5 ms·

Is there anything actually illegal here? Like is it a plausible “business” model for talented and morally compromised developers to do this and then sell the pr

Is there anything actually illegal here? Like is it a plausible “business” model for talented and morally compromised developers to do this and then sell the private key to state actors without actually breaking in themselves or allowing anyone else to break in. Edit: MIT license provides a pretty broad disclaimer to say it isn’t fit for any purpose implied or otherwise.

kstrauser 3y ago
Yes. This would surely be prosecutable under the CFAA. Honestly, if I were involved in this, I'd hope that it was, say, the FBI that caught me. I think that'd be the best chance of staying out of the Guantanamo Bay Hilton, laws be damned.
- gghffguhvc 3y ago
  Even with the MIT disclaimer and the author not being the distributor or have any relationship with the distributor. Publishing vulnerable open source software to GitHub with a disclaimer that says it isn’t fit for any purpose seems like a bit of an oversight of using MIT license in distros to me.
  - gghffguhvc 3y ago
    THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
    - account42 3y ago
      BY READING THIS COMMENT YOU AGREE THAT THE AUTHOR CAN TAKE ALL YOUR WORDLY POSSESSIONS. YOU ALSO INDEMNYFY THE AUTHOR FOR ANY HARM THEY MIGHT CAUSE YOU AT ANY TIME. I own you now. Sucks to be you I guess. Or maybe that's not how things work a) limits to what licenses can allow you to do and b) limits to who is bound by the license at all.
  - gowld 3y ago
    A software license has never been a protection against malicious criminal activity. They'd have to prove that the "feature" had a legitimate non-nefarious purpose, or was accidental, neither of which apply here.
    - infamouscow 3y ago
      In the US, you are innocent until proven guilty. In the US, you are innocent until proven guilty. In the US, you are innocent until proven guilty. Apologies for having to be obnoxious about it, but it deserves repeating. If you take a approach of presumed guilty where the accused have to prove their innocence: you have a problem. You'd have a very difficult time proving your innocence after being accused of a crime. Anyone can accuse you of a murder that happened at 2am, and your alibi of being asleep won't cut it. Remember, in this bizarro world, it's presumed you are already guilty. You need to convince the prosector and jury you didn't commit the crime. Even if you had 4K night vision video of you sleeping in your bed, it probably won't persuade anyone because the prosecutor will say you pre-recorded the video to deceive a jury, and since you're presumed guilty, it makes sense for you to manufacture evidence in your defense. This is why guilty until proven innocent is genuinely stupid.
      - account42 3y ago
        Proven here is not in the same sense of a mathematical proof. "But your honor, technically you can't prove my client was going to use this exploit carefully hidden behind layers of obfuscation for malicious intent" is not a legal defense.
  - bawolff 3y ago
    That is not how disclaimers work. You cannot disclaim liability for intentionally harming someone. You also cannot avoid criminal charges for a crime simply by shouting "don't blame me"
    - kstrauser 3y ago
      That's exactly right. Imagine a license that said "...and I can come to your house and kill you if I want to." Even if someone signed it in ink and mailed a copy back, the licensor still can't go to their house and kill them even though the agreement says they can. I can imagine the case of maybe a "King of the Hill"-type game played on bare hardware, where you're actively trying to hack into and destroy other players' systems. Such a thing might have a license saying "you agree we may wipe your drive after downloading all your data", and that might be acceptable in that specific situation. You knew you were signing up for a risking endeavor that might harm your system. If/when it happens, you'd have a hard time complaining about it doing the thing it advertised that it would do. Maybe. Get a jury involved and who knows? But somewhere between those 2 examples is the xz case. There's no way a user of xz could think that it was designed to hack their system, and no amount of licensing can just wave that away. For a real world analogy, if you go skydiving, and you sign an injury against waiver, and you get hurt out of pure dumb luck and not negligence, good luck suing anyone for that. You jumped out of a plane. What did you think might happen? But if you walk into a McDonald's and fall through the floor into a basement and break your leg, no number of "not responsible for accidents" signs on the walls would keep them from being liable.
