11 ms·

Telling the Truth About Defects in Technology Should Never Be Illegal

432 points by severine 8y ago

crankylinuxuser 8y ago
That's fine. If Congress illegalizes speech of this nature, then public disclosures of exploits and other code errors won't happen nearly as often. So what would happen then? There's many, many organizations that are willing to pay for exploits, because they plan to use them. There's one such company in DC that is likely to sell to the defense industry. For a 0-day no click exploit, $500k . So sure, make it illegal. You only push this into the illegal side of operations and exploits. And I would much rather have exploits well known, so I can make the determination to: do nothing, take service down until fixed, or try to patch if available.
- amelius 8y ago
  It should then also be illegal to disclose exploits of the tax system, etc. Hacking is not limited to electronics, but can also happen to any of our social/legal constructs.
  - crankylinuxuser 8y ago
    Ugh. Your comment reminds me of the Etherium DAO debacle. Is the law the actual legal code, or should it be conjoineded with the spirit and justification for the law? If the law is the law, devoid of underlying reason, then it is no exploit to discuss edge cases in the law. It is indeed the law, regardless the intentions upon initial discussion and passing. It also doesn't hurt that most of these edge cases can only be triggered with large amounts of money. Us normal people can look at the edge cases, but never touch.
- fosco 8y ago
  what company?
- rixrax 8y ago
  >> For a 0-day no click exploit, $500k . Which company is that again? You hang around with them cybersec folks too long and you keep hearing about these 6 or 7-figure payouts for expl0its by some mysterious companies. But it's always someones friend or friend of friend or some other 'reliable' source. Can someone here actually say that they have received, or more importantly, are on a consistent basis getting 6-figure payouts for their exploits? For reference, Microsoft offers bug bounties up-to $250k[0]. I can see that in light of this, it's not entirely unreasonable that some tax payer money has been wasted on buying an exploit or two for large amounts of $$$. But what I am calling into question is the myth of consistent 6/7-figure payouts for 'exploits' when sold to 'shady' companies or that such payments would be common place or such markets being generally available to security 'researchers' (read exploit developers). Intrigued to be proven wrong here! :) [0] URL: https://www.microsoft.com/en-us/msrc/bounty https://www.microsoft.com/en-us/msrc/bounty
  - cortesoft 8y ago
    > Can someone here actually say that they have received, or more importantly, are on a consistent basis getting 6-figure payouts for their exploits? I am not going to make any claim on whether people are or are not receiving payments, but anyone who actually is would clearly not disclose it directly, because that would most likely break the terms of the payment. The fact that no one is saying are getting paid directly for exploits is not evidence that it is not happening.
  - wepple 8y ago
    https://zerodium.com/program.html https://zerodium.com/program.html This is fairly vague, and “up to $X” butnpossibly provides a touch more concrete-ness than you’ve seen so far. You’re right though; you won’t find anyone who is currently selling 0day exploits to brokers or govt who will be willing to go on record. Or even admit that they sell them.
    - rixrax 8y ago
      Thanks for this link. It looks like my skepticism may not have been well founded. Are there [many] other similar companies out there? Now that my curiosity peaked, they are the only one mentioned in Wikipedia[0] related to this activity. And as an add-on question to satisfy my curiosity, how would one know when approaching company such as one linked here that the exploit sold will be used by good-guys<tm> and doesn't come to haunt you later when it ends up being used by bad-guys<tm>? [0] https://en.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.wikipedia.org/wiki/Market_for_zero-day_exploits
