4 ms·

> If your software is only intended to demonstrate the existence of a security flaw but contains no payload, then it is less obviously criminal. Still technical

> If your software is only intended to demonstrate the existence of a security flaw but contains no payload, then it is less obviously criminal. Still technically so, I suppose, but not so obviously that you couldn't make some kind of argument. I do not see anything criminal at all in writing some malware or exploits. _Applying_ them to a system, where they might cause damage however, that is a completely different matter. You don't go after the blacksmith or manufacturer of kitchen knifes or guns either. You go after the one using them for the wrong purpose.

msh 2y ago
A knife have legal purposes to be used. Does malware?
- ok_dad 2y ago
  Would you prefer only criminals research security issues?
- layer8 2y ago
  Unlocking bricked systems you own.
  - ivan_gammel 2y ago
    This implies certain user interface that is different from criminal use cases. I.e. certain types of knives are considered weapons rather than kitchen appliances and even carrying them will get you problems in some jurisdictions.
jltsiren 2y ago
It's often the intentions that matter. Doing X may not be a crime, but doing it with the intention to commit crime could be. And while outsiders can't know the true intentions, courts are often happy accept the intentions seen by a "reasonable person" as the truth. Which means that if you want to write malware, you should look like a respectable person and not do anything too shady.
ivan_gammel 2y ago
>I do not see anything criminal at all in writing some malware or exploits. MaaS (malware-as-a-product) is certainly criminal. There’s no legitimate purpose in writing control servers or admin panels for DDOS or ransomware.
- spwa4 2y ago
  Pretty much every such product uses libz, libssl, and these days websocket and javascript libraries. Are they malware? Very often the border between malware and non-malware is not clear. There are many command and control software that have no payload, and no exploits to spread. Are those malware? What about IRC/XMPP servers, webRTC/STUN/servers + proprietary equivalents, name resolution services (from DNS to some company's active directory), DHT, game servers (minecraft, quake) and other public services that often serve as or contribute to command-and-control hubs? But I'm not really interested in drawing an actual clear line. I'm worried especially what will happen if a local police officer or court judge takes action based on their personal assessment of a cybercrime. And now, with this law, international action. Right now often DNS is sabotaged, usually on a way larger scale than necessary, to achieve a court order. Inconveniencing everyone, often right up to gTLDs. Usually such a court order then doesn't work because the fact that a court case exists (and the time these things take) serves as ample warning for the malware authors plus you can use encryption to hide the command and control servers beyond the reach of even sabotaging DNS. And even that is assuming the damage isn't completely done by the time a decision is reached. Actual prevention of malware attacks is the domain of extra-judicial agents working at security companies, and they usually disable malware by injecting their own payloads, something that even currently is highly illegal, and sometimes causes the justice system to go after these individuals.
  - ivan_gammel 2y ago
    > Pretty much every such product uses libz, libssl, and these days websocket and javascript libraries. Are they malware? The answer to this question is obvious and the question doesn’t have to be asked. In what kind of thinking a product considered malware would imply that its generic components are also malware? It is clear logic fallacy. Same with C&C software - I don’t get how do you generalize it to IRC. I do not also see how this generalization can happen in law enforcement or courts.

msh 2y ago

A knife have legal purposes to be used. Does malware?

ok_dad 2y ago
Would you prefer only criminals research security issues?
layer8 2y ago
Unlocking bricked systems you own.
- ivan_gammel 2y ago
  This implies certain user interface that is different from criminal use cases. I.e. certain types of knives are considered weapons rather than kitchen appliances and even carrying them will get you problems in some jurisdictions.

jltsiren 2y ago

It's often the intentions that matter. Doing X may not be a crime, but doing it with the intention to commit crime could be. And while outsiders can't know the true intentions, courts are often happy accept the intentions seen by a "reasonable person" as the truth. Which means that if you want to write malware, you should look like a respectable person and not do anything too shady.

ivan_gammel 2y ago

>I do not see anything criminal at all in writing some malware or exploits. MaaS (malware-as-a-product) is certainly criminal. There’s no legitimate purpose in writing control servers or admin panels for DDOS or ransomware.

spwa4 2y ago
Pretty much every such product uses libz, libssl, and these days websocket and javascript libraries. Are they malware? Very often the border between malware and non-malware is not clear. There are many command and control software that have no payload, and no exploits to spread. Are those malware? What about IRC/XMPP servers, webRTC/STUN/servers + proprietary equivalents, name resolution services (from DNS to some company's active directory), DHT, game servers (minecraft, quake) and other public services that often serve as or contribute to command-and-control hubs? But I'm not really interested in drawing an actual clear line. I'm worried especially what will happen if a local police officer or court judge takes action based on their personal assessment of a cybercrime. And now, with this law, international action. Right now often DNS is sabotaged, usually on a way larger scale than necessary, to achieve a court order. Inconveniencing everyone, often right up to gTLDs. Usually such a court order then doesn't work because the fact that a court case exists (and the time these things take) serves as ample warning for the malware authors plus you can use encryption to hide the command and control servers beyond the reach of even sabotaging DNS. And even that is assuming the damage isn't completely done by the time a decision is reached. Actual prevention of malware attacks is the domain of extra-judicial agents working at security companies, and they usually disable malware by injecting their own payloads, something that even currently is highly illegal, and sometimes causes the justice system to go after these individuals.
- ivan_gammel 2y ago
  > Pretty much every such product uses libz, libssl, and these days websocket and javascript libraries. Are they malware? The answer to this question is obvious and the question doesn’t have to be asked. In what kind of thinking a product considered malware would imply that its generic components are also malware? It is clear logic fallacy. Same with C&C software - I don’t get how do you generalize it to IRC. I do not also see how this generalization can happen in law enforcement or courts.