      - bawolff 3y ago
        > For a real world analogy, if you go skydiving, and you sign an injury against waiver, and you get hurt out of pure dumb luck and not negligence, good luck suing anyone for that. You jumped out of a plane. What did you think might happen? But if you walk into a McDonald's and fall through the floor into a basement and break your leg, no number of "not responsible for accidents" signs on the walls would keep them from being liable. Even this is a bad example, since it is just gross negligence and not intentional. A better analogy would be if mcdonalds shoots you.
- shp0ngle 3y ago
  CIA didn't put anyone new into gitmo for years. The 30 remaining gitmo prisoners are all W Bush holdovers that all subsequent administrations forgot.
  - kstrauser 3y ago
    Conspiracy theorist: That's what they want you to believe. And in fairness, the whole nature of their secrecy means there's no way to know for sure. It might be just a boogeyman kept around as a useful tool for scaring people into not breaking national security-level laws. I mean, it's not as though I want to go around hacking the planet, but the idea of ending up at a CIA "black site", assuming such things even exist, would be enough to keep me from trying it.
    - deleted 3y ago
      [deleted]
  - aftbit 3y ago
    Sure but that's because the world knows about Gitmo now. What about the other quieter black sites?
  - account42 3y ago
    "forgot" lmao
alfanick 3y ago
Legality things, depends on jurisdiction, which may or may not depend on: * where were the authors of the code, * where the code is stored, * who is attacked, * where are their servers, * who is attacking, * where are they based, * where did they attack from, * ... IANAL but it seems very complicated from law perspective (we, humanity, don't have a global law) Edit2: making a bullet point list is hard
jcranmer 3y ago
There are things you can't contractually wave away, especially in form contracts that the other side has no ability to negotiate (which is what software licenses amount to). One of those things is going to be fraud: if the maintainer is intentionally installing backdoors into their software and not telling the user, there's going to be some fraud-like statute that they'll be liable for.
- dannyw 3y ago
  That said, if you’re doing this for your jurisdiction’s security agency, you’ll certainly be protected.
greyface- 3y ago
I brought this up in an earlier thread and got heavily downvoted. https://news.ycombinator.com/item?id=39878227 https://news.ycombinator.com/item?id=39878227
- saagarjha 3y ago
  I don't think you should have been downvoted, but it's pretty clear that this would be a crime.
pama 3y ago
You are talking about the greatest exposed hack of the computer supply chain so far by a big margin. Laws can be made retroactively for this type of thing. It has implications that are beyond the legal system, as the threat level is way beyond what is typically required as a sniff test for justifying military actions. This was not an RCE based on identifying negligent code; this was a carefully designed trap that could reverse the power dynamics during military conflict.
- greyface- 3y ago
  > Laws can be made retroactively Not in the United States. https://constitution.congress.gov/browse/article-1/section-9/clause-3/ https://constitution.congress.gov/browse/article-1/section-9...
  - KeplerBoy 3y ago
    Meh, these are potentially the kind of crimes where laws don't apply.
  - int_19h 3y ago
    Ex post facto criminal liability is prohibited either constitutionally or by strong custom in most jurisdictions, and this is generally considered a fundamental part of having rule of law and due process. This is also spelled out in UDHR, ECHR, and several other similar documents.
    - pama 3y ago
