10 ms·

If you sell software with features that could only reasonably used for illegal activitities, such as sending you the creditcard number someone is entering, then

If you sell software with features that could only reasonably used for illegal activitities, such as sending you the creditcard number someone is entering, then: a resounding YES! Also if you advertise features for illegal use, even if they could be used for legal things.

keithpeter 14y ago
I recollect that the German law was written in a way that would logically classify gcc as a hacking tool, i.e. the definition was very broad. I'd be interested in the definition/ law being used here.
- wuest 14y ago
  That's beside the point. There are plenty of valid uses for other things which would have been criminalized such as Metasploit and Core Impact. Not to mention that such things as writing PoC code to validate vulnerabilities would have been right out of the question.
  - keithpeter 14y ago
    I accept what your point which I take to be that a law or regulation that attempted a narrow definition of tools thought to be for criminal purposes would still criminalise legitimate activities. It is the activity that should be against the law, not possession of the software. I was just wondering what the law used in this case was.
    - saraid216 14y ago
      Yes, but privacy. A lot of activities are incredibly hard to actually catch someone in the act of, and incredibly hard to actually get hard proof of. Possession, on the other hand, is a strong correlation and proof of itself. The reasonableness of this correlation is what draws the line between whether or not possession is illegal, and that's going to be subjective. It's really easy to forget that the first and foremost reason we defend privacy isn't because its breach is icky. It's because illegality is sometimes the right thing to do. However, usually it's not. This is a natural contradiction that makes writing law difficult.
    - wuest 14y ago
      Absolutely agreed--this is a point I made in other posts. I apologize if I came across as harsh--absolutely not my intention.
tlrobinson 14y ago
Out of curiosity, what law makes it illegal?
- wuest 14y ago
  I'd be curious to find out as well. It's a very fine line between a luhn10 checker, and a luhn10 sniffer--the law's wording would need to be very precise to avoid criminalizing legitimate business software.
  - tlrobinson 14y ago
    Plus pen testers could argue that they legitimately need any tool a hacker could possibly use in order to test the security of their systems. nmap was one example I remember hearing would be considered illegal under Germany's new law.
    - wuest 14y ago
      s/could/do/ This is the problem with these manner of laws. Criminalizing the very method by which entities guarantee their security is never a good idea.
      - Retric 14y ago
        It's not that hard to carve out exceptions. Professionals can buy really dangerous fireworks that are 'illegal'.
        iy56 14y ago
        Most likely this will lead to official certification and registration of pen testers like locksmiths and alarm system installers are required to have in some states..
        wuest 14y ago
        Yeah, this is pretty likely. It's a dangerous road to go down, however, as regulatory bodies can be far from impartial. It's a difficult issue to properly address. I think the right method to go about it is to punish actions, rather than possession of tools. On some level, simply having the ability to write software makes one suspect, if you start scrutinizing tools. Actions (compromising boxes and running exploits without permission of the owner of the host, advertising explicitly criminal use of software) are easy enough to define, and it's easier to define an exclusive list of "bad" actions, than to come up with generalizable rules.
Tichy 14y ago
Remote desktops can be used for all sorts of things, among others helping people with their computer problems.
- coldtea 14y ago
  And the sellers of THOSE remote desktops don't have a problem.
- vidarh 14y ago
  In this case the specific software we're talking about had a feature whose specific purpose was to detect someone entering a credit card number, screenshot it and upload the image to an FTP server: 'In further MSN chats with the FBI, the person alleged to be Hogue answered a question about whether the Blackshades software would automatically conduct key logging or whether it had to be initiated manually. "It auto does, and you can download from all at once, or scan for keywords or digits," came the reply. "And if it detects a credit card is being entered, it can send screenshots to FTP and you can scan for digits that are 16 in a row :P"' It also had as a feature to encrypt a users files and pop up a ransom notice: 'Blackshades went beyond DarkComet in its support for features that were likely to result in illegality, such as the "File Hijacker" that could encrypt a victim's key files and then pop up a "ransomware" message demanding payment into a remote bank account in order to free the files. (A note attached to this feature said: "However, one thing to put in mind: This feature was made for educational purposes only.")' In general, even tools that are quite clearly intended for illegal uses seems to be ok. But this one took it much further.
  - jiggy2011 14y ago
    I think it depends on the generality of the software. Obviously a general purpose remote desktop program has a lot of more legitimate uses that something designed specifically to find CC numbers. Thing is , you could make a CC sniffing program and then realise "hmm, this might be difficult to defend in court" so you generalise it to something that simply looks for arbitrary strings of numbers. Of course the fact that 90% of your users happen to enter "16" into the box is not your fault. The generalised program might have useful side effects as a result, but it is no less dangerous than the more specific program.
AutoCorrect 14y ago
so you would be ok with people being arrested for selling software to rip dvds or cds?
philhippus 14y ago
ACME kitchen knives: great for chopping onions and murder sprees. Yes that is tongue-in-cheek but there is an equivalence here in that the consumer decides how the product will be used. I do agree that advertising use for illegal activity should be quashed (does that impinge on free-speech?).
- wuest 14y ago
  > does that impinge on free-speech? It could be argued that free speech necessarily has limitations. Depending on where you are in the world, this involves hate speech and incitation to violence. I would readily agree that distributing (especially SELLING) tools with the expressly stated purpose of criminal use should be punishable. That being said, the same tools are likely useful for legitimate purposes. Heck, I could see an argument for Back Orifice being useful in that one would really like to be assured that their network's egress filtering would raise flags when BO traffic is on the wire. This brings up another important point--these tools are always useful for people who are writing protection and mitigation against the tools' methods.
- AnIrishDuck 14y ago
  Selling kitchen knives: not illegal. Selling kitchen knives, and giving tips and instruction on where to stab to inflict maximum damage: I'd be very surprised if you're not legally liable for the actions of the third party. But, IANAL. EDIT: as for free speech, the "imminent lawless action" [1] test is AFAIK the current standard in the US. I'm sure there's case law around this that I'm not familiar with, but I'd argue giving killing tips is likely to incite "imminent lawless action" in the knife analogy. 1. http://en.wikipedia.org/wiki/Imminent_lawless_action http://en.wikipedia.org/wiki/Imminent_lawless_action

