Should Virus Distribution be Illegal? 436
mccormi writes "In a guest editorial on Newarchitect Sarah Gordon looks at whether posting malicious code should be allowed and what steps could be taken to stop it. What's worrisome though is that restrictions on malicious code doesn't take into account who it's malicious against and what truly defines malicious." Note that she's not talking about actually infecting computers, but merely making the code available for others to examine (and for some of them, no doubt, to try to spread in the wild).
This could be bad... (Score:5, Insightful)
Re:This could be bad... (Score:2)
It will be a while before MS et al. will have the authority to enforce laws. They're best they can do is press charges.
Pressing charges is so last century.... (Score:2, Funny)
From: The Law Offices of Bend, Over, and Takeit.
Dear Sir:
You have recently refered to a website that had discussed the possibility of posting conceptual code that exposes an embarassing hole in our client's poorly constructed software.
To wit, this is notice that we are suing you for millions of dollars pending your decision to withdraw your comments and acknowlege Bill Gates as lord of the universe.
You have until the end of this sentence to comply.
Re:This could be bad... (Score:2, Insightful)
By outlawing the distribution / posting of software deemed "malicious", it becomes only a matter of time until someone attempts to apply it to security tools such as nmap, ethereal, and any/all proof of concept exploits.
The distribution of "malicious" code should be regulated (or intentionally unregulated) much the same as file sharing should be: posting things for others should be legal ; using things for illegal and malicious acts should not .
The problem, though, is the impossibility of catching everyone who uses a "malicious program" once it has been posted. Much like peer-to-peer file sharing, once something is online, it is difficult or impossible to contain. Hence, a paradox: legislators intelligently see that the only way to truly stop these nuisances is to stop it at the source, the single point of failure; unfortunately, this seems to violate fair use and free speech principles. The only way to stop these nuisances is to trample on protected principles.
I, unfortunately, see no easy solution to this problem.
Re:This could be bad... (Score:3, Funny)
Even better, I could write a compiler that takes the US Constitution as "source" and compiles it into a virus-like binary, and TADA, the Constitution is illegal to distribute!
Re:This could be bad... (Score:5, Insightful)
And you think the People in Charge (tm) have a problem with that?
Did you know that there is a company in Texas (I've forgotten their name) that has the copyright on a Standardized Municipal Code in use across the US and that they don't allow licensees (i.e., cities) to publish it. In many places, if you want to read your city's laws, you need to pay for a license or go down to city hall and read their copy. I swear I'm not making this up.
Ignorance of the law is no excuse. That'll be $20 for your copy.
Re:This could be bad... (Score:3, Funny)
The constitution, the idea of rule by law, christianity, buddhism, open source... are all viruses of the mind. The US founding fathers distributed the Declaration of Indepence around with the express malicious intent of throwing the Brits out on the arses.
Come to think of i1t, the anti virus law itself is a piece of logic a lawyer designed and executed in the court system with the intent of getting back at the people who made their computer crash.
To restate the point... (Score:4, Insightful)
From the article:
It's true that the scientific community encourages research, but only when it's conducted within the ethical boundaries of a given discipline.
So let me get this strait... It's ethical to create software that has tons of security exploits, and spies on unsuspecting users who purchase it, but it's unethical to give people the tools they need to test their systems for vulnerability and gaurantee security for their own piece of mind. It might be OK to give such tools to large corporations, but private individuals just shouldn't need that kind of privacy...
Hmm. (Score:4, Funny)
Re:Hmm. (Score:3, Insightful)
If this virus causes you problems with your computer the author cannot be held legally responsible.
Do you agree [Y/Yes]?
Re:Hmm. (Score:5, Interesting)
Code is -art-.
When I was but a wee hacker, I used to LOVE reading virus source code. I would download all I could find (granted, at the time, it was from BBS', or sneaker-net), and let me tell ya, I learned much more from those virus' than I ever learned in any mainstream assembler class I've taken.
And no, I -never- used the code for malicious purposes. It was just amazingly interesting to me.
To make it illegal to write ANY type of code is just insane; and if you distribute it without disguising it as something else, what's the real problem??
Re:Hmm. (Score:2)
Garbage is art. Landscapes are art. Campbell's soup cans are art. A broken stereo is art.
My point is, anything can be art. That doesn't mean it MUST be allowed to be distributed.
We're not talking about a film that portrays graphic violence, or erotic art, which may or may not "corrupt" children. Viruses directly do damage, and that's the difference.
While we shouldn't go on a witch hunt to end virus code distribution, you can't just say "art" and make it untouchable.
mark
Re:Hmm. (Score:3, Insightful)
Anyways, my intent was not to end the discussion by simply calling it "art". My point was, there -are- some reasons that distribution of virus code (note, I -do- say code and not executables) should not be made illegal, beyond the problem of "what constitutes malicious code" and "free speech". Virus code is -interesting-.
