4 ms·

> The new Belgian whistleblower law (Klokkenluiderswet) has changed the legal situation for ethical hacking in Belgium. A natural or legal person is now authori

> The new Belgian whistleblower law (Klokkenluiderswet) has changed the legal situation for ethical hacking in Belgium. A natural or legal person is now authorised to investigate organisations in Belgium for potential cybersecurity vulnerabilities, even if they have not consented to such investigations. Cool. Though, Belgium will soon have the most secure systems in the world, or no one dares running open computer systems there. This will be fascinating to follow. > The second condition mandates that ethical hackers report any uncovered cybersecurity vulnerability as soon as possible to the Centre for Cyber Security Belgium (CCB), which is the national computer security incident response team of Belgium. I really hope they will take the opportunity and publish statistics about the reports. > The final condition is an obligation for ethical hackers to not disclose information about the uncovered vulnerability to a broader public without the consent of the CCB. Right, I agree with OPs comment, that this is a bummer. Why not let the organization self decide this? Or one-out-of-two? This seems a bit fishy. I hope it works out.

andreareina 3y ago
The context here is "without authorisation of the owner of the system"; if they agree to publication then the additional protections [need to] don't apply
- crimsontech 3y ago
  It’s going to be interesting in the cases where the security researchers cause denial of service conditions, data corruption, or just weaken or breaks a security control totally leaving systems and data wide open.
michaelt 3y ago
> Though, Belgium will soon have the most secure systems in the world, or no one dares running open computer systems there. I doubt it'll deter anyone from running computer systems. After all, hacking already goes unpunished if it crosses the right jurisdictional borders, or if the attacker can't be traced. And for most attacks both are true so the cops don't do anything. The only difference this law makes is for in-country hackers who disclose their own identity.
sillysaurusx 3y ago
Good. Make it law in every other country too. You would not believe the amount of duct tape holding systems together; crowd sourcing the inspections would at least get eyeballs on the problems, even if it caused an uptick in security incidents. (Former pentester @matasano, though only for a little over a year.) After witnessing the results of over 50 pentests, you’re dragged to the conclusion that (a) companies usually get pentests because they’re forced to by other companies, and (b) the security incidents that do happen tend not to affect the companies themselves. By (b) I mean “security doesn’t matter,” in the sense that very few companies have ever died from security incidents. The cost is borne by the customers whose data is exposed, not the companies who allowed the breach. De-legislating cybersecurity will improve security, almost by definition. As you say, you’re forced to secure your systems. This is probably a net positive, and hopefully the experiment in Belgium will show why.
- pcthrowaway 3y ago
  > By (b) I mean “security doesn’t matter,” in the sense that very few companies have ever died from security incidents. Ashley Madison, and Mt Gox come to mind. I suspect Lastpass will be added to that list soon.
  - 16bitvoid 3y ago
    Just checked: Ashley Madison is still in business and reached their highest (known) peak of users in 2019, about 4 years after the leak.
    - anonym29 3y ago
      This begs the question: who's more stupid, the business that negligently screwed their customers, or the customers who came back after?
      - jstarfish 3y ago
        There is an unstated implication that negligence doesn't happen twice. I'd sooner assume the membership count comprises bots and repeat throwaway/voyeur accounts.
ComodoHacker 3y ago
Looks like the new legal framework puts everyone at the mercy of CCB, a government body. Hope they have enough incentives and processes to do the right thing with all those 0-days that will flow to them. Otherwise, this could undermine the public disclosure concept itself, a mechanism to force a stubborn vendor to fix their vulnerabilities.
sylware 3y ago
Unicorn world. How lovely: "hackers" will start to give "vulnerabilities" for "free" to some "agencies"... I wonder how many will stay secret for those "agencies" own agenda. How can you expect any trust in the shady world of "vulnerabilities"? Are you serious?
- atoav 3y ago
  It is about deterrence. I had more than one instance where I did not tell a government agency or an airport or whatever about a flaw in theie system, because I did not want to deal with them potentially "shooting" the messenger. Makeing certain things legal explicitly has it's merits.
  - sylware 3y ago
    But the "process" is still "secret", and the whole issue is the shadow around this, gov agencies or corps, same same. At the time I was seeing "computer security" people: namely at the time I did learn deliverable "security" is a fantasy, some said they were "pressured" by some corps to shut up with significant help from the authorities. There is only one way to do that safely: immediat full public disclosure. Corps and govs have to be ready for that all the time, this is a significant part of their job. The real issue is the trust about the source of "vulnerabilities", because upon publication, it must be validaded by competent ppl, and here we go again in the shadows where things could become "delayed" indefinitely (I guess as long as possible).
stavros 3y ago
> Belgium will soon have the most secure systems in the world, or no one dares running open computer systems there. There are three groups of people: * People who hack for profit and want to exploit you. * People who hack for fun and don't care about telling you. * People who hack for fun and are polite enough to tell you about it afterwards. #1 isn't going to be deterred by law, as hacking is illegal already. #2 might do it anyway, since the risk of getting caught is low, you just won't hear about it. #3 is the only group that this new law will affect, and the way it will affect them is that now they can tell you about it without fearing repercussions. I don't see this making people more afraid to run open computer systems. The bad guys were always going to get to them anyway.
KRAKRISMOTT 3y ago
Ah, a crowd sourced NSA. Very clever.
- amelius 3y ago
  Yes, a very cheap solution. Very typical, as security always ends up at the bottom of the budget plan.
mytailorisrich 3y ago
Vulnerabilities are by definition dangerous. In some cases critically dangerous. It is reasonable, common sense even, that vulnerabilities should not be publicised without a vetting process.
underdeserver 3y ago
Compare and contrast Google's Project Zero's disclosure policy: https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-policy.html https://googleprojectzero.blogspot.com/p/vulnerability-discl... They don't wait for your permission to publish - they give you 90 days to fix and 30 days from when the fix is ready, but if you don't cooperate, they're posting it anyway. As I understand it they don't hack into someone else's system, but they might disclose a vulnerability in your software running on my device.
GTP 3y ago
> Why not let the organization self decide this? Or one-out-of-two? I think there could be two different situations. In the first one, the company doesn't want to let the pubilc know about a vulnerability they had to not damage their image. But the CCB gives permission after the vulnerability has been patched. The second one is that the company gives permission, but the CCB wants to wait to first evaluate how many companies could have the same problem and get in touch with them. Think e.g. a vulnerability that can be potentially widespread like log4j.

