell the data, I think deliberately breaking into a factory is itself criminal). Your second case does not.
- marcoperaza 9y ago
  As to your first example, there seems to be this pervasive idea in tech culture that something shouldn't be a serious crime or tort because it is so easy to do. I see the argument very often in cases of unauthorized access and copyright infringement. Murder is also rather easy, and we execute people for it.
  - tptacek 9y ago
    That's not what he's saying. He's saying that independent of how easy it is to do, it's also something that professional security people do routinely. And he's right. But that's not the basis of the charge against Aurenheimer.
    - marcoperaza 9y ago
      >That's not what he's saying. He's saying that independent of how easy it is to do, it's also something that professional security people do routinely. And he's right. But that's not the basis of the charge against Aurenheimer. It's certainly part of what he said: >but it also wasn’t exactly hardcore hacking; IIRC he just changed a URL parameter. The difficulty of carrying out an action is completely irrelevant to its legality.
      - tptacek 9y ago
        I agree with you that the "hardcoreness" of what Aurenheimer did is a red herring.
      - Ilurkyeahsowat 9y ago
        Even if he did attempt to sell the data, is it illegal to sell data that is freely available on the internet (honest question, I couldnt find a solid answer via googling)? It might be against TOS.
syshum 9y ago
Actual prosecutions of malware creators are exceedingly rare to almost none existent. As such I believe there are extreme pressure on law enforcement to "Make an example" of some malware creator, or anyone they can even remotely connect to the creation of malware. This pressure I believe will lead them to over reach on CFAA like they have in the past in other "hacking" cases https://www.wired.com/2015/10/cfaa-computer-fraud-abuse-act-most-controversial-computer-hacking-cases/ https://www.wired.com/2015/10/cfaa-computer-fraud-abuse-act-... So while I can not point to an example right now, that is simply because there is a general lack of case law in the field to begin with, nor does that support a position that the FBI is correct in this case, or would never go after a innocent security research, their history defies that completely.
zippy 9y ago
"can we name anyone who has been prosecuted for what turned out to clearly be benevolent research work?" Randal Schwartz https://en.wikipedia.org/wiki/Randal_L._Schwartz https://en.wikipedia.org/wiki/Randal_L._Schwartz
- tptacek 9y ago
  Yeah, I think you'll find when you dig into the details that that case is not a great example for you.
  - syshum 9y ago
    https://w2.eff.org/legal/cases/Intel_v_Schwartz/schwartz_case.intro https://w2.eff.org/legal/cases/Intel_v_Schwartz/schwartz_cas... Seems to be clear example to me
  - sqeaky 9y ago
    Instead of doubt, can you give us concrete reasons?
    - tptacek 9y ago
      This is from memory, but it's been discussed on HN before, so you can also consult the search bar. Schwartz had a contract to do sysadmin work for Intel. In the course of doing that work, he backdoored some of the systems he worked on. After his employment with the firm that had staffed him at Intel concluded, he continued to use those backdoors to access Intel's systems. His claim is that it was necessary to do so, in order to complete work Intel had asked him to do. But from what I recall, he was caught using those backdoors after any relationship he'd had with Intel had been severed. It's not the crime of the century, but it's not a case of someone doing benevolent security research getting caught. Nobody practicing today would backdoor a client computer, use the backdoor after their engagement had ended, and expect anyone to find that action defensible.
- nl 9y ago
  That isn't a great example. He managed to get his conviction overturned because of the lack of criminal intent, but what he did was pretty stupid. Rather ill-advisedly, the Perl-programming guru (who's written several books on the subject) tried to prove his worth by running a password cracking package after he'd left in order to produce evidence that security practices had deteriorated since his departure. Instead of re-hiring Schwartz, as he hoped, Intel called in the police and he was charged with hacking offences. http://www.theregister.co.uk/2007/03/05/intel_hacker_charges_quashed/ http://www.theregister.co.uk/2007/03/05/intel_hacker_charges...

watty 9y ago

But he wasn't arrested for any normal thing a security researcher would do - he's arrested for creating and selling malware... big difference. The FBI could be wrong and that'd suck. I'm just assuming that the FBI and their resources have enough evidence to reasonably believe he's the creator. And again, your last comment doesn't fit this article. They aren't overextending and arresting a security researcher (although he is one), they're arresting someone whom they believe is a malware creator and distributor.

syshum 9y ago
The FBI claims he created malware, an unnamed co-conspirator is charged with selling it So you generally believe people are guilty until proven innocent, and I always believe people are innocent until they are proven guilty. I never take the government word for anything, and generally assume the government is lying at all times. History supports my position. I find it extremely alarming how quickly people just believe the FBI's assertions as fact with almost no actual evidence being presented
- watty 9y ago
  Correct, I don't think the FBI is making up evidence about Marcus and they actually believe he's the creator of Kronos. Sounds crazy, I know.
  - syshum 9y ago
    >> Sounds crazy, I know. At least you admit that believing the FBI is crazy, maybe there is hope for you.
- comex 9y ago
  > So you generally believe people are guilty until proven innocent, and I always believe people are innocent until they are proven guilty. “Innocent until proven guilty” is a legal standard applied where “guilty” means having one’s liberty taken away. And in that context it’s a perfectly appropriate standard. But as mere spectators, where the harm caused by mistakenly believing he’s guilty is minimal, I think we should feel free to simply believe in the most likely possibility (aka preponderance of the evidence). You may disagree on that point, and that’s your right. However, if we agree to apply that standard, I don’t think it’s reasonable to believe that the FBI’s allegations being false is actually more likely than the alternative. > I never take the government word for anything, and generally assume the government is lying at all times. History supports my position. [citation needed]

BinaryIdiot 9y ago

> because a lot of legitimate security research when viewed through the myopic and cynical lens of a Federal Agent can be seen as illegal, this is an ongoing and ever present fear for people in the field. While I tend to agree that this is possible, the parent's point was how unrelated this was to WC and to any research occurring in the field. It's strictly a case of "this guy wrote malware and sold it". > you seem to believe fully this narrative of the FBI with no room for the FBI to view completely innocent actions as something else. No room for the FBI to be in error, no room for the FBI to be wrong. I'm confused. The parent simply stated he was arrested for that. How does that translate into "Parent believes 100% what the FBI states with no room for the FBI to be wrong"?