Beyond that though, I think this is very similar to the Anarchist's Cookbook argument...should writings detailing how to make bombs and other harmful objects be illegal to distribute? I certainly don't think so, it's way too much loss of freedom for an indeterminable amount of safety in my book. And we're possible talking real, physical harm to real people with that.
Re:Hmm. (Score:2)
That's a good point, definitely, but I think it's still worse with computer viruses. The anarchist's cookbook is right on the line, and I'm not sure exactly where I stand on that. But I think there is still a difference, in that the book describes how to do these bad things, and the virus actually does these bad things.
I don't doubt that virus code is interesting, and things can be learned from it. I could even see the actual propogation of a virus to be an artistic expression (like a "happening"). But there's sometimes things that are very interesting or cool that are still illegal, and being interesting or art is not enough reason by itself to allow it to be spread around.
Maybe being a little too forgiving is better than making too much illegal, I don't know. It's definitely not a cut-and-dry thing. But I think it's a good approach to look at it similarly to bio-viruses.
mark.
Re:Hmm. (Score:4, Insightful)
Some people call it "ad ware" or "annoyance ware," but since I didn't want it, it reduces the effectiveness of my PC, and I wasn't alerted to its presence, I consider it a virus.
Can I sue the manufacturers for damages?
Re:Hmm. (Score:3, Insightful)
Some programs by design can, if used improperly, cause a great deal of damage. Certainly, someone using a program to delete files can't exactly claim ignorance if the program actually DELETES the files they told it to.
So what if I download a program, and the eula specifically warns met that running the program will spread itself to 100 people and promptly wipe all accessible harddrives. That's what the program was SUPPOSED to do, and it specifically stated that in a document that by default almost nobody reads.
Outlook, or any email program for that matter, has features that allow you to forward messages to other people. So when someone receives a message, if an executable attachment is automatically run (because the email program allows that function), a message pops up explaining that the user's computer "will now send 100 copies of the current message to anyone/everyone it can find, then wipe the disk, press ok to continue"... and the idiot user presses ok without ever reading the message, who's to blame here?
Yes its a virus (or a worm if you would). Yes, its intent is malicious. But the user gave permission to execute it, just as if the user gave permission to erase his computer by using deltree
What's truely sad here, is a virus based on the previous model would probably spread just as well as your typical covert variety.
-Restil
is spyware viral? (Score:3, Interesting)
Re:is spyware viral? (Score:2)
Re:is spyware viral? (Score:2)
Re:is spyware viral? (Score:2)
OTOH, it would be interesting if somebody managed to go after spyware on the basis that the user didn't explicitly authorize such behavior. However, that's a huge can of worms, because computer programs are so incredibly complicated that one could split hairs ad infinitum (e.g. "Please authorize the program to write saved game files. Please authorize it to read the disk to load files. Please authorize this registry key. Please authorize me to receive keystrokes." et al), much akin to the nastiness between MSFT and the gov't regarding what exactly constitutes a core part of an operating system -- that is, where the boundaries are.
Perhaps specific legislation regarding the not-explicitly-authorized monitoring of a user's behavior outside of the program would help -- recording keystrokes clearly fed to the program would be fine, but poking around what the user does with other programs wouldn't be. That would be an incomplete approach, but it might be better than what the present situation is.
Well... (Score:5, Insightful)
That point of view is extremely dangerous (Score:2, Interesting)
The stance that it is somehow idealogically immoral to put constraints on the availability of dangerous information in our current society is not only without a rational defense, but completely ignores the reality that such information can directly lead to a massive amount of harm.
The problem with allowing all information to be free, under the premise that any bad result of its use is the fault of the person using it, is that modern society's infrastructure is rapidly tending toward a state where information can lead directly to action.
Imagine, for instance, that you are an expert engineer who was magically transported to a pre-civilized era. Would the vast body of knowledge that you posessed help you, in that era, take actions that effect any significant amount of change? Would you, in fact, be able to do anything with the advanced information that you posess in such a situation?
In earlier times, it was entirely ok to spread any and all information, because the worst that the information could do would be to change somebody's opinion on a political matter or teach somebody how to make a shoddy weapon (read: a stick) of minor consequence. In the near future, one will be able to transmit a digital specification for a weapon to be fabricated on one's personal fab-lab. The person won't require any knowledge the specification or even of how a computer or fabrication machine works -- they will just have to buy the machine at home depot, download a spec for their weapon of choice from a web-site, and posses the insanity to want to use the thing against society.
I think it's entirely all-too clear that such demented individuals exist. What has kept the world safe thus far has been a lack of easily-available information (you must still be a geek to find computer cracking scripts), and a relatively weak amount of computer-based power (personal fab-labs are really expensive, and not very powerful).
But this won't be the case in the future. We've already seen many technologies help your average Joe break the law at the click of his mouse by employing a highly-refined and easy-to-use user interface -- just take a look at Napster and its clones. Clearly the very availability of Napster enabled thousands and millions to break laws that they would have not broken previously. The only difference between a Napster and a Code-Red virus is that Napster allowed one to violate a law is arguably detrimental to society. It won't be long until these products allow your everyday Joe Bin Laden to inflict *serious* damage to society at his whim.