      Not sure it is worth spending any effort on this subject, however a ton of existing laws in almost any juristiction could be applied to this particular crime. I doubt the perpetrators would be caught, but I also doubt the punishment would be established via a legal system in a public setting anyways. Depending on what jurisdiction it is and who feels most compelled to punish them or not, it is possible they could be used as spies again for a different government. I wish I would be able to read the story behind the story eventually but I very much doubt it. The existence of a public key means there was in principle a way to verify the identity beyond doubt, though I don’t know how much longer this will be the case.
vikramkr 3y ago
Is there some weird loophole or something I'm missing here? Otherwise, I'm not exactly sure how hacking wouldn't be illegal.
- greyface- 3y ago
  Hacking statues cover unauthorized access, and there's no evidence that unauthorized access has occurred, unless we see someone actually making use of the backdoor in the wild. Accessing a system without authorization is a crime, but distributing code that contains a backdoor is not a crime. The attacker was authorized to publish changes to xz.
  - vikramkr 3y ago
    Do you have a source for the claim that this isn't a crime because it didn't succeed? As a sanity check, checking the plain text of the CFAA, it covers attempted hacking as you'd expect. So distributing a system with a backdoor, introducing a backdoor, etc all seem quite comfortably covered by existing statues. Which makes sense since like, I don't want to say 'duh' because I think that probably wouldn't meet HN guidelines for discourse but I'm not sure what else to say. Even American politicians, as notoriously incompetent as our leaders can be sometimes, wouldn't miss a crime that obvious. https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030
    - greyface- 3y ago
      I'm not claiming the attempt didn't succeed. I'm claiming that the attempt didn't occur, and that distributing the backdoor more widely would only have created the preconditions for an attempt. We don't know who the intended target was, or what the intended payload was. Yes, subsection (b) of the CFAA covers attempts at acts described in subsection (a) of the CFAA. Which specific act under subsection (a) do you claim has been attempted?
      - vikramkr 3y ago
        All of them? It's a backdoor into Linux to gain unauthorized access to computers that even specifically only works for that attackers specific private key. We have trial by jury where I guess you could argue that this carefully crafted backdoor was just some sort weird accident, but we also have prosecutors to make the obvious counterargument and investigate what these folks were going for. Though frankly they're probably state actors that we're never gonna catch. But literally all of part a. I still don't understand if I'm actually just missing something obvious about our criminal justice system that would mean the US has no ability to prosecute even moderately complex crimes by slightly sophisticated actors that didn't reach fruition, since by your reasoning we'd also never be able to prosecute essentially any organized crime anywhere as long as they keep their targets a secret? If the attempt didn't occur then did someone just trip and fall on their keyboard over a period of months to accidentally carry out sophisticated social engineering to write a carefully hidden backdoor into a package targeted at hijacking widely used operating systems?
db48x 3y ago
I’m no lawyer, but it is at minimum tortuous interference.
- denton-scratch 3y ago
  Indeed. I think a lawyer would have written "tortious", there being no pain involved.
  - db48x 3y ago
    Only the pain of spelling.
vikramkr 3y ago
As a sanity check, attempted crime is still crime, so not a lawyer but part B isn't exactly ambiguous here: https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030 In terms of a plausible business model - I mean that's conspiracy to commit crime, like of course that's illegal? And depending on the state actor and the target system - literally treason if it's a cyber attack as a part of a war? You can put whatever you want into a license or contract but obviously that doesn't let you override the actual law

