Legal goons threaten researcher for reporting security bug
When vuln disclosures are outlawed...
A German software company has threatened legal action against a security researcher who privately reported a critical vulnerability in one of its programs, Dark Reading reports.
Legal goons from Magix AG sent a nasty gram to a researcher who goes by “Acidgen” after he reported the stack buffer overflow in the company's Music Maker 16. According to the report, Acidgen alerted Magix representatives to the bug in several emails that also included proof-of-concept code that forced the Windows calculator to open, indicating the flaw could be exploited to execute malicious code on a victim's computer.
Acidgen also provided suggestions for fixing the flaw, Dark Reading said. He also told the representatives he planned to disclose vulnerability details publicly once a patch was released.
That's when things got ugly.
“MAGIX does not appreciate that you are intending to publicly release the Exploit and to cause irreparable harm,” a company attorney wrote. “As you maybe [sic] aware it is illegal to release software which is intended to commit computer sabotage (e.g. Sec. 202C I No. 2 German Criminal Law). In addition this announcement together with your offering to have the vulnerability fixed by your company may be considered as an attempted extortion.”
The letter said Magix would “enter into all necessary and appropriate legal steps” and to “inform manufacturers of antivirus software that there might be a new virus based on your code.”
Germany enacted a draconian hacker law in 2007 that also criminalizes the creation or possession of dual-use security tools. ®
Acidgen sent an email and asked to make the following points:
"I didn't ask them if they needed help with patching their vulnerability or creating any kind of fix. I asked if they wanted a fuzzing service. I didn't state 'what' company or how and when. They've just assumed as their strolled by my linkedin, and saw that i have a registred buisniess. Also, they asked me to create the PoC for them."
my company web site...
...Once got owned by a group of defacer types. It was pretty much a boilerplate hack. No damage to the actual site, just a new index page. The deface page linked to their IRC server, so I went in, introduced myself, and politely asked what the vuln was and how I could fix it. I figured that if I got nailed so easily I must have done something dumb; no point in getting in a huff.
They were quite helpful - one of them sent a message to the guy who did the hack to join - and told me what was up. Turns out there was a problem with phpbb, and my isp hadn't updated mine. I asked them what I needed to do, and the hacker said, "nothing - I fixed it after I got in". And he had.
It makes no sense at all that people respond like this - all you do is piss off someone who's already proven they have the ability to hurt you. It's a bit like the saying about trying to beat up an elephant bare-handed - you get tired and the elephant gets pissed off.
rather than say 'thanks for highlighting how crap our software really is' - they try and filler the cavernous security holes with legal threats - how does that help?? Just get on and fix the crap that has been created and learn from them.
assuming is easy
did you read the same article ? It is not mentioned that the researcher was trying to force the company into using his services ?
"Acidgen also provided suggestions for fixing the flaw, Dark Reading said. He also told the representatives he planned to disclose vulnerability details publicly once a patch was released."
nowhere is mentioned that Acidgen was setting a date. "Once a patch was released" is not the same as saying that I will release the bug and exploit code at a set date.