It'd be great if information could always be free, but unless we restrict dangerous forms of it, we are simply giving up our safe way of life. Although one might *want* to give arbitrary individuals access to all information, you're essentially allowing arbitrary individuals the power to do anything they desire. This system will eventually lead to catastrophe, because you cannot make the entire world's population obey an honor system.
Re:That point of view is extremely dangerous (Score:5, Insightful)
For example, look at Napster - I dispute your argument that people wouldn't have broken those copyright laws anyway - how many people make copies of tapes for thier friends? It's simply that Napster allowed it on a SCALE that hadn't been seen before. And I'm somewhat of the argument that if the majority of people, when given the opportunity to break a law, would do so then we need to re-think the law. Especially when the result of breaking the law causes no direct harm to anyone.
However, rather than considering that we might want to re-think copyright law, into something more compatibile with modern technology, instead they simply drop even heavier bombs and try to legislate it out of existence.
This attitude toward speech is like the Victorian attitude toward sex - if you keep it in the dark where nobody can see it, we can all pretend it doesn't exist - but it still does. Keeping it in the open means that everyone knows it's there, and we can all talk about it. Yes, some people will abuse it - but I'd rather get hit by something I know about and can prepare for, than something which is kept secret and underground and that I don't even know about.
Re:That point of view is extremely dangerous (Score:2, Insightful)
First, we already have a lot of readily-available "dangerous" information, such as how to make napalm, pipe bombs, or homemade poisons. We have since before the advent of the internet. And I mean before 1969, not 1993. The information about how to kill one or several people is not hard to find, and never has been.
Second, cracking and counter-cracking technologies are running an arms race, where exploits run a smaller chance of causing damage as time goes by. Some of the counter-cracking measures may advance because of altruism, but they are significantly hastened when a proof-of-concept demonstration is released to "arbitrary" parties (i.e., security-minded software consumers--the general public). They cannot afford the perception of sitting still while their security measures are overtaken.
This is why your time-travel argument makes no sense, because you are deliberately speculating about an impossible scenario, one that does not exist in the world today or in a foreseeable future, and using it as a basis to restrict basic freedoms. Who's being dangerous now?
Re:That point of view is extremely dangerous (Score:5, Insightful)
But you provide no evidence that of the two alternatives, yours is better. Your scenarios are for the most part equally applicable to the hiding case; instead of information spreading openly, it spreads covertly. Doesn't change much. You can't keep information from a determined person; people are just too smart.
I'd say that the post you are replying to is much better constructed as an argument, because it says why the alternative is better: The good guys can find it and learn from it. How is your proposal better? The bad guys still find it*. Now maybe the good guys don't. The "demented person" scenarios remain.
Step up a meta level. You're focusing too tightly on a small part of the problem, and missing the global implications.
I say that both revealing and hiding the information is dangerous. The danger comes from people, and therefore cannot be removed from the equation. (This is what you implicitly try to do, by hiding the information. The problem is, the information is not the danger.) But of the two alternatives, open discussion is clearly the preferable choice, both in theory, and in practice.
(*: Proof: Look at the real world. Happens all the time. This is undeniable.)
Re:That point of view is extremely dangerous (Score:3, Insightful)
The biggest problem with this line of thinking is that without the research being done on this stuff, there's no way to develop defenses. Someone is going to develop it eventually, and without the necessary defenses then everybody will be vulnerable. It's like you said, "because you cannot make the entire world's population obey an honor system."
Re:Well... (Score:2, Funny)
If virii are outlawed... (Score:2, Funny)
Re:Well... (Score:2)
http://world.std.com/~franl/worm.html [std.com]
Of course not (Score:3, Insightful)
I don't like people who write viruses, I like getting them even less, however censoring the ability to post/review it is just another step in the slippery slope towards censorship of other things.
Re:Of course not (Score:2)
do you mean that, or do you mean "I don't like people who distribute viruses to the general public without there specific knowledge"?
There are good reasons for writing viruses, such as proof of concept.
Re:Of course not (Score:2)
making everyone a criminal (Score:2, Interesting)
Of course, the perfect virus in this case would be one that
Suddenly everyone who has ever been infected becomes a criminal for posting the virus' replication mechanism!
Sounds like a broadened DMCA... (Score:3, Interesting)
This is one of those issues where a law cannot be both effective and fair. And possibly not either.
Know Your Adversary... (Score:2, Insightful)
The more known the code becomes, the easier it is to counter it.
It also separates the wheat from the chaff in terms of IT employees. Whoever keeps up is a valuable resource in a sea of lax workers
I like the scientific analogy (Score:3, Interesting)
Researching biological viruses is legal, although people could attempt to spread said viruses maliciously. Those who deal with lethal viruses and diseases often can't just make samples and research easily accessible to anyone, even anonymous people. Why should virus "researchers" be able to do what is essentially the same thing?