andreareina 3y ago

The context here is "without authorisation of the owner of the system"; if they agree to publication then the additional protections [need to] don't apply

crimsontech 3y ago
It’s going to be interesting in the cases where the security researchers cause denial of service conditions, data corruption, or just weaken or breaks a security control totally leaving systems and data wide open.

michaelt 3y ago

> Though, Belgium will soon have the most secure systems in the world, or no one dares running open computer systems there. I doubt it'll deter anyone from running computer systems. After all, hacking already goes unpunished if it crosses the right jurisdictional borders, or if the attacker can't be traced. And for most attacks both are true so the cops don't do anything. The only difference this law makes is for in-country hackers who disclose their own identity.

sillysaurusx 3y ago

Good. Make it law in every other country too. You would not believe the amount of duct tape holding systems together; crowd sourcing the inspections would at least get eyeballs on the problems, even if it caused an uptick in security incidents. (Former pentester @matasano, though only for a little over a year.) After witnessing the results of over 50 pentests, you’re dragged to the conclusion that (a) companies usually get pentests because they’re forced to by other companies, and (b) the security incidents that do happen tend not to affect the companies themselves. By (b) I mean “security doesn’t matter,” in the sense that very few companies have ever died from security incidents. The cost is borne by the customers whose data is exposed, not the companies who allowed the breach. De-legislating cybersecurity will improve security, almost by definition. As you say, you’re forced to secure your systems. This is probably a net positive, and hopefully the experiment in Belgium will show why.