ikeboy 8y ago
This is obfuscating the law. It’s not illegal to disclose anything, it’s illegal to hack (in certain circumstances). Nobody is getting prosecuted for disclosure, they’re getting prosecuted for hacking. Now, maybe those forms of hacking should be legal. I’m sympathetic to their cause. But it’s disingenuous to frame this as disclosure being illegal. As a side note, the post implies companies are using criminal sanctions as a threat to prevent disclosure - this is itself illegal extortion.
- Drakim 8y ago
  If I buy a Bluetooth SmartLock, is it illegal for me to to attempt to open my own lock without the key to see if the product actually works?
  - ikeboy 8y ago
    Probably, it isn't trying to protect anything copyrighted. Ask a lawyer to be sure
    - Drakim 8y ago
      Wouldn't the software inside the lock be copyrighted?
      - delinka 8y ago
        But you're not trying to access the software, you're trying to unlock the lock. DMCA concerns itself with copyrighted works behind some protection mechanism: technically, if you're accessing the lock's firmware, discover it's encrypted, then attempt to decrypt it, you're violating the DMCA. In addition, if you publish the decrypted software, you're infringing copyright. In either case, these are probably not CFAA violations.
  - Meist1 8y ago
    Depends on the lock and the method of attack you are using - CFAA violations are usually tied to 18 USC §1030 (4) (https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030), which only apply to "protected computer[s]" A computer is protected (18 USC §1030(e)(2)) in generally one of three circumstances - i) Used exclusively by a financial institution; ii) Used exclusively by the US Gov't; or iii) Affects foreign commerce or communication [usually interpreted to mean connected to the Internet] Therefore, if you are using a non-internet connected device (i.e. Bluetooth or NFC only), it's unlikely to be a violation of the CFAA. NOT LEGAL ADVICE, SEEK YOUR OWN LICENSED ATTORNEY
elronster 8y ago
This is easy to get around. Just release the information anonymously on an anonymous platform.
- JamesUtah07 8y ago
  Yea but most platforms, that garner any attention, are not actually anonymous in ways that would protect the person releasing the information.
  - wepple 8y ago
    The full-disclosure mailing list has been around 20 years and has no problem garnering attention. Sending an anonymous email in that direct with no way to track back isn’t particularly difficult.
- adrianN 8y ago
  A possibility to avoid punishment doesn't make wrong laws right.
LinuxBender 8y ago
There are a large number of penetration testers that operate in the open because it is legal and there are frameworks for disclosure. What happens when we make this illegal? Will those people simply cease and desist?
tptacek 8y ago
You read Cory Doctorow talking about vulnerability research and you get the impression that there's a war out there on security researchers. But of course, everything else in Doctorow's article aside, there isn't: the field of vulnerability research has never been healthier, and there have never been more companies explicitly authorizing testing of their servers than there are now. There isn't an epidemic of prosecutions of vulnerability researchers --- in fact, there are virtually no such prosecutions, despite 8-10 conferences worth of well-publicized independent security teardowns of everything from payroll systems to automotive ECUs. There are so many random real-world things getting torn down by researchers that Black Hat USA (the industry's biggest vuln research conference) had to make a whole separate track to capture all the stunt hacking. I can't remember the last time someone was even C&D'd off of giving a talk. I'm a vulnerability researcher (I've been doing that work professionally