keithpeter 14y ago

I recollect that the German law was written in a way that would logically classify gcc as a hacking tool, i.e. the definition was very broad. I'd be interested in the definition/ law being used here.

wuest 14y ago
That's beside the point. There are plenty of valid uses for other things which would have been criminalized such as Metasploit and Core Impact. Not to mention that such things as writing PoC code to validate vulnerabilities would have been right out of the question.
- keithpeter 14y ago
  I accept what your point which I take to be that a law or regulation that attempted a narrow definition of tools thought to be for criminal purposes would still criminalise legitimate activities. It is the activity that should be against the law, not possession of the software. I was just wondering what the law used in this case was.
  - saraid216 14y ago
    Yes, but privacy. A lot of activities are incredibly hard to actually catch someone in the act of, and incredibly hard to actually get hard proof of. Possession, on the other hand, is a strong correlation and proof of itself. The reasonableness of this correlation is what draws the line between whether or not possession is illegal, and that's going to be subjective. It's really easy to forget that the first and foremost reason we defend privacy isn't because its breach is icky. It's because illegality is sometimes the right thing to do. However, usually it's not. This is a natural contradiction that makes writing law difficult.
  - wuest 14y ago
    Absolutely agreed--this is a point I made in other posts. I apologize if I came across as harsh--absolutely not my intention.

tlrobinson 14y ago

Out of curiosity, what law makes it illegal?

