Forgot your password?
typodupeerror

Immunizing the Internet 181

Posted by ScuttleMonkey
from the shot-in-the-keister dept.
jonny4001 writes "The Harvard Law Review has published a student-written article that argues that hackers, worms, and viruses are good for network security and that the law and public policy should encourage 'beneficial' hacking. From the article: 'Exploitation of security holes prompts users and vendors to close those holes, vendors to emphasize security in system development, and users to adopt improved security practices. This constant strengthening of security reduces the likelihood of a catastrophic attack -- one that would threaten national or even global security [...] Current federal law, however, does not properly value such strategic goals.'"
This discussion has been archived. No new comments can be posted.

Immunizing the Internet

Comments Filter:
  • Finally! (Score:5, Funny)

    by Anonymous Coward on Monday June 26, 2006 @05:29AM (#15604176)
    Totally telling the FBI slashdot said it was 'ok'.
    • Re:Finally! (Score:3, Insightful)

      by Crayon Kid (700279)
      Except it's not ok. Glorifying "hacking" (used loosely) makes it look cool and omnipresent and makes it accepted at some level. Stupid young kids see it as a desirable activity.

      And claiming that a certain amount of malware going around helps security measures stay alert is silly. The analogy with living organisms and biological malware is way off. Computer malware doesn't thrive in the wild, mutating randomly. It is powered by misguided humans and by misguided blacklisting approaches to security.

      Perpetuatin
  • by Heavyporker (922078) on Monday June 26, 2006 @05:29AM (#15604177) Homepage
    Darwin operates perfectly online! Now all we need is to set up the digital version of the Darwin Awards. Now, granted, idiot users aren't permanently removed from the gene pools, but if they ram enough computers into the dirt, they'll be dirt-poor and thus unsuitable as mates, hence they won't reproduce. Right?
    • Re:Wow! Who knew? (Score:5, Insightful)

      by Tatarize (682683) on Monday June 26, 2006 @05:38AM (#15604202) Homepage
      It turns out while your a child, you will turn out better if you touch everything and pick your nose and eat your buggers.

      In general being exposed to a lot of germs (typically harmless) trains up your immune system. buggers catch a lot of local bacteria and allows for exposure in a safe and weakened form.

      -- Just because it's correct. Doesn't make you want to do it.
      • It turns out while your a child, you will turn out better if you touch everything and pick your nose and eat your buggers.

        While it may be safe to eat those who bug you, you may instead try eating your boogers.
         
        • I was under the impression that buggers was a verb, implying that it was healthful for a child to perform oral sex on a person who performs anal sex on him or her. Unless the poster meant burgers. Who knew that eating fast food could be healthy?
      • Yeah, but you just try going around sneezing on babies....

        Mark
      • Heh, try saying that in England.

        To the point, children may be stronger for this, but its increasingly a problem for adults having petri dishes running around.
    • Re:Wow! Who knew? (Score:2, Insightful)

      by Joebert (946227)
      hence they won't reproduce

      Don't bet on it.
  • by argent (18001) <peter@slashdot.2 ... m ['nga' in gap]> on Monday June 26, 2006 @05:30AM (#15604178) Homepage Journal
    More than a quarter of a century ago I inadvertently found a hole in a UNIX based bulletin board system, went in and fixed the code, called the operator to tell him what I'd done and how to fix the rest of the problems, and ended up with a series of contracts.

    A few years later I wouldn't have considered it. People who'd not done much more had spent time in court and been threatened with jail. Not much later, you had people actually doing jail time for simply "knocking on doors".

    What happened?

    The whole "ethical intruder" meme had spread, and people had started cracking into systems and then claiming they were just "rattling doorknobs" to "help security". Of course you couldn't tell an "ethical hacker" from a crook, and the crooks could claim they were just trying to help.

    It's the "ethical hackers" themselves that have made it impossible for this kind of activity to be condoned.
    • by Xugumad (39311) on Monday June 26, 2006 @06:07AM (#15604263)
      I think also, as systems stop being maintained by one person, and are covered by a group, it has become a lot less easy to simply go "Ah, they meant well, I'll just ignore it". Instead, the entire group has to come to a decision, and no-one wants to be seen as lazy at maintaining security.

      I've seen a student here report a security hole (the muppet that originally developed the web app they were using tracked currently logged in user by putting their username in the CGI parameters. Change the name, and you can be whoever you want), and some members of staff still wanted to seem the kicked out (we did manage to talk some sense into them, though). Point is, if it had just gone to the person maintaining the system at the time (me), I'd have patched up the code, thanked them, and forgotten about it.
    • by Anonymous Coward
      ... but going in jail is may be a worse option.

      It is true that bad hackers will pretend to be ethical hackers but by putting everone in jail you end up creating a less secure world. Only the bad hackers will find the security hole and they won't tell anyone.

      Full discolure is the only solution and it is not popular: companies get bad press for having security holes, they might loose some business and thus try to shoot the messenger ... with success so far.