since the mid-1990s) I've been threatened legally several times, but all of them occurred more than 8 years ago. It has never been better or easier to be a vulnerability researcher. Telling the truth about defects in technology isn't illegal. Doctorow has no actual connection to the field, just a sort of EFF-style rooting interest in it. I'm glad he approves of the work I do, but he's not someone who I'd look to for information about what's threatening us. I'm trying think of something that might be a threat... credentialism, maybe? That's the best I can come up with. Everything is easier today, more tools are available, things are cheaper, more technical knowledge is public; there are challenges in other parts of the tech industry, but vuln research, not so much.
- icc97 8y ago
  > the field of vulnerability research has never been healthier, and there have never been more companies explicitly authorizing testing of their servers than there are now. > in fact, there are virtually no such prosecutions > Telling the truth about defects in technology isn't illegal. These statements don't seem to add up. If it's legal to tell about defects, then all of EFF's work (on this case) is a waste of time and they're spreading misinformation. If it's legal to do what they're doing then there should be zero prosecutions. Companies wouldn't need to authorize anyone because what they are doing is legal. Edit: added some clarification
  - 8y ago
rotrux 8y ago
Ok so I do appreciate the EFF's zeal in preemptively quashing a bug-hunter-hunt, but here's a scenario that throws their thesis into question: Bank of 'MURICA (Bo'M) gets a phone call from some random guy (Jack) who identifies a bug in the interface between PoS systems at gas stations across the US, and whatever Bo'M internal software-mega-structure manages checking acct balances for Bo'M customers. Now, Jack is a good Samaritan; he would never use this information to steal from millions of Bo'M customers...but like...he totally could. Jack's sister Jill overhears her brother's conversation with Bo'M's security team, & decides everyone needs to know immediately about Bo'M's negligence. Lets pretend it's going to take a ~month to fix the interface. Is it cool for Jill to get on Reddit and post the code necessary to exploit the bug before Bo'M has a chance to protect their customers? Is this a victimless act? Was she just being responsible? Should she have waited to be responsible?
- deleted 8y ago
  [deleted]
- Chardok 8y ago
  Okay, but what about potential customers of BoA that have no idea that the bank they want to entrust their money to has a huge known exploit that increases their chances of identity theft? Does the customer not have a right to know what they are signing up for?
  - tptacek 8y ago
    I have bad news for you. I don't know what bank you use, but I know this: your bank has huge exploits that increase your chance for identity theft.
    - Chardok 8y ago
      I'm sure it does. Even if I already was a BoA customer in this theoretical scenario, I would also prefer to be in the know to avoid that specific POS/gas station company until the issue was resolved, instead of wondering why my identity was stolen and dealing with the fallout with my bank unknowingly to blame.
mdsareckcfsck 8y ago
Attempting to have a reasonable conversation in this thread is impossible because mods have allowwed certain accounts to post as much as they want and brigade counter opinions.
- dang 8y ago
  Most accounts are allowed to post as much as they want! We do put rate limits on some if they have a history of posting too many low-quality comments too quickly, or of getting involved in flamewars. Also, new accounts are rate limited for a while, to cut back on trolling. If you or anyone else has a rate limited account and would like us to lift the rate limit, you're welcome to email us at hn@ycombinator.com. We're happy to do that if we believe there's an intention to use HN as intended in the future.