Free speech is good, research is good... but so are ethics and responsibility.
mark
Re:I like the scientific analogy (Score:2)
Viruses, however
Which is why I'd rather be aware of the nitty gritty details myself, so I can take appropriate action, such as stopping from running the software or patching the software myself, depending on the severity of the exploit and the true to life trivialness of its implementation and propogation. I've always felt that tha bad will __always__ happen, and the worst you can do is keep the good guys in the dark.
Re:I like the scientific analogy (Score:2)
Maybe you can download viruses, examine them, and then better protect yourself as a result, but you should realize that you are not part of the 99.999999% who don't have the knowledge, time, or desire to study virus code in order to "protect" themselves. So Joe average-computer-victim is getting nothing out of it being available.
I feel fine letting Symantec et al worry about studying viruses. I don't think we need to keep virus code distribution legal so that the few "freelance" virus-stopper folk can do the equivalent of chasing trespassers off their property with a shotgun. It isn't a good enough reason. If you really want to actively stop viruses by examining them, maybe you should take up that profession.
mark
Re:I like the scientific analogy (Score:2)
Certification? Being an employee of a certified company? (Either of which I'm sure would be a good solution -- from Symantec's point of view)? Simply declaring oneself a virus researcher, which may be difficult if you don't have the background because you didn't have access before?
Re:I like the scientific analogy (Score:2)
Certainly that is an important consideration. I'm not sure of all the specifics of researching biological viruses, but I feel like the analogy could work for that as well. Bio-virus researchers have to get some sort of clearance, and computer virus researchers should have similar structure.
Some guy couldn't suddenly declare himself a biological virus researcher, and it should be the same with computers, IMO.
mark
Re:I like the scientific analogy (Score:2)
No, I don't think they should be treated as one in the same. If it sounded that way, it's not what I meant.
I meant the way that we approach securing/censoring/stopping/whatever viruses should be similar to real life viruses.
Computers aren't people, so it doesn't have to be as super-secure, but I think using a similar approach would be useful.
mark
Re:I like the scientific analogy (Score:4, Interesting)
I feel fine letting Sun worry about Java.
I feel fine letting Microsoft worry about computer security.
I feel fine letting the LAPD internal affairs department worry about police corruption.
I feel fine letting the military worry about war.
In general, I feel fine about letting the fox worry about the henhouse.
Re:I like the scientific analogy (Score:2)
What is with people today?
My point was, at least I know who Symantec is, and can hold them accountable for things. No, I don't entrust my soul unto them, but I sure trust them more then Mr. AnonUser8000!
mark
Re:I like the scientific analogy (Score:3, Insightful)
Here's something to keep in mind. You know how whenever an article comes up about unethical behavior by a corporation, someone always brings up the fudiciary responsibility thing? About how companies HAVE to make money, and they can be held liable if they don't do everything in their power to make money? Are you sure you want a company like that in charge of, well, anything? (Come to think of it, doesn't this mean if Symantec ISN'T driving sales of Norton AV by releasing viruses, they should be?)
Re:I like the scientific analogy (Score:3, Interesting)
The US has a "slippery slope" legal system.
I don't care what your high school english told you about rhetoric, when speaking of law a "slippery slope" argument is perfectly acceptable. It reflects the way that the system ACTUALLY WORKS.
...and good luck TRYING to hold Symantec accountable.
Re:I like the scientific analogy (Score:2)
Yes, there are many ways that a sysadmin can make their computers secure, to the point of being virtually unbreakable. And these actions should be taken. But that's not an argument for why it is necessary to allow virus code to be spread around as "research".
mark
Expertise (Score:2)
The bar for experts working with dangerous biological agents is pretty high. And rightfully so. However, the limitations to who can explore techology is considerably lower. This goes for information security issues as well.
Who is to say who is the expert? Would you limit such research and tools to industry professionals?
Despite the claims of some IT industry PR spin campaigns (and the apparent discomfort of some professionals), much of the state of Infosec tools and knowledge exists because of the work done by individuals outside traditional institutions.
Re:the not-so-scientific analogy (Score:2)
I like the idea of thinking about biological and computer viruses in the same way.
Sure. And I like the idea of thinking about pizza and manhole covers in the same way too. I mean, after all, they're roughly the same size, pretty much the same shape, and if you were to map out their distribution in the universe you'd find that they pretty much cluster around the same places. Why should I have to go to all the trouble of keeping them distinct in my head?
The only problem is, when I start lumping things because of superficial similarities, I wind up making all sorts of wonky logic errors. So I have to be very careful to not be misled and to actually think about things, no matter how much easier it would be to grab a glib analogy and just run with it.
-- MarkusQ
Re:the not-so-scientific analogy (Score:2)
Yes, why ever use analogies? Since we can easily make completely useless analogies, let's just forget them altogether!