      However, full discolure is a necessary evil it we wan
      • by Anonymous Coward
        Exactly, but there is a time and a place for full disclosure, and the situation is easily complicated. Even just the act of disclosure is uncertain. Publish to widely and be accused of helping hackers. Publish too narrowly, and be accused of not informing the public. Its a messy job.
    • by jaclu (66513) on Monday June 26, 2006 @07:47AM (#15604492)
      One problem is accountabilitty,

      While I do agree with you, that a kid reporting an error and perhaps even a sugested solution, would be regarded as helpful and something of a "white-hat" on a private perspective

      However one thing that has changed since the early eighties is that now there is usually quite a bit more money involved.

      Now accountability is a big concern.

      If that kid was into a system I admin, I must realize that even if he propably just is helpful, I still cant be sure, after all he was in there, where he shouldnt have been, who knows what he did and discover but not tell me about.

      And thats what its all about, ne one side I have a complete stranger who claims that he has been in one of my systems, found a few bugs, and have a few suggestions, one the other side is that the only way to be sure of system integrity is to asume that the system is completely penetraded, and do a very expensive security checkup, to see how much damage that _could_ have occured.

      If I trust the kid, and he happens to be a black-hat - poof - there goes my job

      If he turns out to be a white-hat, well in that case he was nice and not much won for either me or my clients (since we have to do an expensive audit anyhow)

      So I would asume he was a black-hat, cause if he wasnt, I havent lost much... Maybe synical, but thats how it works. /Jacob Lundqvist

      • Doing an expensive audit after an intrusion is the cost of not having enough security in the first place. If you got hacked, you got hacked. It's true that it doesn't matter whether or not anything else was done with respect to the follow-up audit.

        Having someone come forward and say "you've got a rather specific problem that needs fixing and here's a way to maybe fix it" and then going and doing your damnedest to ruin their career and/or put that person in jail is simply needlessly shooting the messenger.
        • Maybe I was unclear, I didnt mention it in the post but I work in Sweden, and here we dont have the same tradition of suing people. Not because we are nice guys, more because the fines here are not very high, so going to court is not normally a way to turn a profit. You would more propably sue somebody if you wanted to taint there records if (you belive) they really are crocked, but only if you have a reasonably good case. Here the loser pays all legal expences, and also a corp losing to the "little guy" is
      • way to be sure of system integrity is to asume that the system is completely penetraded, and do a very expensive security checkup, to see how much damage that _could_ have occured.

        Which, arguably, you should have done in the first place.
      • ... [On] one side I have a complete stranger who claims that he has been in one of my systems, found a few bugs, and have a few suggestions, one the other side is that the only way to be sure of system integrity is to asume that the system is completely penetra[t]ed...

        Yeah, it's like what von Clausewitz said about war: "You plan for what the enemy can do, not what he will do."

        When somebody can corrupt your whole system, the only secure way to proceed is to assume they already have.
    • What? Are you trolling or just high? Your premises don't just fail to support your conclusion-- they would appear to support the exact opposite conclusion. You've distinguished "ethical hackers" as being separate from crooks, and then blamed the "ethical hackers" for the problem.

      It's crooks who are the problem, but more commonly it just appears to be lawyers who are the major part of it, since they so often find themselves "forced" to do due-diligence and attempt to prosecute every little thing that come
    • The whole "ethical intruder" meme had spread, and people had started cracking into systems and then claiming they were just "rattling doorknobs" to "help security". Of course you couldn't tell an "ethical hacker" from a crook, and the crooks could claim they were just trying to help.

      That's like a jewel thief or bank robber claiming they were "just trying to help out" when relieving a bank or jewelry store of its goods. Breaking and entering is breaking and entering -- if you do not belong in a place and

      • by Anonymous Coward

        That's like a jewel thief or bank robber claiming they were "just trying to help out" when relieving a bank or jewelry store of its goods. Breaking and entering is breaking and entering -- if you do not belong in a place and you enter that place without authorization, you're breaking the law.

        In that case, using your metaphor, what happens to the person who walks by the jewelry store and calls the owner (or the authorities) to inform them that the door has been left open. In a real jewelry store, the owner w

  • PDF WARNING! (Score:5, Informative)

    by Maelwryth (982896) on Monday June 26, 2006 @05:30AM (#15604180)
    The link is directly to a .pdf file. This [66.102.7.104] should link to the Google html cache.
  • by Anonymous Coward on Monday June 26, 2006 @05:34AM (#15604188)
    I'm sure plenty won't click the link, so you are missing out on the great title that was left out of the summary:
    IMMUNIZING THE INTERNET, OR: HOW I LEARNED TO STOP WORRYING AND LOVE THE WORM
    • by arivanov (12034) on Monday June 26, 2006 @06:24AM (#15604312) Homepage
      Well...

      Realistically this is the history repeating itself. Many times.

      Prior to Edward Jenner discovering the vaccination the people tried to instill immunity to Smallpox in their children by a process known as variolation. The difference from vaccination was that people were deliberately infecting children with the real virus hoping that they have it in a milder form. Well... and if not, that was just a child, one more, one less who cares. In some more awkward and less developed parts of the world this is still done with Varicella, and less frequent Rubella, Measles and Mumps.