432 points by severine 8y ago

That's fine. If Congress illegalizes speech of this nature, then public disclosures of exploits and other code errors won't happen nearly as often. So what would happen then? There's many, many organizations that are willing to pay for exploits, because they plan to use them. There's one such company in DC that is likely to sell to the defense industry. For a 0-day no click exploit, $500k . So sure, make it illegal. You only push this into the illegal side of operations and exploits. And I would much rather have exploits well known, so I can make the determination to: do nothing, take service down until fixed, or try to patch if available.

amelius 8y ago
It should then also be illegal to disclose exploits of the tax system, etc. Hacking is not limited to electronics, but can also happen to any of our social/legal constructs.
- crankylinuxuser 8y ago
  Ugh. Your comment reminds me of the Etherium DAO debacle. Is the law the actual legal code, or should it be conjoineded with the spirit and justification for the law? If the law is the law, devoid of underlying reason, then it is no exploit to discuss edge cases in the law. It is indeed the law, regardless the intentions upon initial discussion and passing. It also doesn't hurt that most of these edge cases can only be triggered with large amounts of money. Us normal people can look at the edge cases, but never touch.
fosco 8y ago
what company?
rixrax 8y ago
>> For a 0-day no click exploit, $500k . Which company is that again? You hang around with them cybersec folks too long and you keep hearing about these 6 or 7-figure payouts for expl0its by some mysterious companies. But it's always someones friend or friend of friend or some other 'reliable' source. Can someone here actually say that they have received, or more importantly, are on a consistent basis getting 6-figure payouts for their exploits? For reference, Microsoft offers bug bounties up-to $250k[0]. I can see that in light of this, it's not entirely unreasonable that some tax payer money has been wasted on buying an exploit or two for large amounts of $$$. But what I am calling into question is the myth of consistent 6/7-figure payouts for 'exploits' when sold to 'shady' companies or that such payments would be common place or such markets being generally available to security 'researchers' (read exploit developers). Intrigued to be proven wrong here! :) [0] URL: https://www.microsoft.com/en-us/msrc/bounty https://www.microsoft.com/en-us/msrc/bounty
- cortesoft 8y ago
  > Can someone here actually say that they have received, or more importantly, are on a consistent basis getting 6-figure payouts for their exploits? I am not going to make any claim on whether people are or are not receiving payments, but anyone who actually is would clearly not disclose it directly, because that would most likely break the terms of the payment. The fact that no one is saying are getting paid directly for exploits is not evidence that it is not happening.
- wepple 8y ago
  https://zerodium.com/program.html https://zerodium.com/program.html This is fairly vague, and “up to $X” butnpossibly provides a touch more concrete-ness than you’ve seen so far. You’re right though; you won’t find anyone who is currently selling 0day exploits to brokers or govt who will be willing to go on record. Or even admit that they sell them.
  - rixrax 8y ago
    Thanks for this link. It looks like my skepticism may not have been well founded. Are there [many] other similar companies out there? Now that my curiosity peaked, they are the only one mentioned in Wikipedia[0] related to this activity. And as an add-on question to satisfy my curiosity, how would one know when approaching company such as one linked here that the exploit sold will be used by good-guys<tm> and doesn't come to haunt you later when it ends up being used by bad-guys<tm>? [0] https://en.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.wikipedia.org/wiki/Market_for_zero-day_exploits

ikeboy 8y ago

This is obfuscating the law. It’s not illegal to disclose anything, it’s illegal to hack (in certain circumstances). Nobody is getting prosecuted for disclosure, they’re getting prosecuted for hacking. Now, maybe those forms of hacking should be legal. I’m sympathetic to their cause. But it’s disingenuous to frame this as disclosure being illegal. As a side note, the post implies companies are using criminal sanctions as a threat to prevent disclosure - this is itself illegal extortion.

Drakim 8y ago
If I buy a Bluetooth SmartLock, is it illegal for me to to attempt to open my own lock without the key to see if the product actually works?
- ikeboy 8y ago
  Probably, it isn't trying to protect anything copyrighted. Ask a lawyer to be sure
  - Drakim 8y ago
    Wouldn't the software inside the lock be copyrighted?
    - delinka 8y ago
      But you're not trying to access the software, you're trying to unlock the lock. DMCA concerns itself with copyrighted works behind some protection mechanism: technically, if you're accessing the lock's firmware, discover it's encrypted, then attempt to decrypt it, you're violating the DMCA. In addition, if you publish the decrypted software, you're infringing copyright. In either case, these are probably not CFAA violations.
- Meist1 8y ago
  Depends on the lock and the method of attack you are using - CFAA violations are usually tied to 18 USC §1030 (4) (https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030), which only apply to "protected computer[s]" A computer is protected (18 USC §1030(e)(2)) in generally one of three circumstances - i) Used exclusively by a financial institution; ii) Used exclusively by the US Gov't; or iii) Affects foreign commerce or communication [usually interpreted to mean connected to the Internet] Therefore, if you are using a non-internet connected device (i.e. Bluetooth or NFC only), it's unlikely to be a violation of the CFAA. NOT LEGAL ADVICE, SEEK YOUR OWN LICENSED ATTORNEY

elronster 8y ago

This is easy to get around. Just release the information anonymously on an anonymous platform.

JamesUtah07 8y ago
Yea but most platforms, that garner any attention, are not actually anonymous in ways that would protect the person releasing the information.
- wepple 8y ago
  The full-disclosure mailing list has been around 20 years and has no problem garnering attention. Sending an anonymous email in that direct with no way to track back isn’t particularly difficult.
adrianN 8y ago
A possibility to avoid punishment doesn't make wrong laws right.

