5 ms·

Responsible disclosure is one of the worst things to happen to the information security industry, and the sale of exploits is similarly terrible. Modern-day whi

by ihsw 13y ago

Responsible disclosure is one of the worst things to happen to the information security industry, and the sale of exploits is similarly terrible. Modern-day white hats have effectively turned into 'green hats' whose goals are no longer compatible with the previously-held ethical hacking belief system. Personally I feel that the sale of exploits should be outlawed, or at least specifically to customers have no intentions of fixing the exploit (buying a hackers silence), or to governments that are intent on conducting clandestine/offensive operations. I also agree with the EFF's stance on exploit sales, and that is that they should be front-and-center in any and all national cyber-security debates: https://www.eff.org/deeplinks/2012/03/zero-day-exploit-sales-should-be-key-point-cybersecurity-debate https://www.eff.org/deeplinks/2012/03/zero-day-exploit-sales... Also on Schneier.com: http://www.schneier.com/blog/archives/2012/06/the_vulnerabili.html http://www.schneier.com/blog/archives/2012/06/the_vulnerabil... No I'm not arguing for zero disclosure or that security researchers shouldn't be compensated for their hard work, I just think that the people and organizations that sell these exploits are effectively complicit in the destruction resulting from these exploits. The world of information security is slowly but surely moving towards a Cold War scenario where nation-states are fostering sustained and escalating tensions, especially where they maintain a stockpile of exploits to be deployed in war-time scenarios.