      Society attitudes have changed since. The majority no longer consideres normal to infect children with the real viruses. Still, even now, there are idiots who insist that "having child diseases is good for the children as it improves their character" (or other such bollocks).

      Similarly, infecting networks with real worms is not dissimilar to variolation. There are plenty of security tools out there nowdays which can detect the vulnerabilities that can be used by the worm and force the user to fix them. There is no real need to weed out the "weak" (yeah, I know, I am tempted myself to weed out the idiotz sometimes).

      And as far as jo average user it will take some time for them to grow up, but it will end up the same as with vaccination. People were reluctant to do it initially. That is not the case now.
      • ***Well... and if not, that was just a child, one more, one less who cares.***

        Can you provide any sources for this statement? Every description I've ever seen of losing a child, even in the bad old days, was usually pretty painful. You probably have to exempt the usual psychopaths.
        • It was usually referred to: "Such was the God's will".

          Which as far as I am concerned is about the same as the "one more, one less" attitude. Just a different form of it.

          Let's not forget that 40%+ child (under 7) mortality was something normal as recently as the 19th century in most of Europe. People in those days were much more familiar with child death in the family then us. I am not saying that they did not care at all. Only idiots do not. They simply cared less, because they did not have a choice. Tuberc
          • Being more familiar with child death is not equivelent to "They simply cared less". It means they were more familiar, nothing greater. I noticed you did not provide any linkage to any form of support for your view.

            The reason for exposing children to mumps, etc. (as my mother did me) is that these childhood diseases were far less fatal to children. They can easily kill adults.
      • The point of the article is not that we need to weed out the weak, but that hackers serve the purpose of revealing vulnerabilities in our systems, and allow us to take action to secure our systems. If they use non-destructive methods to reveal these system weaknesses, they should either not be punished, or their punishment should be proportionate (to what it might be if their attack was destructive). The point is that if we are continually having our systems tested by hackers and then fixing the weaknesses
        • Nobody's debating that a hack exposed a fixable problem. The debate is on whether the hacker should be absolved of responsibility for system penetration just because it highlights a problem. No is my answer.
          • The debate is on whether the hacker should be absolved of responsibility for system penetration just because it highlights a problem.

            No, the issue, at least in the article, is to what degree do we punish or encourage system penetration, and should punishment fit actual damage rather than simple penetration.

            There's nothing wrong with your opinion in and of itself, but perhaps you should actually read the entire article (for comprehension) before commenting on it. The author never suggests that there should n
  • by amelith (920455) on Monday June 26, 2006 @05:34AM (#15604189) Homepage
    So bank robbery is good for their security and should be encouraged? Everyone who moves to a new city should be immediately mugged so they can learn valuable lessons about personal security? Perhaps there should be an official quota of licensed murders so people don't get too lax about their own safety?

    What is the special magic about technology that makes people give opposite answers to "Is X sensible?" and "Is X sensible using a computer?" for just about all values of X?

    Ame
    • Might be a good idea, as long as you make the Robbers' Guild (wrong name I'm sure?) hand out receipts so nobody gets mugged more than three times a year. :)
    • Why Shouldn't it :-P (Score:2, Interesting)

      by sakahna (597647)
      Harry Harrison makes exacly this argument in his Stainless Steel Rat [wikipedia.org] series. As long as no-one gets physically hurt, the banks pass on the loss to their insurers, the police have what to do, the media what to report, the general public is entertained and the money is put back into circulation. So in theory, "everybody benefits".

      Of course, real-life doesn't work like that. Just look how every little imaginery threat is currently used by the PTBs to further clamp down on the innocent general public.
      • by Anonymous Coward
        "the banks pass on the loss to their insurers"

        Yeah, because we all know that insurers are not part of the system at all; unlike the rest of us, they have access to magic money-making machines powered by pixie dust.
        • by badfish99 (826052) on Monday June 26, 2006 @06:29AM (#15604325)
          No, it's trickle-down economics in action. The banks recover the cost from their customers, who are mostly rich businessmen. So some of the wealth of those rich people ends up having trickled down to the poor robbers. Isn't that how things are supposed to work?

          The rich people were probably just going to donate their spare wealth to charity to help the poor: robbery saves them the trouble of having to do that, too. It's a win-win situation!

    • by Animaether (411575) on Monday June 26, 2006 @06:06AM (#15604261) Journal
      Imagine if this was the so-manieth discussion about music or video copyright infringement. Now ask again: "What is the special magic about technology". I think you'll find your answer.

      I don't agree with it, for what it's worth, in either case.
    • Well all those crimes hurt people/corporations. "Ethical hacking" is capable of occurring without causing damages. If I find a hole in a system for a remote code execution exploit, run code that simply displays a console message on a server, then determine how to fix the hole and inform the system administrator, that seems harmless. It allows the admin to find out about the hole and fix it. Now if I were to run code that roots the box and turns it into a spam bot sending millions of spam emails out wast
      • Should I be penalized if I go to your house, find out how to break into it, and tell you what I found?

