Full Disclosure mailing list archives
Re: UK ISP threatens security researcher
From: <Glenn.Everhart () chase com>
Date: Wed, 18 Apr 2007 10:53:18 -0400
Extortion is AFAIK the demand for money or valuables without legal authority. I do not believe "fame" qualifies, and in any event one who points out a bug in public has his fame or infamy independently of what a company does. At a former employer (an OS vendor) the general line was to ask customers to not disclose vulnerabilities. However this was accompanied by an almost paranoid internal search-and-destroy attitude toward security holes and by prompt fixes to such problems as became known. As a result the customers supported this stand. Mind, there was little or none of the childish "counting coup" that seems to go on in some quarters involved. Those who advocated disclosing problems did not "claim credit" for finding the problems in the cases that surfaced. The discussion about whether to do so was always centered on the theory (with some observational support) that attackers knew of the bugs already and countermeasures could often be used if the attacks were known to exist. To my mind, a company that wants its problems to be kept quiet externally till fixed needs to earn that consideration by such paranoia. If a company is smart it will communicate with outsiders who point out problems. (Communicating about problems that can affect third party software is also a good thing. Many of us did.) Still, one who reveals a problem to the public is contributing to public knowledge, and that act by itself is not extortion or bullying. It should not be confused with such. The ethical issues center around whether the warning might help avoid a problem, or simply precipitate it. A similar ethical issue appeared in science fiction and is a caution to the "reveal everything" side. In the story a small group learns to build a cheap doomsday device. In the end one of them kills the others because he worries about it being used for extortion. However, he is shortly afterwards killed by his wife, who worries that if the device can be built her children's lives cannot be safe. The law ought to be clear that revealing information freely is OK, but that something that risks precipitating a catastrophe is not. A properly defended (in 2nd Amendment sense!) society might very well in clear cases resort to the science fiction solution. On the other hand, claiming such risk for every oversight, and at the same time not advertising your code does not run in hostile environments, is a kind of public fraud which does not deserve either protection or respect. The science fiction example is in clearly defined territory. Computer risks are seldom so, and before legal (or extralegal societal extreme) measures get involved there should be much more proof than has been common, and clarity about what is arguably beneficial and what is thuggery. When I propose designs, by the way, I am very glad to have heard about vulnerabilities in different technical areas so I might design around them. If I must propose a kludge I am also very glad to have heard about where the dangers lie. At least it allows my guesstimates of how long the kludge might be used to be more accurate. In the case referred to, the ISP's arguments remind me of what English banks were reputed to do some years ago when thefts occurred: argue that (in so many words) "our systems are secure so you must have done something wrong to breach them". Yep, bullying seems to be going on, but from the ISP. A response more along the lines of fixing the holes (as Microsoft has done when holes cropped up in its mail systems) would be more responsible. Had they considered that the researcher was giving them free help, having found the problem due to some vulnerabilities the ISP's software was causing on his home system, the ISP would have wound up looking better. Reading the original post btw shows the guy gives a workaround for customers to close the holes created in their home systems. No evidence there far as I can see that the guy wanted anything other than to alert others about a hole in their own systems that the ISP software created (perhaps inadvertently), and what he noted. (That they responded noting that the terms & conditions say a customer is responsible for security of account passwords selected by the customer, and claiming this somehow applies to passwords evidently "selected" by the ISP, is an indication of CYA, not of problem solving.) Glenn Everhart -----Original Message----- From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-bounces () lists grok org uk]On Behalf Of Dr. Neal Krawetz, PhD Sent: Wednesday, April 18, 2007 8:01 AM To: full-disclosure () lists grok org uk; ge () linuxbox org Subject: Re: [Full-disclosure] UK ISP threatens security researcher ********************************************************************** This transmission may contain information that is privileged, confidential, legally privileged, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. Although this transmission and any attachments are believed to be free of any virus or other defect that might affect any computer system into which it is received and opened, it is the responsibility of the recipient to ensure that it is virus free and no responsibility is accepted by JPMorgan Chase & Co., its subsidiaries and affiliates, as applicable, for any loss or damage arising in any way from its use. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you. ********************************************************************** -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Let's keep in mind that publishing most security information borders extortion. There isn't any other industry where fat nerds try to strongarm large corporations into admitting there are weaknesses in their products, defaming them publicly, causing their stock prices to fall, or otherwise damaging their public image and thus causing financial damage, et cetera. Gadi, I doubt your people would be thrilled if you tried to petition Yahweh with complaints regarding His children being vulnerable to pieces of metal fired at high velocity from guns, and demanding that if things aren't fixed within what you consider a satisfactory timeframe (which, in the end is just some arbitrary number invented by people with no concept of industry and economics) that you will arm every man, woman, child, and lizard of bordering Arabic nations to Israel in order to teach that big guy up in the sky a lesson about not making humans impervious to gunfire! Come on man! You're smarter than this! When socially inept people who possess only rudimentary computer skills start bullying (call it what you will, in the end if you argue against my points you clearly are one of those people who can't make it in the real world) corporations for fame and money, which have real-world financial consequences to said corporate entities, you are in the least committing extortion. And while you might think these efforts are noble, the reality of the situation is simple - this is absolutely no different than a bunch of Russians with botnets, forcing businesses to comply with their demands if that business wishes to continue existing on the Internet. When was the last time an auto manufacturer was humiliated publicly because their car windows can easily be broken and contents of the car stolen? When have chain manufacturers been chastised by the mass media for the existence of bolt cutters? What about the serious threat of hacksaws? People, grow up. If your life is spent behind a computer discovering uninteresting oversights in software design, where you clearly lack experience and ability, and proclaiming yourself the #chatzone badass and drolling saying "I'm the best evah!!!" doesn't make you important. The sad state of this industry is that there are enough ignorant people that find it impressive, and who don't understand the ramifications of their publicity whoring and the obvious parallels to other industries. The long and short of it is: If you want to act like a criminal, be prepared to be treated like a criminal, and don't cry about the choices you've made in life. You aren't a fucking martyr when your motivations and cause are only self-promoting and otherwise selfish. Always remember the embarrassment to hackers, humans, and Hebrews everywhere that is Kevin Mitnick. - - Dr. Neal Krawetz, PhD http://www.hackerfactor.com/blog/ On Tue, 17 Apr 2007 19:30:54 -0400 Gadi Evron <ge () linuxbox org> wrote:
http://www.theregister.com/2007/04/17/hackers_service_terminated/ "A 21-year-old college student in London had his internet service terminated and was threatened with legal action after publishing details of a critical vulnerability that can compromise the security of the ISP's subscribers." I happen to know the guy, and I am saddened by this. Gadi. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wpwEAQECAAYFAkYmCAUACgkQDpFP8dW5K4bwFgP/Z2cmOC7HiPZ9Bp1p0VqC/1IMv40l Vxi/gS/jMQMDG9XiIZqnDQQwMGm8OhnBu6LfMPi66Xnfr9ZV5zcE3wCeqlRfDsyAuAD7 TvpzfqAfhdLDgfG6hmX9BBZdpALXIa4ijwKuo4zs5uqtA/najmlIwgDjmGXC1NefQsZP acyWgT8= =zSxl -----END PGP SIGNATURE----- -- Click here for free information on earning a criminal justice degree today. http://tagline.hushmail.com/fc/CAaCXv1S4xxoKJy71c1syHceuiPxgdCh/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ********************************************************************** This transmission may contain information that is privileged, confidential, legally privileged, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. Although this transmission and any attachments are believed to be free of any virus or other defect that might affect any computer system into which it is received and opened, it is the responsibility of the recipient to ensure that it is virus free and no responsibility is accepted by JPMorgan Chase & Co., its subsidiaries and affiliates, as applicable, for any loss or damage arising in any way from its use. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you. ********************************************************************** _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- UK ISP threatens security researcher Gadi Evron (Apr 17)
- <Possible follow-ups>
- Re: UK ISP threatens security researcher Dr. Neal Krawetz, PhD (Apr 18)
- Re: UK ISP threatens security researcher Tremaine Lea (Apr 18)
- Re: UK ISP threatens security researcher Thomas Pollet (Apr 18)
- Re: UK ISP threatens security researcher Matt Richard (Apr 18)
- Re: UK ISP threatens security researcher Ajay Pal Singh Atwal (Apr 18)
- Re: UK ISP threatens security researcher Glenn.Everhart (Apr 18)
- Re: UK ISP threatens security researcher jt5944-27a (Apr 18)