tcoppi 13y ago
I swear I'm not trying to be rude or snarky here, but do you also believe that manufacturing and selling weapons (guns, ammo, aircraft carriers, whatnot) should be illegal?
- ihsw 13y ago
  No, absolutely not. There are many instances in history where fear and uncertainty were used as political tools to disarm and otherwise control 'untrustworthy' or 'unreliable' people. I'm sure you can imagine what usually follows that line of thought. I have a hard time reconciling that with my feelings about information security and I can see how this would contradict my statement above, but I have different feelings about information security and physical security (ie: in information security there is a very fine line between offensive and defensive capabilities). You and anybody else are welcome to convince me otherwise.
- _delirium 13y ago
  If you take that analogy seriously, a lot of current exploit sales would already be illegal, even without restricting weapons sales further (which I personally think should be done, but that's another discussion). For example, you cannot generally export weapons to another country without a license. In the U.S. you cannot even sell weapons across state lines without a license. Many countries also restrict the sale of even low-level devices likely to be used for sabotage, e.g. molotov cocktails, and that may extend to marginal sabotage devices like spray paint as well. Burglary tools are another example of a restricted device that has some analogies. Lots of what the "security industry" does would land them in jail in any other field, even if it were selling low-level burglary devices to car thieves. Whether it's a good thing it doesn't, I'm not sure. The people taking money for exploits in a "don't ask what they'll do with it" kind of arrangement have a pretty dark shade of gray on their hats.
  - tcoppi 13y ago
    Right, so why is nobody instead saying that exploit sales should be regulated? Why are most people drawing such stark distinctions between exploit weapons and meatspace weapons?
    - ihsw 13y ago
      Meatspace weapons are easy to detect since most/all modes of transportation between nations is monitored and recorded, meanwhile exploit weapons are quite impossible to manage in the same fashion. Decentralized and obfuscated means of communication make it easy to engage in this behavior at scale, for example Tor and Bitcoin. Meatspace weapons of significant destructive capabilities are also large and bulky, too.
      - tcoppi 13y ago
        That doesn't explain why they need to be completely outlawed rather than more strictly controlled, or some other medium. Also, if exploits are "quite impossible" to manage like regular weapons(and I agree that is probably the case, see how crypto export controls worked out), it goes both ways - any laws passed outlawing trafficking in weapons will be impossible to enforce.
- revelation 13y ago
  Exploits are not weapons, and these are very very strictly regulated. Do you think you should be able to disclaim any responsibility after you sold information about faulty material used in bridges all over the world to third-parties with unknown intentions?
jrockway 13y ago
I don't think exploit sales could ever be made illegal in the US. Courts have already ruled that code is speech [1], and the Constitution puts restrictions on how the government can limit speech. First 0-day exploits are illegal, then The New York Times. Exploit sales are basically a byproduct of living in a free society. If you want them to go away, find the exploits yourself and post them to full-disclosure. Or pay someone to. [1] http://en.wikipedia.org/wiki/Bernstein_v._United_States http://en.wikipedia.org/wiki/Bernstein_v._United_States
- deleted 13y ago
  [deleted]
- nitrogen 13y ago
  Can you legally sell exploits of physical systems? Say, a book containing instructions for breaking into any military installation? Maybe it would be enough if an international treaty required all nations, and their intelligence and law enforcement arms, to abstain from using software exploits, and requiring them to disclose any exploit information they acquire to system vendors for prompt correction.
  - jrockway 13y ago
    Probably. A more recent example: can you sell the NSA's confidential slides? The Washington Post apparently can.
- tcoppi 13y ago
  This is the best argument against making them illegal, in my opinion. If you believe source code, code implementing cryptography, and privacy software like Tor and OTR is speech, then you can't set a double-standard just because you don't like what exploits may or may not be sold to do.
- lukifer 13y ago
  We already make certain practical exceptions to free speech that take intent into account: slander, blackmail, death threats, shouting fire in a theater, etc. Though I'm dubious about creating (more) wedges that could erode constitutional rights, outlawing only the selling of exploits seems reasonable. Whereas if you tell the world about a zero day exploit for free, it falls back under free speech.
bilbo0s 13y ago
"...Personally I feel that the sale of exploits should be outlawed...to governments that are intent on conducting clandestine/offensive operations..." You expect governments... to outlaw the sale of exploits.... to themselves?
- ihsw 13y ago
  Yes, absolutely. If we're going to shout to the world that we have a moral high-ground then we should put our money where our mouth is, otherwise we're just two-faced crooks and liars.
mikevm 13y ago
Let's play devil's advocate for a moment. Why should selling exploits be illegal? If I spend many weeks looking for an exploit and I find one, what do I get by disclosing it, to say, Google? The Chrome project does pay a little, but I could probably get more in a bidding war. If Google wants the exploit, it should be able to outbid the other people who are willing to buy it. Time is money after all, and by disclosing an exploit I worked so hard to find I'm basically giving it all away to Google... and for what? For ethical reasons? What ethical reasons? Google is not a person, it's a corporation.
- ihsw 13y ago
  People use Chrome, that is the ethical issue. As long as we're not pretending that we're ethical hackers then that's fine with me. I find it extremely hypocritical to claim to be an ethical hacker and sell exploits at the same time.
  - mikevm 13y ago
    Well, people look for exploits in popular software, so pretty much anything that is being exploited is being used by people. It's Google's job to secure Chrome, not the people out there that are looking for exploits. Why would you work for free (or almost for free)? Do you not need to pay for food & shelter? Frankly, I don't see why finding an exploit and then selling it to someone is unethical. (By the way, you can replace Google by Microsoft or your other favorite corporation)

by ihsw 13y ago

tcoppi 13y ago

I swear I'm not trying to be rude or snarky here, but do you also believe that manufacturing and selling weapons (guns, ammo, aircraft carriers, whatnot) should be illegal?

ihsw 13y ago
No, absolutely not. There are many instances in history where fear and uncertainty were used as political tools to disarm and otherwise control 'untrustworthy' or 'unreliable' people. I'm sure you can imagine what usually follows that line of thought. I have a hard time reconciling that with my feelings about information security and I can see how this would contradict my statement above, but I have different feelings about information security and physical security (ie: in information security there is a very fine line between offensive and defensive capabilities). You and anybody else are welcome to convince me otherwise.
_delirium 13y ago
If you take that analogy seriously, a lot of current exploit sales would already be illegal, even without restricting weapons sales further (which I personally think should be done, but that's another discussion). For example, you cannot generally export weapons to another country without a license. In the U.S. you cannot even sell weapons across state lines without a license. Many countries also restrict the sale of even low-level devices likely to be used for sabotage, e.g. molotov cocktails, and that may extend to marginal sabotage devices like spray paint as well. Burglary tools are another example of a restricted device that has some analogies. Lots of what the "security industry" does would land them in jail in any other field, even if it were selling low-level burglary devices to car thieves. Whether it's a good thing it doesn't, I'm not sure. The people taking money for exploits in a "don't ask what they'll do with it" kind of arrangement have a pretty dark shade of gray on their hats.
- tcoppi 13y ago
  Right, so why is nobody instead saying that exploit sales should be regulated? Why are most people drawing such stark distinctions between exploit weapons and meatspace weapons?
  - ihsw 13y ago
    Meatspace weapons are easy to detect since most/all modes of transportation between nations is monitored and recorded, meanwhile exploit weapons are quite impossible to manage in the same fashion. Decentralized and obfuscated means of communication make it easy to engage in this behavior at scale, for example Tor and Bitcoin. Meatspace weapons of significant destructive capabilities are also large and bulky, too.
    - tcoppi 13y ago
      That doesn't explain why they need to be completely outlawed rather than more strictly controlled, or some other medium. Also, if exploits are "quite impossible" to manage like regular weapons(and I agree that is probably the case, see how crypto export controls worked out), it goes both ways - any laws passed outlawing trafficking in weapons will be impossible to enforce.
revelation 13y ago
Exploits are not weapons, and these are very very strictly regulated. Do you think you should be able to disclaim any responsibility after you sold information about faulty material used in bridges all over the world to third-parties with unknown intentions?