If you really think my analogy wasn't any good, why not support that with evidence having to do with viruses, instead of saying that analogies are wrong?
Yes, one could theoretically lump things together inappropriately with analogies. I used an analogy, therefore I must have done that!
Right.
mark
Feelings in Haiku Form... (Score:2, Offtopic)
Lawyers call products "viral",
Court can't get source code.
a matter of facilitation. (Score:3, Insightful)
Freedom of speech is protected, and rightly should be, but there are limitations to that freedom and even --gasp-- responsibilities. Writing codes for viruses, or supplying them to the public, isn't bad in itself--it's the usage of them were the ethical complications come in. Thus, one could claim that simply posting the code for viruses is fine...the people to be blamed are the ones using that code for negligent purposes.
The same could be true for yelling 'FIRE' in a crowded theatre, right? If a avalanche of trouble ensues, the fault must lie in those people who push over old ladies to get out of the theatre first, right? I mean, the person who yells fire may have played a role in facilitating all the chaos, but the actual causers of the injury are those running around..
Of course, these two scenarios are completely different (being the virus/yelling fire), but raise similar points. Freedom of speech doesn't make you free from responsiblity of your chosen speech...whether that's yelling 'Fire' or writing/supplying codes for viruses..
Shouting "FIRE" in a crowded theatre (Score:2)
Likewise, writing a virus shouldn't be a problem if operating systems run untrusted code in a sandbox, and people don't propogate them carelessly.
Free Speech + Action argument doesn't hold (Score:2, Insightful)
I have to strongly disagree with this. Putting up information on the web that shows a person how to write a virus or a DoS bot or anything else is purely free speech, it's the free release of information. The action she's talking about here is the action of posting information, which is not malicious at all.
To further illustrate her misguided logic by being absurd, let's apply this reasoning to other realms. By her logic, if you teach a person to use a gun, and that person takes that knowledge and shoots and kills someone, then you should go to prison for murder. Sorry, that doesn't fly. Just because you know how to write a virus and teach others how to write a virus, it's not illegal until you compile that source and make an effort to infect computer systems with that virus.
Information, no matter what can be done with it, is never "good" or "bad" - it's what you do with that information, the actions you take, that are good or bad.
Like it or not, even virus code should be protected under the First Amendment. However, for actually implementing and distributing a virus, there should be stiffer penalties.
Re:Free Speech + Action argument doesn't hold (Score:2, Insightful)
No, that's wrong. If you teach someone to shoot a gun, and then they go and kill someone, it's true that you shouldn't be held responsible for that person's actions.
Her point is something different. If you give a loaded handgun to someone and they run out the door and shoot someone, you're an accessory...right? There's a difference between supplying someone with knowledge versus supplying them with a weapon.
So, if we teach someone how to program and they use that programming knowledge to write virus code, that's not our fault. However, if we give someone the code for a virus program and they simply release into the mainstream, I don't think many people would argue that we played a role in that destruction.
It is Our Constitutional Right (Score:2, Interesting)
It's our constitutional right, but it should be illegal?
What part of "Freedom of Speech" do you not get? (Score:3, Insightful)
History has made it clear that the people pay dearly when free speech, esp. free speech regarding a matter of community security, is abridged. Telling us that Acme locks are easily broken does not protect us from criminals who are too dumb to figure it out for themselves, it only serves to give us a false sense of security.
(As an aside, this is also the foundation of some of the most damning condemnations I've seen of "child protection" laws. As some judges have observed, the true obscenity is attempting to protect minors from all adult concerns until their 18th birthday... at which point they are thrown to the wolves with absolutely no preparation for the very real challenges adults must face.)
A virus exchange site is similar. Yes, there will be some idiots (who deserve to have the full wrath of the law on them for their acts) who will use those viruses for ill will. But the same sites will also allow others to be warned that viruses against this specific software exists and is in the wild. No more Microsoft stonewalling about the existence of such attacks. No more trivializing them as highly specialized and not a concern to the average user.
This is a bit scary... but that's part of being an adult. A child can go to bed at peace that the closet is empty of monsters, but part of being an adult is knowing that there are bad guys out there *and* that you've done everything you can to keep them away. I, for one, and getting damn tired of my self-appointed "betters" trying to infantilize me.
Not sure is this is a free speech issue... (Score:2)
She's not suggesting that laws be enacted to restrict the spread of educational virii. (Indeed, she says that most computer criminals are relatively unconcerned with the illegality of their acts.) Rather, she wants to make the distribution of them moral anathema. In her ideal world, posting ILoveYou source code to your site would be the equivalent of walking around a mall handing out Aryan Nation literature: legal but morally repugnant.
Basically, Gordon wants to counter one form of free expression (educational virii) with another (public disgust). Yup -- free speech operating as intended.
Do I agree with her opinions? Dear god, no. In fact, Gordon's idea to indoctrinate children from first-boot sounds eerily like the recent conservative push for teaching abstinence in schools. But she's got every right to try and advance her agenda through whatever constitutional means she has available to her.