wuest 14y ago
I'd be curious to find out as well. It's a very fine line between a luhn10 checker, and a luhn10 sniffer--the law's wording would need to be very precise to avoid criminalizing legitimate business software.
- tlrobinson 14y ago
  Plus pen testers could argue that they legitimately need any tool a hacker could possibly use in order to test the security of their systems. nmap was one example I remember hearing would be considered illegal under Germany's new law.
  - wuest 14y ago
    s/could/do/ This is the problem with these manner of laws. Criminalizing the very method by which entities guarantee their security is never a good idea.
    - Retric 14y ago
      It's not that hard to carve out exceptions. Professionals can buy really dangerous fireworks that are 'illegal'.
      - iy56 14y ago
        Most likely this will lead to official certification and registration of pen testers like locksmiths and alarm system installers are required to have in some states..
        wuest 14y ago
        Yeah, this is pretty likely. It's a dangerous road to go down, however, as regulatory bodies can be far from impartial. It's a difficult issue to properly address. I think the right method to go about it is to punish actions, rather than possession of tools. On some level, simply having the ability to write software makes one suspect, if you start scrutinizing tools. Actions (compromising boxes and running exploits without permission of the owner of the host, advertising explicitly criminal use of software) are easy enough to define, and it's easier to define an exclusive list of "bad" actions, than to come up with generalizable rules.

Tichy 14y ago

Remote desktops can be used for all sorts of things, among others helping people with their computer problems.

coldtea 14y ago
And the sellers of THOSE remote desktops don't have a problem.
vidarh 14y ago
In this case the specific software we're talking about had a feature whose specific purpose was to detect someone entering a credit card number, screenshot it and upload the image to an FTP server: 'In further MSN chats with the FBI, the person alleged to be Hogue answered a question about whether the Blackshades software would automatically conduct key logging or whether it had to be initiated manually. "It auto does, and you can download from all at once, or scan for keywords or digits," came the reply. "And if it detects a credit card is being entered, it can send screenshots to FTP and you can scan for digits that are 16 in a row :P"' It also had as a feature to encrypt a users files and pop up a ransom notice: 'Blackshades went beyond DarkComet in its support for features that were likely to result in illegality, such as the "File Hijacker" that could encrypt a victim's key files and then pop up a "ransomware" message demanding payment into a remote bank account in order to free the files. (A note attached to this feature said: "However, one thing to put in mind: This feature was made for educational purposes only.")' In general, even tools that are quite clearly intended for illegal uses seems to be ok. But this one took it much further.
- jiggy2011 14y ago
  I think it depends on the generality of the software. Obviously a general purpose remote desktop program has a lot of more legitimate uses that something designed specifically to find CC numbers. Thing is , you could make a CC sniffing program and then realise "hmm, this might be difficult to defend in court" so you generalise it to something that simply looks for arbitrary strings of numbers. Of course the fact that 90% of your users happen to enter "16" into the box is not your fault. The generalised program might have useful side effects as a result, but it is no less dangerous than the more specific program.

AutoCorrect 14y ago

so you would be ok with people being arrested for selling software to rip dvds or cds?

philhippus 14y ago

ACME kitchen knives: great for chopping onions and murder sprees. Yes that is tongue-in-cheek but there is an equivalence here in that the consumer decides how the product will be used. I do agree that advertising use for illegal activity should be quashed (does that impinge on free-speech?).

wuest 14y ago
> does that impinge on free-speech? It could be argued that free speech necessarily has limitations. Depending on where you are in the world, this involves hate speech and incitation to violence. I would readily agree that distributing (especially SELLING) tools with the expressly stated purpose of criminal use should be punishable. That being said, the same tools are likely useful for legitimate purposes. Heck, I could see an argument for Back Orifice being useful in that one would really like to be assured that their network's egress filtering would raise flags when BO traffic is on the wire. This brings up another important point--these tools are always useful for people who are writing protection and mitigation against the tools' methods.
AnIrishDuck 14y ago
Selling kitchen knives: not illegal. Selling kitchen knives, and giving tips and instruction on where to stab to inflict maximum damage: I'd be very surprised if you're not legally liable for the actions of the third party. But, IANAL. EDIT: as for free speech, the "imminent lawless action" [1] test is AFAIK the current standard in the US. I'm sure there's case law around this that I'm not familiar with, but I'd argue giving killing tips is likely to incite "imminent lawless action" in the knife analogy. 1. http://en.wikipedia.org/wiki/Imminent_lawless_action http://en.wikipedia.org/wiki/Imminent_lawless_action