Anti-hacking laws 'can hobble net security'
Good Samaritans discouraged by threat of prosecution
Agentless Backup is Not a Myth
Jeremiah Grossman has long stopped looking for vulnerabilities in specific websites, and even if he suspects a site to have a critical flaw that could be compromised by an attacker, he's decided to keep quiet.
The silence weighs heavily on the web security researcher. While ideally he would like to find flaws, and help companies eliminate them, the act of discovering a vulnerability in any site on the internet almost always entails gaining unauthorised access to someone else's server - a crime that prosecutors have been all too willing to pursue.
"I have long since curtailed my research," said Grossman, who serves as the chief technology officer for website security firm WhiteHat Security. "Any web security researcher that has been around long enough will notice vulnerabilities without doing anything. When that happens, I don't tell anyone, rather than risk reputational damage to myself and my company."
Grossman's fears underscore the fact that security researchers who find flaws in websites are crossing a line and trespassing on systems that do not belong to them. However, applying the law to good Samaritans interested in eliminating possible online risks only undermines the security of the Internet, a working group of researchers, digital-rights advocates and federal law enforcement officials concluded this week.
"I think that if you look at the software security world, there has been many, many cases of someone knowing about a vulnerability before you do and be using it out in the wild," said Sara Peters, editor for the Computer Security Institute. "There is no way to say that these same things are not happening in the web world. Assuming that nothing is going wrong, because you haven't heard about it is a very myopic and callow way of looking at it."
Dubbed the Working Group on Web Security Research Law, the panel of experts has started to study whether researchers have any ability to play the good Samaritan and find security flaws in websites without risking prosecution. The group met at the Computer Security Institute's NetSec on Monday and released an initial report that raises more questions about the status of web vulnerability research than provides answers to concerned bug hunters.
While security researchers have been able to test computer software and disclose details about any flaws found, the working group concluded that there is no way to test a web server without prior authorisation and not run the risk of being prosecuted. Software security researchers are free to disclose flaws fully or take part in a process that allows the vendor to plug the holes, while web researchers that disclose vulnerabilities in a way that angers the website owner could easily be reported to law enforcement.
"The way it is right now, if you find a vulnerability and the site owner finds about it, you can be held culpable for anything that happens after that," Peters said. "Perhaps, that is a bit of hyperbole, but not much. There is no culpability for the website owner."
COMMENTS
Re: Great Train Robbery Revealed to be a Security Survey
@Keith T
The real problem in security is not people who test the security of websites(even illegally) it is the lazy, careless and negligent webmasters and so-called IT professionals and the way security is dealt with in general. I will take an example from a close but different field to illustrate, cryptography.
A cryptographic algorithm is not considered secure if its inner workings are unknown and are just claimed to be secure by their creators. It is especially not secure if its security relies on its workings being secret. An algorithm is only considered to be secure if its working is fully public and it has been tested by professionals and non-professionals alike for flaws and none have been found.
The same is true of websites. A web site's security should not rely on the inner workings of the website remaining secret and it being untested by anyone other than the creators and contracted professionals. Having that would be irresponsible as any flaw that was not spotted by them could be spotted by a malicious person and exploited.
If the "amateurs" and "joyriders" as you call them test a website's security it shouldn't be a problem to your "IT professionals" in fact unless their intent is to harm or is malicious in any way(and we are not talking about those kinds of hackers are we?) then they are a great asset to webmasters. Indeed non-malicious hackers don't publish flaws immediately, they contact the webmaster and warn them. If the webmaster doesn't take action then it is their own fault and publishing the results is very ethical since it would help warn unsuspecting users that their information is potentially at risk(And has probably been compromised) and that they should take whatever actions they deem necessary.
Webmasters should respond quickly to warnings about their security especially if they have sensitive information about users(credit card numbers, social security numbers, etc...). They should be grateful for the amateurs who find flaws and warn them about them since that helps them fix those flaws so that they are not exploited by malicious attackers.
I am sorry that this turned into an unplanned rant... I just hate it when somebody bring such stupid sentences out of their asses and cite them as fact: "These amateurs, joyriders, vandals and extortionists are a real problem for IT professionals."
And there I was thinking that the real problems were the script kiddies, spammers, bot-net owners, worm makers and malicious attackers.... But no, no, the real problem was those people looking for security flaws in websites and reporting them to the webmasters.
Intent matters
If it were a journalist checking for unlocked doors at the bank, or testing their security checks, then bringing it up with the bank and publishing it if they refused to acknowledge it, I doubt there'd be many people, apart from the bank, who'd be criticising the journalist for the situation.
Great Train Robbery Revealed to be a Security Survey
A method crooks use is to go down hotel hallways checking for unlocked doors. If a door is unlocked they enter. If someone is in the room, they just claim to be good samaritans doing a security check.
If someone is a security professional, they should be doing what professionals do, and sett up a contract with the client before they do the work.
Passing by a bank after hours and noticing an unlocked door and money loose inside would be analogous to casually visiting a website normally and noticing a security problem in the normal process of using the website.
Clearly you have committed no crime. And, if you quietly report the problem to the site's webmaster, you are committing no crime.
If you see a "closed", "private", or "no trespassing" sign and enter a bank (without authorization) to look at what is available inside to steal, you are committing a crime even if you you tell police you are a good samaritan doing a security survey.
Likewise with websites. Entering areas posted as off-limits should be illegal.
If, to enter the bank, you use impersonation, stolen or guessed lock codes, a pry bar, etc., you are breaking the law, and claiming to be a good samaritan doing a survey won't stop you being arrested.
Using hacking tools, stolen passwords, guessed passwords, etc. to enter a website should likewise be against the law.
If you publicize how to enter a bank illegally you are aiding someone else in the commission of a crime as an accomplice, conspirator or accessory, and it should be the same with websites and other cyber facilities.
These amateurs, joyriders, vandals and extortionists are a real problem for IT professionals. The justice system needs to deal with them much more harshly.
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