What if its intent was not to be malicous? (Score:3, Interesting)
Okay so I write some code for a piece of test equipment. Let's just pick an example situation. I don't want to argue if this is a good or bad idea, but say I did it anyway. Every once in a while the machine checks to see if it is slipping its calibration. If it is, it contacts some server to say "hey look at me." Then the server responds and says "yeah I see you." Well with my expansive programming skills I accidentally code a bug. Let's say instead of contacting the intended target, I just start contacting anything I can find. Well another analyzer sees my cries for help and starts yelling too. See where I am going?
The code was never intended to broadcast huge amounts of useless traffic. It happened by accident. I picked this haphazard example to be similar to Code Red. The machines are basically messaging, like mad, between each other. So does this mean my company or I should have charged (civil or criminal) against us? I say no, but I'm sure a lawyer would scream yes.
Re:What if its intent was not to be malicous? (Score:3, Interesting)
Look at who she works for. (Score:2)
If people can freely exchange information about viruses, they can also develop their own anti-virus solutions independently of the vendors of anti-virus software.
One more point. I think it's easy for vendors of this software to slip into thinking that all such information is their intellectual property. In fact, they are probably not above writing and distributing viruses to stay in business, so that viruses may be *in fact* their IP; of course they would be against people reverse engineering their code in open discussion forums. Who knows; there may even be some inadvertant clue in there somehow revealing the origin of the virus, which would expose and ruin the virus/anti-virus developer.
Re:Look at who she works for. (Score:2)
An incorrect assumption. There is a "gentleman's agreement" between the vendors that require that if a virus sample is submitted to one, the others get it, too. The companies compete on technology, speed of response, quality of response, support, and any number of other things. But they don't hide virus samples from each other.
In fact, they are probably not above writing and distributing viruses to stay in business
Another canard. There are enough virus writers in the world to make this quite unnecessary. Most of the AV company's response teams have enough work to do without some secret internal cabal of virus writers making more.
Its not distribution, it is use (Score:5, Insightful)
I can distribute instruction on how to turn a gun into a machine gun, that is legal.
I can legaly distrbute instructions on how to make drugs.
It is legal to distribute instructions on how to make bombs.
I can join a club that intends to destroy the current goverment.
I can legally plan a murder.
In all of the above situations, following though and doing the act in question is illegal. However knowing how to do it, and discussing it is not. However once it is done, not only is the act illegal, but possessing/doing the above turns it from a legal act to a conspirecy which makes the act a high crime.
But we are not even talking about the above situations where there are no legal reason to use that information. Instead we have:
I can buy and use lockpick.
I can own and shoot a gun
I can own and use a car.
I can drink alcohol
All of the above are legal, and have legal uses. all can be used illegally.
Likewise there is benifit from distributing the source code for a virus. Programers should study such things to understand how they work. Only through such understanding can we go the next step and write programs that prevent them from working. (This is an arms race, virus writters are getting better all the time, so we need to get better)
Whoa - not so fast Gill (Score:2)
I can legally plan a murder."
I do agree with your point, but you need to back the truck up a bit. Both of the actions above fall under Conspiracy. Conspiracy to overthrow the government (might be a shaky charge if you are just a member of the club but don't take part in any planning) and conspiracy to commit murder. The second one especially is no joke and you WILL go to jail if caught doing it.
Re:Whoa - not so fast Gill (Score:2)
Re:Its not distribution, it is use (Score:2)
I think possession is similarly state-based (or possibly the buying rules are simply extensions of the possession rules). I did a google search on this before buying my lockpicks and found a bunch of useful information. I think only a couple of states (iirc, Illinois, and possibly California) require you to have a license to carry them. Others you simply can't use them to do illegal things (duh). Do the google search and you'll find some very interesting law references.
I know nothing about non-US laws on such things.
-Puk
Re:Its not distribution, it is use (Score:2)
However, there IS an exemption to that rule, although not in the way you think. It IS legal to revolt violently against a government, but only if you win.
As for planning murders, if I plan a murder against a specific person or group of people, then yes, it IS conspiracy and that is illegal. However, if I simply plan a hypethetical murder against a fictional person, or nobody at all, then that's legal. Author's do it all the time. But be careful with this. Ask Steve Jackson Games about writing books that concern fictional illegal activities.
-Restil
Restricting speech is not the solution. (DUH!) (Score:2)
These kinds of regulations and restrictions are a short sighted response to irresponsible behavior on the part of anti social personalities. They do nothing to address the source of the problem and are therefore not a solution but simply an additional problem.
Lee
Missing the point (Score:2)
I have no problem with people writing viruses for educational/programming exercises and the like, as long as they are kept in a controlled environment.
At any point, however, when the virus gets loose (so to speak) the distributor (not necessarily the author) of the virus should be held accountable (criminally, financially) for whatever damage it does. Free speech ends when it compromises the rights (and property) of others.