        I hate these kinds of analogies, but can't help but play along...

        How would you feel about having someone hanging out outside your front door playing with the locks, going to your windows and seeing if they open, trying to peep in your bedroom blinds, tracking what time your kids leave and come home from school, and sitting in a parked car across the street for a few days staring at you?

        Would it make you fee
        • That's a good point. I don't think I COULD respond positively to a statement like that. I wouldn't want someone to be that involved in my home's security, monitoring my family's activities, playing with the locks, etc... but if someone was driving by and noticed my front door was open all day, or saw that I had a rope hanging out one of the bedroom windows for someone to climb, I'd want them to let me know. I wouldn't want someone to constantly be brute forcing my ssh server, or hitting my web server wit
    • by evilviper (135110) on Monday June 26, 2006 @06:38AM (#15604341) Journal
      So bank robbery is good for their security and should be encouraged?

      This isn't the equivalent of bank robbery (nobody gets potentially harmed, and no real damage done). Rather, a far better example would be the instances of journalists repeatedly and successfully smuggling weapons through TSA security, onto commercial flights. Absolutely no real harm is done by it, and success leads to very important good things (increasing security where it is lacking).

      The more they will find security holes, and make the system safer against the real threat, the truely malicious professionals. Of course, the analogy isn't perfect, but it's far closer than bank robbery and murder.

      What is the special magic about technology that makes people give opposite answers to "Is X sensible?" and "Is X sensible using a computer?" for just about all values of X?

      Probably because of people like you... People who can't relate the computer world to the proper real-world equivalents, and therefore have a really warped and twisted misunderstanding of the computer world.
      • a far better example would be the instances of journalists repeatedly and successfully smuggling weapons through TSA security, onto commercial flights. Absolutely no real harm is done by it

        Is that so? Hmmm. "No, officer, I'm a journalist, honest. I know I'm wearing a turban and have a foreign-sounding name, but I wasn't going to use these explosives strapped to my chest. It's just for a newspaper story. Sorry, what? 'Press card'? Er, no, I left that at home, sorry. But I really wasn't going to s

    • by Archtech (159117) on Monday June 26, 2006 @06:57AM (#15604386)
      Every time computer security is discussed, someone immediately trots out the "burglar" analogy. I have nothing against analogies - they are very useful for getting insight into unfamiliar situations - but every analogy has its limits. In this case, a burglar is someone whose only purpose is to steal property for his own gain. Some people who hack into computers have this motivation, but many do not.

      This is where the analogy breaks down catastrophically. There is no simple, familiar motivation for anyone to try getting into a house as an intellectual exercise, or even as a challenge. Either the house is wide open - in which case it would be legal to enter in some jurisdictions, while in others the householder could legitimately shoot an intruder anyway - or it is secured, in which case any attempt to gain entry is almost certainly of a criminal nature.

      Computers are different, in that trying to understand and improve on software mechanisms is a universal impulse among (good) programmers. Bill Gates, and many other people who came to be famous, hacked in his youth. The sainted Richard Feynman confessed openly to having made a hobby of getting into as many locked areas and safes as he could, while working on the Manhattan Project. He had absolutely no ill intentions, although he was well aware that the military bosses would be hard to convince of that. Incidentally, he told of a valuable spin-off, when a senior official left the project and his immense safe was found to be secured. No one had the combination, and they were thinking of explosives and thermic lances until Feynman came along and casually opened it.

      Please don't accuse me of trying to excuse genuine criminals - I am the last person to do that. But do realize that many people who experiment with software do so from motives of genuine curiosity and intellectual challenge, which can be very useful if properly harnessed. And let's get over the crude physical analogy of "breaking into" a computer. A computer is a machine that executes instructions. When some sets of instructions are executed, the computer can display words, numbers, and pictures meaningful to humans, and accept human input through keyboards and other devices. A computer does not have a mind of any sort, and thus cannot be deceived, pleased, annoyed, or educated. Moreover, the idea of the computer as a structure or territory that could be broken into is simply an analogy that helps us to think about it; it does not correspond to anything real.
      • OK, let's say someone steals your car, but not for personal gain, only so they can figure out how internal combustion works . . .

        I have no real point here. I just wanted to work a car analogy into the conversation. =)
      • And let's get over the crude physical analogy of "breaking into" a computer. A computer is a machine that executes instructions. When some sets of instructions are executed, the computer can display words, numbers, and pictures meaningful to humans, and accept human input through keyboards and other devices. A computer does not have a mind of any sort, and thus cannot be deceived, pleased, annoyed, or educated. Moreover, the idea of the computer as a structure or territory that could be broken into is simpl

        • Bringing the "mind" element in was a tactical error, I admit; I was broadening my assault on comparisons of computers with any physical form of property whatsoever.

          A computer is an abstract machine for manipulating information. As good /.ers, we all understand that implicitly, but it's amazing how many people don't. They think it's a machine for running Office, or a machine for browsing the Web, or for email, or for playing games. Whereas it is actually all of the above and infinitely more, just as "the nat
          • A computer is an abstract machine for manipulating information. As good /.ers, we all understand that implicitly, but it's amazing how many people don't. They think it's a machine for running Office, or a machine for browsing the Web, or for email, or for playing games. Whereas it is actually all of the above and infinitely more, just as "the natural numbers" are not just 1, or 2, or 3 although it includes them.