jrockway 13y ago

I don't think exploit sales could ever be made illegal in the US. Courts have already ruled that code is speech [1], and the Constitution puts restrictions on how the government can limit speech. First 0-day exploits are illegal, then The New York Times. Exploit sales are basically a byproduct of living in a free society. If you want them to go away, find the exploits yourself and post them to full-disclosure. Or pay someone to. [1] http://en.wikipedia.org/wiki/Bernstein_v._United_States http://en.wikipedia.org/wiki/Bernstein_v._United_States

deleted 13y ago
[deleted]
nitrogen 13y ago
Can you legally sell exploits of physical systems? Say, a book containing instructions for breaking into any military installation? Maybe it would be enough if an international treaty required all nations, and their intelligence and law enforcement arms, to abstain from using software exploits, and requiring them to disclose any exploit information they acquire to system vendors for prompt correction.
- jrockway 13y ago
  Probably. A more recent example: can you sell the NSA's confidential slides? The Washington Post apparently can.
tcoppi 13y ago
This is the best argument against making them illegal, in my opinion. If you believe source code, code implementing cryptography, and privacy software like Tor and OTR is speech, then you can't set a double-standard just because you don't like what exploits may or may not be sold to do.
lukifer 13y ago
We already make certain practical exceptions to free speech that take intent into account: slander, blackmail, death threats, shouting fire in a theater, etc. Though I'm dubious about creating (more) wedges that could erode constitutional rights, outlawing only the selling of exploits seems reasonable. Whereas if you tell the world about a zero day exploit for free, it falls back under free speech.

bilbo0s 13y ago

"...Personally I feel that the sale of exploits should be outlawed...to governments that are intent on conducting clandestine/offensive operations..." You expect governments... to outlaw the sale of exploits.... to themselves?

ihsw 13y ago
Yes, absolutely. If we're going to shout to the world that we have a moral high-ground then we should put our money where our mouth is, otherwise we're just two-faced crooks and liars.

mikevm 13y ago

Let's play devil's advocate for a moment. Why should selling exploits be illegal? If I spend many weeks looking for an exploit and I find one, what do I get by disclosing it, to say, Google? The Chrome project does pay a little, but I could probably get more in a bidding war. If Google wants the exploit, it should be able to outbid the other people who are willing to buy it. Time is money after all, and by disclosing an exploit I worked so hard to find I'm basically giving it all away to Google... and for what? For ethical reasons? What ethical reasons? Google is not a person, it's a corporation.

ihsw 13y ago
People use Chrome, that is the ethical issue. As long as we're not pretending that we're ethical hackers then that's fine with me. I find it extremely hypocritical to claim to be an ethical hacker and sell exploits at the same time.
- mikevm 13y ago
  Well, people look for exploits in popular software, so pretty much anything that is being exploited is being used by people. It's Google's job to secure Chrome, not the people out there that are looking for exploits. Why would you work for free (or almost for free)? Do you not need to pay for food & shelter? Frankly, I don't see why finding an exploit and then selling it to someone is unethical. (By the way, you can replace Google by Microsoft or your other favorite corporation)