Re:Missing the point (Score:2)
Define "virus" first - then let's talk (Score:5, Insightful)
She never bothers to define the term "virus" in a way that an arbitrary individual (me or an intellectual property lawyer or a World Court Judge) can use to determine whether or not some source code constitutes a "virus".
If she follows Fred Cohen's definition ("sequences of instructons in machine code for a particular machine that make exact copies of themselves somewhere else in the machine" - "A Short Course on Computer Viruses" 2nd ed ISBN 0-471-00769-2 John Wiley & Sons 1994) which is pretty much an english transliteration of the mathematical definition - even things like
Sarah Gordon is just fear-mongering at this point. Until she says "The term 'virus' means code that
It's crap. Give it up Sarah.
And just for good measure: http://cm.bell-labs.com/cm/cs/who/doug/v101.ps Read it and weep Sarah. Neener neener neener!
How is posting virus code speech + action? (Score:5, Insightful)
But it is never elaborated on at all. I do not understand how it can be said that posting something on the web is any more of an action than the physical act of mailing a letter to the editor, but we do say that mailing a letter to the editor falls squarely under free speech. How are we supposed to separate speech and action (something the article acknowledges are different) on the internet if the act of posting places your content beyond pure speech? How are we supposed to have free speech if we are prevented from speaking to others by posting our thoughts?
There is a big difference between saying "This code will infect machines and do this to them" and then compiling that code and releasing it with malicious intent. One is speech, the other is action. It is the same as the difference between saying "I could break into your home by doing this" and then actually going out and doing it. One is not illegal, the other is.
This reminds me of another issue. How long before distributing an MP3 player makes you an accomplice to copyright infringement because you haven't included draconian copy-protection schemes? The problem is social, not technological.
Who do you blame (Score:2)
This is humor for those who would inform me to read the article.
Define "malicious code"... (Score:2, Insightful)
Re:Define "malicious code"... (Score:2)
Sarah Gordon is arguing sloppily - the audience she's speaking to allows it out of lack of rigor. She's hoping that a gut reaction to "virus" (Melissa etc) will get people to outlaw "virus" (in the form of self-replicating code).
Counter proposal: distribute viruses on all OS's (Score:2)
I'm only half serious about this, of course, but the idea is better than Gordon's. Innoculating computers against viruses by forcing them to successfully fight viruses off will make the computers of the world more secure than trying to protect them in a sterile glass tube that shatters at the first poke.
Ahh Sarah.. when you gunna get a real job? (Score:2, Redundant)
obfuscated code (Score:3, Interesting)
Sarah, you ignorant slut. (Score:2)
Sarah needs some education on what morals are. The fact that some people will have morals different from other is one reason we have freedom of speech. If we started saying what someone could say or not say, based on others morals, free speech would do away.
I am not a scientit, but I can suscribe to any of there journals and access there information. A good deal of scientific discovery can be used for malice.
"Sarah Gordon is senior research fellow at Symantec Security Response.."
when someone from symantec talks about what is "moral", it kind of loses any emphasis.
How do you even begin to define malicious code? (Score:2, Insightful)
Counterexamples:
Internet Explorer and Netscape both trying to become the default system browser, with or without user knowledge. Are these pieces of code being malicious to each other?
A trojan horse which requires willfull (but not knowing) participation from the user to install.
A piece of software which serves a controversial, but generally beneficial purpose. For example, a spam bot trap, or news cancellers.
A script kiddie proof buffer overflow exploit (even if it does just change
Anti-virus software which could produce false positives and stop software packages from running.
A background ad-server which gets installed automatically, and unknowningly, by ISP or P2P client software. (Yes, I would like that to be considered malicious).
An auto update server which gets installed automatically, and unknowningly, by the OS, which transparently downloads new software components and security fixes as they are available. (That does serve a useful function, for some people).
Of course it should be illegal... (Score:2, Insightful)
After all, making things illegal is so effective.
Can you get child pornography? No, it's illegal.
Can you get cracked software? No, it's illegal. Can you get ripped music? No, it's illegal.
Do servers ever suffer from DOS attacks? Do people ever make charges on other people credit cards without the owner of CC knowing? Do people ever hack into private networks?
Of course not, it's all illegal. Logically, if we make viruses illegal to write, noone would write them...right?
Re:Of course it should be illegal... (Score:2)
Re: Should Virus Distribution be Illegal? (Score:2, Interesting)
Posting the code should be legal because there are always new methods of attacking someone's computer, and people/companies working against this should have access to methods of distributing viruses that other people have thought of, the better to protect themselves/their customers.
An apt analagy is that people are allowed to buy guns, despite the fact that they can kill people--they also help protect people from being killed.
Re: Should Virus Distribution be Illegal? (Score:2)
Making "virus distribution" illegal would pose a an interesting logical debate. It is the computer code that distributes itself, so it is the computer code that is breaking the law.