pcthrowaway 3y ago
> By (b) I mean “security doesn’t matter,” in the sense that very few companies have ever died from security incidents. Ashley Madison, and Mt Gox come to mind. I suspect Lastpass will be added to that list soon.
- 16bitvoid 3y ago
  Just checked: Ashley Madison is still in business and reached their highest (known) peak of users in 2019, about 4 years after the leak.
  - anonym29 3y ago
    This begs the question: who's more stupid, the business that negligently screwed their customers, or the customers who came back after?
    - jstarfish 3y ago
      There is an unstated implication that negligence doesn't happen twice. I'd sooner assume the membership count comprises bots and repeat throwaway/voyeur accounts.

ComodoHacker 3y ago

Looks like the new legal framework puts everyone at the mercy of CCB, a government body. Hope they have enough incentives and processes to do the right thing with all those 0-days that will flow to them. Otherwise, this could undermine the public disclosure concept itself, a mechanism to force a stubborn vendor to fix their vulnerabilities.

sylware 3y ago

Unicorn world. How lovely: "hackers" will start to give "vulnerabilities" for "free" to some "agencies"... I wonder how many will stay secret for those "agencies" own agenda. How can you expect any trust in the shady world of "vulnerabilities"? Are you serious?

atoav 3y ago
It is about deterrence. I had more than one instance where I did not tell a government agency or an airport or whatever about a flaw in theie system, because I did not want to deal with them potentially "shooting" the messenger. Makeing certain things legal explicitly has it's merits.
- sylware 3y ago
  But the "process" is still "secret", and the whole issue is the shadow around this, gov agencies or corps, same same. At the time I was seeing "computer security" people: namely at the time I did learn deliverable "security" is a fantasy, some said they were "pressured" by some corps to shut up with significant help from the authorities. There is only one way to do that safely: immediat full public disclosure. Corps and govs have to be ready for that all the time, this is a significant part of their job. The real issue is the trust about the source of "vulnerabilities", because upon publication, it must be validaded by competent ppl, and here we go again in the shadows where things could become "delayed" indefinitely (I guess as long as possible).

stavros 3y ago

> Belgium will soon have the most secure systems in the world, or no one dares running open computer systems there. There are three groups of people: * People who hack for profit and want to exploit you. * People who hack for fun and don't care about telling you. * People who hack for fun and are polite enough to tell you about it afterwards. #1 isn't going to be deterred by law, as hacking is illegal already. #2 might do it anyway, since the risk of getting caught is low, you just won't hear about it. #3 is the only group that this new law will affect, and the way it will affect them is that now they can tell you about it without fearing repercussions. I don't see this making people more afraid to run open computer systems. The bad guys were always going to get to them anyway.

KRAKRISMOTT 3y ago

Ah, a crowd sourced NSA. Very clever.

amelius 3y ago
Yes, a very cheap solution. Very typical, as security always ends up at the bottom of the budget plan.

mytailorisrich 3y ago

Vulnerabilities are by definition dangerous. In some cases critically dangerous. It is reasonable, common sense even, that vulnerabilities should not be publicised without a vetting process.

underdeserver 3y ago

Compare and contrast Google's Project Zero's disclosure policy: https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-policy.html https://googleprojectzero.blogspot.com/p/vulnerability-discl... They don't wait for your permission to publish - they give you 90 days to fix and 30 days from when the fix is ready, but if you don't cooperate, they're posting it anyway. As I understand it they don't hack into someone else's system, but they might disclose a vulnerability in your software running on my device.

GTP 3y ago

> Why not let the organization self decide this? Or one-out-of-two? I think there could be two different situations. In the first one, the company doesn't want to let the pubilc know about a vulnerability they had to not damage their image. But the CCB gives permission after the vulnerability has been patched. The second one is that the company gives permission, but the CCB wants to wait to first evaluate how many companies could have the same problem and get in touch with them. Think e.g. a vulnerability that can be potentially widespread like log4j.