kstrauser 3y ago

Yes. This would surely be prosecutable under the CFAA. Honestly, if I were involved in this, I'd hope that it was, say, the FBI that caught me. I think that'd be the best chance of staying out of the Guantanamo Bay Hilton, laws be damned.

gghffguhvc 3y ago
Even with the MIT disclaimer and the author not being the distributor or have any relationship with the distributor. Publishing vulnerable open source software to GitHub with a disclaimer that says it isn’t fit for any purpose seems like a bit of an oversight of using MIT license in distros to me.
- gghffguhvc 3y ago
  THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  - account42 3y ago
    BY READING THIS COMMENT YOU AGREE THAT THE AUTHOR CAN TAKE ALL YOUR WORDLY POSSESSIONS. YOU ALSO INDEMNYFY THE AUTHOR FOR ANY HARM THEY MIGHT CAUSE YOU AT ANY TIME. I own you now. Sucks to be you I guess. Or maybe that's not how things work a) limits to what licenses can allow you to do and b) limits to who is bound by the license at all.
- gowld 3y ago
  A software license has never been a protection against malicious criminal activity. They'd have to prove that the "feature" had a legitimate non-nefarious purpose, or was accidental, neither of which apply here.
  - infamouscow 3y ago
    In the US, you are innocent until proven guilty. In the US, you are innocent until proven guilty. In the US, you are innocent until proven guilty. Apologies for having to be obnoxious about it, but it deserves repeating. If you take a approach of presumed guilty where the accused have to prove their innocence: you have a problem. You'd have a very difficult time proving your innocence after being accused of a crime. Anyone can accuse you of a murder that happened at 2am, and your alibi of being asleep won't cut it. Remember, in this bizarro world, it's presumed you are already guilty. You need to convince the prosector and jury you didn't commit the crime. Even if you had 4K night vision video of you sleeping in your bed, it probably won't persuade anyone because the prosecutor will say you pre-recorded the video to deceive a jury, and since you're presumed guilty, it makes sense for you to manufacture evidence in your defense. This is why guilty until proven innocent is genuinely stupid.
    - account42 3y ago
      Proven here is not in the same sense of a mathematical proof. "But your honor, technically you can't prove my client was going to use this exploit carefully hidden behind layers of obfuscation for malicious intent" is not a legal defense.
- bawolff 3y ago
  That is not how disclaimers work. You cannot disclaim liability for intentionally harming someone. You also cannot avoid criminal charges for a crime simply by shouting "don't blame me"
  - kstrauser 3y ago
    That's exactly right. Imagine a license that said "...and I can come to your house and kill you if I want to." Even if someone signed it in ink and mailed a copy back, the licensor still can't go to their house and kill them even though the agreement says they can. I can imagine the case of maybe a "King of the Hill"-type game played on bare hardware, where you're actively trying to hack into and destroy other players' systems. Such a thing might have a license saying "you agree we may wipe your drive after downloading all your data", and that might be acceptable in that specific situation. You knew you were signing up for a risking endeavor that might harm your system. If/when it happens, you'd have a hard time complaining about it doing the thing it advertised that it would do. Maybe. Get a jury involved and who knows? But somewhere between those 2 examples is the xz case. There's no way a user of xz could think that it was designed to hack their system, and no amount of licensing can just wave that away. For a real world analogy, if you go skydiving, and you sign an injury against waiver, and you get hurt out of pure dumb luck and not negligence, good luck suing anyone for that. You jumped out of a plane. What did you think might happen? But if you walk into a McDonald's and fall through the floor into a basement and break your leg, no number of "not responsible for accidents" signs on the walls would keep them from being liable.
    - bawolff 3y ago
      > For a real world analogy, if you go skydiving, and you sign an injury against waiver, and you get hurt out of pure dumb luck and not negligence, good luck suing anyone for that. You jumped out of a plane. What did you think might happen? But if you walk into a McDonald's and fall through the floor into a basement and break your leg, no number of "not responsible for accidents" signs on the walls would keep them from being liable. Even this is a bad example, since it is just gross negligence and not intentional. A better analogy would be if mcdonalds shoots you.
shp0ngle 3y ago
CIA didn't put anyone new into gitmo for years. The 30 remaining gitmo prisoners are all W Bush holdovers that all subsequent administrations forgot.
- kstrauser 3y ago
  Conspiracy theorist: That's what they want you to believe. And in fairness, the whole nature of their secrecy means there's no way to know for sure. It might be just a boogeyman kept around as a useful tool for scaring people into not breaking national security-level laws. I mean, it's not as though I want to go around hacking the planet, but the idea of ending up at a CIA "black site", assuming such things even exist, would be enough to keep me from trying it.
  - deleted 3y ago
    [deleted]
- aftbit 3y ago
  Sure but that's because the world knows about Gitmo now. What about the other quieter black sites?
- account42 3y ago
  "forgot" lmao

alfanick 3y ago

Legality things, depends on jurisdiction, which may or may not depend on: * where were the authors of the code, * where the code is stored, * who is attacked, * where are their servers, * who is attacking, * where are they based, * where did they attack from, * ... IANAL but it seems very complicated from law perspective (we, humanity, don't have a global law) Edit2: making a bullet point list is hard

jcranmer 3y ago

There are things you can't contractually wave away, especially in form contracts that the other side has no ability to negotiate (which is what software licenses amount to). One of those things is going to be fraud: if the maintainer is intentionally installing backdoors into their software and not telling the user, there's going to be some fraud-like statute that they'll be liable for.

dannyw 3y ago
That said, if you’re doing this for your jurisdiction’s security agency, you’ll certainly be protected.

greyface- 3y ago

I brought this up in an earlier thread and got heavily downvoted. https://news.ycombinator.com/item?id=39878227 https://news.ycombinator.com/item?id=39878227

saagarjha 3y ago
I don't think you should have been downvoted, but it's pretty clear that this would be a crime.