            Exactly. They're also becoming pervasive in areas that have little to do with either generic off

        • I am quite in agreement with the parent poster about the problems with analogies. You bring up bank vaults. During WWII, there was no secret more valuable than the work of the Manhatten Project. General Groves, the commanding officer, had a safe for his top secrets. Richard Feynmann, a physicist on the project, is famous for 'cracking' the safe. Feynmann didn't end up in prison, he got a Nobel Prize for some of his later work. Feynann's method was very simple. 1) He read the f***ing manual, 2) he tr
      • This is where the analogy breaks down catastrophically. There is no simple, familiar motivation for anyone to try getting into a house as an intellectual exercise, or even as a challenge. Either the house is wide open - in which case it would be legal to enter in some jurisdictions, while in others the householder could legitimately shoot an intruder anyway - or it is secured, in which case any attempt to gain entry is almost certainly of a criminal nature.

        Slightly off-topic, but there is a quite funny pr

    • The special thing is stupidity. Consider the things you see and hear about IT security in real life.
      People taping their keys next to their door.
      Banks where you just state a different name and get full access to the corresponding accounts.
      People stating that they don't bother if other people can access everything in their house as long as they don't do anything that actually harms them ("i don't care if someone can read my mail")

      I and probably everyone on slashdot know people who don't give a shit about IT s
    • Well, if it's *ethical* hacking you're talking about, the offline analogue wouldn't be bank robbing, it would be noticing that someone's front door looks a bit flimsy, managing to easily open it without doing any damage, then letting the owner know, perhaps fixing the problem in the process.

      If you break into a computer system, copy/steal/mess around with stuff, then tell the maintainer, it's hardly ethical, is it?

      That's not to say that it's sensible, just that done right, it's absolutely nothing like bank r
    • In fact, thanks to bank robbers, safes are safer today than they were 100 years ago.
      • Actually, thanks to people designing better bank vaults. That they are motivated by bank robbers shouldn't mean you give credit to the bank robber. Give credit to the engineer building the bank vaults. Bank robbers don't design safes. At least, not yet.
    • Your analogy is simply broken and does not apply to this situation in the way you want it to.

      It's not good for banks to be robbed, but it is good for honest people to be thinking about how their bank might be robbed and to go to the management and say "Hey, I've noticed that you've got this weakness that would let me walk off with a lot of money". ...provided, of course, that they're not summarily charged with conspiracy and sentenced to a few years in jail.
    • by egarland (120202) on Monday June 26, 2006 @09:34AM (#15605055)
      We already have laws that make stealing illegal, there's no reason for making doing it "with a computer" special. If you break into a computer and steal money, you stole money, go to jail.

      If I break into a computer and play a prank that hurts no one, why should I be facing hard jail time where if I had just broken into a building and played a prank the police would probably not even bother tracking down who did it?

      Somehow people in the technology world have gotten it in their heads that people being curious and testing boundries deserves ass pounding federal prison time. This is incredibly destructive to some of the most important qualities in people: curiosity, cleverness, inventiveness all get squashed by this concept of "if we didn't intend for you to be able to do something and you do, you're a criminal".

      This is highly destructive to real network security, the kind of security where even if people want to do something you didn't intend them to do, they can't. We need to go back to making tinkering with interfaces provided to you legal. The rule should be, if you don't want me to be able to tinker with the interface, don't provide it to me.

      If hacking is a crime only criminals will hack.
    • So bank robbery is good for their security and should be encouraged? Everyone who moves to a new city should be immediately mugged so they can learn valuable lessons about personal security? Perhaps there should be an official quota of licensed murders so people don't get too lax about their own safety?

      Look... I live in a city which has had over 300 murders last year, god knows how many rapes, and roberies are common place.

      Not to exscuse the criminal, but these things happen and that is why most banks here
  • by Joebert (946227) on Monday June 26, 2006 @05:37AM (#15604197) Homepage
    How I learned to stop worrying & love the worm.

    Looks like I found a new Taquila drinking buddy.
  • by Anonymous Coward on Monday June 26, 2006 @05:41AM (#15604209)
    .... too late. It doesn't even have to be a real security issue. It can be something as simple as good security practices. Here are ideas I would recommend e-mail providers, for example, to implement.

    Dual passwords. A master password which can change anything in the account, and a secondary password which can change anything but the master password. The idea is that if your secondary password is stolen, you clean your machine (just incase you were infected), log in with your master password, change your secondary password, and everything is fine.