LinuxBender 8y ago

There are a large number of penetration testers that operate in the open because it is legal and there are frameworks for disclosure. What happens when we make this illegal? Will those people simply cease and desist?

tptacek 8y ago

You read Cory Doctorow talking about vulnerability research and you get the impression that there's a war out there on security researchers. But of course, everything else in Doctorow's article aside, there isn't: the field of vulnerability research has never been healthier, and there have never been more companies explicitly authorizing testing of their servers than there are now. There isn't an epidemic of prosecutions of vulnerability researchers --- in fact, there are virtually no such prosecutions, despite 8-10 conferences worth of well-publicized independent security teardowns of everything from payroll systems to automotive ECUs. There are so many random real-world things getting torn down by researchers that Black Hat USA (the industry's biggest vuln research conference) had to make a whole separate track to capture all the stunt hacking. I can't remember the last time someone was even C&D'd off of giving a talk. I'm a vulnerability researcher (I've been doing that work professionally since the mid-1990s) I've been threatened legally several times, but all of them occurred more than 8 years ago. It has never been better or easier to be a vulnerability researcher. Telling the truth about defects in technology isn't illegal. Doctorow has no actual connection to the field, just a sort of EFF-style rooting interest in it. I'm glad he approves of the work I do, but he's not someone who I'd look to for information about what's threatening us. I'm trying think of something that might be a threat... credentialism, maybe? That's the best I can come up with. Everything is easier today, more tools are available, things are cheaper, more technical knowledge is public; there are challenges in other parts of the tech industry, but vuln research, not so much.

icc97 8y ago
> the field of vulnerability research has never been healthier, and there have never been more companies explicitly authorizing testing of their servers than there are now. > in fact, there are virtually no such prosecutions > Telling the truth about defects in technology isn't illegal. These statements don't seem to add up. If it's legal to tell about defects, then all of EFF's work (on this case) is a waste of time and they're spreading misinformation. If it's legal to do what they're doing then there should be zero prosecutions. Companies wouldn't need to authorize anyone because what they are doing is legal. Edit: added some clarification
- 8y ago

rotrux 8y ago

Ok so I do appreciate the EFF's zeal in preemptively quashing a bug-hunter-hunt, but here's a scenario that throws their thesis into question: Bank of 'MURICA (Bo'M) gets a phone call from some random guy (Jack) who identifies a bug in the interface between PoS systems at gas stations across the US, and whatever Bo'M internal software-mega-structure manages checking acct balances for Bo'M customers. Now, Jack is a good Samaritan; he would never use this information to steal from millions of Bo'M customers...but like...he totally could. Jack's sister Jill overhears her brother's conversation with Bo'M's security team, & decides everyone needs to know immediately about Bo'M's negligence. Lets pretend it's going to take a ~month to fix the interface. Is it cool for Jill to get on Reddit and post the code necessary to exploit the bug before Bo'M has a chance to protect their customers? Is this a victimless act? Was she just being responsible? Should she have waited to be responsible?

deleted 8y ago
[deleted]
Chardok 8y ago
Okay, but what about potential customers of BoA that have no idea that the bank they want to entrust their money to has a huge known exploit that increases their chances of identity theft? Does the customer not have a right to know what they are signing up for?
- tptacek 8y ago
  I have bad news for you. I don't know what bank you use, but I know this: your bank has huge exploits that increase your chance for identity theft.
  - Chardok 8y ago
    I'm sure it does. Even if I already was a BoA customer in this theoretical scenario, I would also prefer to be in the know to avoid that specific POS/gas station company until the issue was resolved, instead of wondering why my identity was stolen and dealing with the fallout with my bank unknowingly to blame.

mdsareckcfsck 8y ago

Attempting to have a reasonable conversation in this thread is impossible because mods have allowwed certain accounts to post as much as they want and brigade counter opinions.

dang 8y ago
Most accounts are allowed to post as much as they want! We do put rate limits on some if they have a history of posting too many low-quality comments too quickly, or of getting involved in flamewars. Also, new accounts are rate limited for a while, to cut back on trolling. If you or anyone else has a rate limited account and would like us to lift the rate limit, you're welcome to email us at hn@ycombinator.com. We're happy to do that if we believe there's an intention to use HN as intended in the future.