pama 3y ago

You are talking about the greatest exposed hack of the computer supply chain so far by a big margin. Laws can be made retroactively for this type of thing. It has implications that are beyond the legal system, as the threat level is way beyond what is typically required as a sniff test for justifying military actions. This was not an RCE based on identifying negligent code; this was a carefully designed trap that could reverse the power dynamics during military conflict.

greyface- 3y ago
> Laws can be made retroactively Not in the United States. https://constitution.congress.gov/browse/article-1/section-9/clause-3/ https://constitution.congress.gov/browse/article-1/section-9...
- KeplerBoy 3y ago
  Meh, these are potentially the kind of crimes where laws don't apply.
- int_19h 3y ago
  Ex post facto criminal liability is prohibited either constitutionally or by strong custom in most jurisdictions, and this is generally considered a fundamental part of having rule of law and due process. This is also spelled out in UDHR, ECHR, and several other similar documents.
  - pama 3y ago
    Not sure it is worth spending any effort on this subject, however a ton of existing laws in almost any juristiction could be applied to this particular crime. I doubt the perpetrators would be caught, but I also doubt the punishment would be established via a legal system in a public setting anyways. Depending on what jurisdiction it is and who feels most compelled to punish them or not, it is possible they could be used as spies again for a different government. I wish I would be able to read the story behind the story eventually but I very much doubt it. The existence of a public key means there was in principle a way to verify the identity beyond doubt, though I don’t know how much longer this will be the case.

vikramkr 3y ago

Is there some weird loophole or something I'm missing here? Otherwise, I'm not exactly sure how hacking wouldn't be illegal.

greyface- 3y ago
Hacking statues cover unauthorized access, and there's no evidence that unauthorized access has occurred, unless we see someone actually making use of the backdoor in the wild. Accessing a system without authorization is a crime, but distributing code that contains a backdoor is not a crime. The attacker was authorized to publish changes to xz.
- vikramkr 3y ago
  Do you have a source for the claim that this isn't a crime because it didn't succeed? As a sanity check, checking the plain text of the CFAA, it covers attempted hacking as you'd expect. So distributing a system with a backdoor, introducing a backdoor, etc all seem quite comfortably covered by existing statues. Which makes sense since like, I don't want to say 'duh' because I think that probably wouldn't meet HN guidelines for discourse but I'm not sure what else to say. Even American politicians, as notoriously incompetent as our leaders can be sometimes, wouldn't miss a crime that obvious. https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030
  - greyface- 3y ago
    I'm not claiming the attempt didn't succeed. I'm claiming that the attempt didn't occur, and that distributing the backdoor more widely would only have created the preconditions for an attempt. We don't know who the intended target was, or what the intended payload was. Yes, subsection (b) of the CFAA covers attempts at acts described in subsection (a) of the CFAA. Which specific act under subsection (a) do you claim has been attempted?
    - vikramkr 3y ago
      All of them? It's a backdoor into Linux to gain unauthorized access to computers that even specifically only works for that attackers specific private key. We have trial by jury where I guess you could argue that this carefully crafted backdoor was just some sort weird accident, but we also have prosecutors to make the obvious counterargument and investigate what these folks were going for. Though frankly they're probably state actors that we're never gonna catch. But literally all of part a. I still don't understand if I'm actually just missing something obvious about our criminal justice system that would mean the US has no ability to prosecute even moderately complex crimes by slightly sophisticated actors that didn't reach fruition, since by your reasoning we'd also never be able to prosecute essentially any organized crime anywhere as long as they keep their targets a secret? If the attempt didn't occur then did someone just trip and fall on their keyboard over a period of months to accidentally carry out sophisticated social engineering to write a carefully hidden backdoor into a package targeted at hijacking widely used operating systems?

db48x 3y ago

I’m no lawyer, but it is at minimum tortuous interference.

denton-scratch 3y ago
Indeed. I think a lawyer would have written "tortious", there being no pain involved.
- db48x 3y ago
  Only the pain of spelling.

vikramkr 3y ago

As a sanity check, attempted crime is still crime, so not a lawyer but part B isn't exactly ambiguous here: https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030 In terms of a plausible business model - I mean that's conspiracy to commit crime, like of course that's illegal? And depending on the state actor and the target system - literally treason if it's a cyber attack as a part of a war? You can put whatever you want into a license or contract but obviously that doesn't let you override the actual law