    Freezing expired accounts for 10 year periods to prevent someone from grabbing it up and gaining mail-forgotten-password privledges from other sites. Got a bank account? Got online banking? Got an account which you can easily send your password to your e-mail address? Oh wait! Your e-mail address expired! Someone else registered it, went to a bunch of bank websites and such, just to see if your former e-mail address has an account there.
  • Keep someone in a clean room all their life and then one day let them out. With an immune system that has never had the chance to "practice" they guy wouldn't last a week. On the other hand its been proven that eating your own boogers will boost your immune system. Just extend the same logic to a network.
  • open source hacking (Score:3, Interesting)

    by joe 155 (937621) on Monday June 26, 2006 @05:48AM (#15604225) Journal
    does anyone know where you can get open source hacking tools to use against your own system? I would like to know if my password could stand up to a traditional brute force crack, or if it would be possible to use remote ssh login to get contol of my computer...
  • by jkrise (535370) on Monday June 26, 2006 @05:55AM (#15604238) Journal
    Hackers, worms, and viruses are good for network security ("Security Software firms such as Symantec) and that the law and public policy should encourage 'beneficial' hacking (Legislation must ensure we keep such firms running). From the article: 'Exploitation of security holes prompts users and vendors to close those holes (Makes people believe that such defects are inevitable, and can only be solved by continuous updates) , vendors to emphasize security in system development, and users to adopt improved security practices. This constant strengthening of security (reliance on vendors for updates) reduces the likelihood of a catastrophic attack -- one that would threaten national or even global security (any negative impact on suspect business practices OR bottom-lines)

    Makes sense now, don't you think?
  • by Opportunist (166417) on Monday June 26, 2006 @06:00AM (#15604248)
    The idea that finding a hole and reporting it leads to more security works in a "perfect" setup. Perfect in a sense that the one finding it reports it instead of abuses it, and the one informed about it fixes it instead of ignoring it.

    The reality looks different.

    In reality, people don't want to be bothered with this pesky thing called security. They want their machines to do the magic by themselves and not worry about it. So they created laws where it becomes illegal to even look for a security hole. Because, what you can't see isn't there.

    Take you average user. Just enough smarts to turn on the PC, updating with an automatically generated and even transfered script is beyond their capabilities. When (not if, when) their computer is turned into a spamslugger, who will they blame? Themselves for not being able to keep their machines secure?

    Keep on dreaming.

    The laws are a reflection of the general unconsciousness. People don't want to be hacked, so it must not be done. Yes, the machines are insecure, yes, there are billions of trojans and viruses out there trying to break in (and succeeding, most of the time), but as long as we don't see them, they're not there.

    La la la, I can't hear you...
  • by pubjames (468013) on Monday June 26, 2006 @06:04AM (#15604256)
    I think this raises a fundamental issue - most of our lawmakers and enforcers are people who have not grown up with these new technologies and have little understanding of them, both from a technology point of view, but also their social context.

    Most judges, seeing a bank had implented very poor physical security - so poor that a lone teenager could fairly easily get into the bank without help - would be lenient on the teenager for breaking into that bank and bank would be in lots of legal trouble for having lax security. But when the internet is involved the teenager becomes an evil hacker in the eyes of both our lawmakers and much of society, and it's off to jail for the teen and no punishment for the bank.

    I really worry about the next generation. All kids do stupid stuff and talk about stupid things as they are growing up. Only now, much of that stupid talk is done via electronic communications, and much of the stupid stuff is easier to trace.

    I can see in the near future (maybe it's happening already?) that when a misdemeanour with a youth occurs one of the first steps a law enforcer will take will be to get access to the youths electronic communications. Then they'll uncover all kinds of stuff that will look terrible in the eyes of a law enforcer and the parents - and be extremely embarrassing or worrying for the youth. But in reality will just be the stupid things people do and say when they are growing up. We'll have youngers going to jail and being ostracized by their parents and society just for doing and saying the stupid things that we all did when we were young.

    • "Most judges...would be lenient on the teenager for breaking into that bank..."

      Bullshit. The teen would have gone to jail. Just because the window's open don't mean it's ok to enter.
      • I didn't say the teen would go unpunished. But the judge could understand the temptation of the open window and that the kid just climbed through it, and would likely be lenient in his sentence. Using the same situation as a metaphor on the internet, the judge wouldn't be able to understand if the window was open or not, and is less likely to be lenient in his sentence.
  • by m874t232 (973431) on Monday June 26, 2006 @06:22AM (#15604308)
    They should be against companies running buggy or insecure servers and end up exposing customer data or causing hassles to their customers.

    As for "hackers", they should be held responsible under existing fraud laws if they commit fraud; the mere act of "breaking into" a computer system should not be a violation of law.
    • the mere act of "breaking into" a computer system should not be a violation of law.

      if there was no security, are you actually breaking in? so, in which case, are you violating the law by attempting to discover if there is any security in place?

      in meatspace, if you walked up to a building and try and open the door, but it's locked, as I understand it you've committed no crime. If the door is locked and you pick the lock without damaging it, you are committing a criminal offense of trespass. If you break

  • by trims (10010) on Monday June 26, 2006 @06:33AM (#15604334) Homepage

    The paper (or article, or whatever) is actually quite well-nuanced and fairly even-handed. However, it suffers from a fatal flaw of many legal articles: a fundamental ignorance of the subject matter itself.

    It's a paper written by (wannabe) lawyers, who, while they site large rafts of supposedly corroberating papers and "experts", don't understand what they (the exports and sited papers) are talking about.

    This kind of approach is eminently practical (and effective) when attempting to try a case, or negotiate a settlement. However, it is absolutely the wrong way to do things when attempting to write a Public Policy piece. If one is attempting to educate the populance (or some subsection of it) about an issue, you have to actually understand the subject, not just quote others' ideas.

    They are correct in the supposition that cybercrime has a different nature than that of "real world" crime. But they completely misunderstand how this difference affects people.

    A classic example of not really understanding the subject matter occurs when they claim that a compromised system actually causes very little economic damage, as the system itself is not physically damaged, and the effort to repair it is theoretically comparable to a periodic security audit/update of the machine. What they perceive is a JoyRide in a "stolen" car - someone took my car out for a whirl, and if they've returned it in good shape, all I (the owner) have to do is sweep out a few of the crumbs (and maybe fix the door lock) before it is ready to go again. This isn't the true case. Rather, it is closer to the case that I, the owner, would have to completely dissassemble the entire car, and put it back together again from its component parts, just to make sure that the kids didn't screw something up (or wire a bomb to the ignition). There is a HUGE economic cost to cleaning up after even a minor intrusion. Because, frankly, there is no way to determine if something was a minor or a major intrusion, until a complete postmortem is done. And the risk associated with keeping a compromised system working is far too great to NOT do the full rebuild. In many ways, the risk analysis looks a lot like empidemiology: when a herd of cows is found to contain one case of Mad Cow, we kill the entire herd and check them all, rather than just kill the sick cow, and say "oh, we found the problem, and it is fixed now".

    The real solution is not to allow "ethical hackers", but rather to provide economic incentives for companies to protect their data. If this were the case, then companies would take security seriously, and there would be a whole thriving sector of legal security probing companies (which exists in a very tiny manner today). If companies were held to multimillion dollar fines every time private data was compromised, you could be damned well sure that security would rank somewhere above "oh, and empty the trash before you leave tonight", which is where it currently resides. And security checks would be done by true professionals, complete with after-incident reports and improvement suggestions.

    -Erik

    • You seem to be the only one to mention this problem: on most systems, an intrusion means that you need to completely reset (at least) the invaded machine. Quite often, although, also possibly compromised passwords, authentication files, etc. must also be reset on a global scale.

      This measure of loss is overinclusive, however, because much of the cost of restoring system integrity is money that one should reasonably expect users to spend anyway. Whenever security flaws are discovered, users spend time and

  • by davmoo (63521) on Monday June 26, 2006 @06:44AM (#15604353)
    So to use this same idea, y'all have no problem if I discover your back door to your house is unlocked and I come in just to look around and make sure there are no other 'security issues', right? I promise I won't steal or damage anything, I just want to look around...

    Sorry, it don't work that way, and just because computers are computers doesn't make it any different. If you want to come in to my computer and inspect, I expect you to ask, just like I would for my house.

    When Microsoft is caught sniffing around anyone's computer without permission, even if they don't damage or alter anything, everyone here wants Bill Gates' head on a pike for public display and criminal charges against Microsoft. But if its a white-hat hacker, that's okay, and we should have the law allow them in. Funny how that works.
  • by D.A. Zollinger (549301) on Monday June 26, 2006 @06:45AM (#15604358) Homepage Journal
    From another perspective, the author's ideas have some merit. In biological systems, it is only after one has been infected and their immune system fights off a disease that they are impervious to repeat infections. In this way entire societies build up resistances to deadly diseases. For example, Jared Diamond believes 95% of Native Americans were killed off by diseases carried by European settlers who were largely immune to said diseases. (link) [wikipedia.org]

    In a way, as different portions of the computer systems and software are attacked, the flaws that allow for such attacks are, in general, corrected. Problems identified in one attack can be applied to other areas, and as such, can affect system-wide changes toward a better system (think buffer overruns), as well as more security-minded design (think security developments in IE7 and Vista).

    I'm not advocating that the world governments should let virus writers and crackers have free reign of the Internet. A balanced response would allow for leniency for those who have no malice in their intentions. Of course, this is difficult to prove, and from personal experience, I have yet to meet a virus writer with purely altruistic intentions. Also there are corporate interests to deal with as well. How embarrassing must it have been for Symantic to have their flagship product meant to help secure a computer be the source of insecurity? While Symantic handled the situation extremely well, many other companies do not have a large security minded staff on hand to deal with security problems. For them it is easier to accuse the attacker than acknowledge a problem they cannot deal with.
    • Consider the avian flu (H5N1). The World Health Organization has found evidence that this disease has mutated and is now starting to transmit from human to human, where previously it was only transmitted from bird to human. (link) [arstechnica.com] The chance for a world pandemic has greatly increased with this revelation, yet people and communities who have prepared themselves, and are in good health to begin with will most likely survive the infection, or avoid becoming infected in the first place.

      Similarly, it is the
  • As Good As It Gets (Score:2, Interesting)

    by Joebert (946227)
    I don't think the world can ever be truely secure.
    The world is always in a sort of "Ok on the count of three, we all drop our guns" state.
  • Yeesh.. from the article:

    Even old-fashioned e-mail worms, which rely primarily on user ignorance, can spread to hundreds of thousands of computers.

    Now, I always thought a worm is "self-contained and does not need to be part of another program to propagate itself. They are often designed to exploit the file transmission capabilities found on many computers."

    Geez people - if you can't cromulize your terminology, I have little faith in your article..

  • by Flying pig (925874) on Monday June 26, 2006 @07:35AM (#15604459)
    There is a possible way...

    Introduce a properly run certification scheme for "Certified ethical hacker". Base it on a course taking in relevant law, security techniques etc., and make damn sure it is vendor-agnostic. Only make the course available to persons who have no criminal convictions, are on the voter's list, member of a professional body, and pass FBI checks or your national alternative. It will be free to qualified applicants.

    Now issue those people with a set of official paper forms, with proper security marking and tied to the individual. When they encounter a security issue, they issue a paper based advisory (because it is still traceable, and because you do not then leave a trail on the net that might enable the black hats to find and target you.) copy to some official body who every year will report the statistics, and list the companies that failed to respond to security advisories.

    So now you have it on your resume when you write in for the bank job: Certified Ethical Hacker, 42 confirmed alerts (or whatever).

    Before anybody tells me this is simply fantasy, consider that there are already volunteer public security forces. In the UK we have Special Constables and the Territorial Army, and there are equivalents in many other countries. We have a Health and Safety Executive who can walk into any company at any time it is operating and demand immediately to observe what is going on. So why not a properly trained volunteer Internet security force?

  • by Tei (520358)
    Imagine a white hat h4xo that found a dangerous hole, send info about that to admins, and that hole is fixed.

    Its that good?

    I think yes. but need:

    1) The white hat attitude. Complete morons are discarded.
    2) Its a hole, and not a feature. Maybe the users want the system this way, and know enough about the tradeoff.
    3) The hole being fixed. If is imposible to fix holes, maybe because lack or resources, this help nothing. Of course, the problem here is the lack of resources.

    On real world, some people want to live
  • Too late (Score:3, Interesting)

    by MECC (8478) * on Monday June 26, 2006 @08:42AM (#15604729)
    Microsoft has 'educated' an entire generation of users that you have to run with full root privileges to get anything useful done at all. This is completely independent from how they respond to security issues raised by third parties. The damage is so pervasive that it can't be undone. MS stands as the village idiot of software companies for such a stupid design paradigm, and the single biggest problem on the Internet, as well as the single biggest problem in the IT industry for so completely dumbing down so many people. I wouldn't look to vista to cure the ill either. The more MS talks about security, the more evident it is that they can't pull their head out of their ass, and they'll keep dumbing down their 'customers'.
  • by sarlos (903082) on Monday June 26, 2006 @09:28AM (#15605021)
    Does no one else here see the glaring hole in this person's argument? There is no such thing as a beneficial virus, worm, or trojan, period, end of story, thank you, have a nice day. Information Security is commonly accepted as a three-part problem: Confidentiality, Integrity, Avalability. Even seemingly innocuous viruses carry huge costs, mostly in the form of hindering Availability. Further, as a System Administrator, how can you ever be completely sure a virus that compromised a system was 'benign?' Answer: You can't. The only safe bet is to restore the system from the last safe backup.

    The problem is akin to the broken window problem in economics. Sure, exploiting security holes leads to more fixes, but you have to take into account the costs. Further, this does not mean Information Security itself is improving, it simply means virus, trojan, and worm writers have to become more creative.

    In short -- if this is what Harvard is producing these days, maybe it's time we re-asses the "Ivy League."
  • ... just kick all the homeless people off of it.
  • This whole debate about black hats, grey hats, etc. is ridiculous. I don't give a crap about itension for the intrusion. If I didn't invite you to break into my system, then you're trespassing and should be punished. I don't care if you've told me about it or not. Now, if you stumble and only stumble (As in not go any farther than to point out a potential weakness and not go snooping), that's different. You haven't actually hacked. When you cross that line, you've screwed yourself and should be punish
  • The problem is that threat analysis judges people by what they can do, not by what they are assumed to want to do. So someone who knows about a hole in your system is a threat! They must be STOPPED!

    I can see that it might well be more rational to judge people by the damage they do or can be shown to have been attempting to do, but that requires judgement. And it's always safer to say "It's HIS fault!", then to acknowledge that you may have made a mistake.

    So I don't see things getting better or saner. Pe
  • When I saw this headline I was thinking. While it is impossible to get every host clean, it is certainly possible for a quickly reacting organization to do the following:

    1.detect malware, viruses, crackers, zombie traffic, etc.
    2.define an identifying pattern and critical data segments to be destroyed
    3.diffuse this info to major routers and other servers on the net around the world
    4.ISPs and smart individuals can also subscribe to the data feed
    5.Routers and firewalls use this feed to filter out (or rewrite

Wernher von Braun settled for a V-2 when he coulda had a V-8.

Working...