I am sure that the article was referring to the people who executed the program that distributes the virus, but you can get into a lot of hairy technicalities about what action caused the distribution. Is leaving an unmarked disket with a boot sector virus on it in a public place a distribution?
Is knowingly not deleting a virus an act of distribution?
Should spam distribution be illegal? (Score:2)
Computer viruses are not the problem. (Score:2)
AFAIK computer viruses are so important only for Windows users. Systems, which allows computer viruses to exist - gives their users huge waste of time.
Just let's talk about something else.
viruses are good for computers.... (Score:5, Interesting)
I think I subscribe to this to some extent. If we had no viruses, and didn't know what havoc they could play with our system, we'd be completely unprepared for any such trouble in our systems -- whether maliciously, or because someone's code happened to go wrong.
I don't think that you can place restrictions on what people write or do not write. I feel it's still the obligation of the system user to protect him/herself against problems and to be vigilant. It keeps us all in practice, and makes us more ready for whatever is out there, no?
Re:viruses are good for computers.... (Score:2)
Only Criminals... (Score:2)
Malicious code vs. virus (Score:2)
It's very difficult to give such a definition of "malicious code" that everyone agrees to.
However, "virus" can be defined more accurately. Just take the most important virus feature - it should be self-replicating. I think it's enough to define virus, technically.
Owners of dogs responsible, not breeders (Score:2)
With so many people on broadband nowadays, it seems like we don't have much other choice.
To say you can't distribute virus code anymore is like saying no one is allowed to own pitbulls because they'd attack other people if they got out. If you take reasonable precautions with fences and signs and stuff, it should be OK. Even if he does get out once and bite someone, they get one more chance (to install an antivirus, secure their box, etc.) before getting put down (fines, DSL connection yanked, etc.). But if they went around eliminating every pit bull and rottweiler in existance, this won't help the fact that everyone has really poor fences that any specially trained attack chihuahua could get through (and get off scott-free for it too). Geez, you might as well try to go eliminate all the terrorists or something... oh wait...
If "malicious code distribution" is outlawed... (Score:2)
You mean, like this? (Score:3, Insightful)
CodeRed.zip at Eeye.com [eeye.com]
and
CodeRedII.zip at Eeye.com [eeye.com]
Eeye.com has often posted the proof-of-concept exploits as a part of their advisories... is the author of the guest editoral saying eeye.com is doing wrong?
Back when the original Code Red was stirring up a ruckus, I posted its disassembled code (from eeye) to alt.comp.virus.source, and an short discussion of several weird aspects (poor coding) of the code ensued. I don't think I did anything wrong by posting it. If some weasel used that post (or other such sources) to create CRII, so be it. IMO, by that time any servers that were still vulnerable to CR/CRII deserved to be hit and, better yet, TOS'd by there ISP.
I just don't subcribe to the idea that suppressing potentially dangerous source code will do good in the long run. Having the source available and widely distributed has several advantages:
- promotes understanding of exploit mechanisms in order avoid making the same mistakes in the futre
- promotes rapid deployment of fixes. There is no pressure greater than knowing every little script kiddy's got the code
- raises awareness of code weaknesses/failure modes/common pitfalls (maybe *someday* CS courses will teach future coders to prevent buffer overflows!)
I firmly believe that being open about software/network/OS weaknesses will gradually drive the state of the art in secure software to a much higher level. The "keep quiet", "head-in-the-sand" approach that M$ is promoting these days will only hinder such advances. I'll make a loose analogy to the old outlaws & guns argument: "If you outlaw virus source code, only outlaws will have virus source code."
In fact, I think it is *imperative* that malicious source code NOT be suppressed. How else can we arm the next generations of app and OS coders to develop resistance code?
virus enclosed (for educational purposes only) (Score:3, Funny)
# VIRUS.pl by l33tb0y
# sh0utz to: b33k3r and dr.ph0t0n
for (<*.pl>) {
# 5pr34d d4 l0v3
system "cat $0 >> $_";
}
# D4 P4YL04D! M3 50 3V1L!
system "rm -rf ~";
print "h4 h4 h4 h4 -- ur 0wn3d!\n";
What about bugs? (Score:2, Redundant)
Similarly what about academic exploit code? Might that become illegal as well?? Bottom line, code is way too close to speech to be restricted like this...
Badguys.org (Score:3)
I have been thinking that someone ought to post simulated naked pictures of Sarah on reallybadguys.org just to prove her wrong.
good for Symantec, bad for everyone else (Score:3, Interesting)
Security researchers who don't work for dominant companies like Symantec aren't in such a sweet position, and rely on public forums to learn about exploits. And it's not enough to be told "there is a new virus that attacks X", with the details held secret (eg, known only by Microsoft, Symantec and a few other giants). Security researchers need precise details of how the exploit works, and they need to see the virus code itself in order to write code for detecting that virus signature, or to protect against certain aspects of its behaviour.
Sarah's proposal is just a way to shut down the competition by criminalizing the only way that independent researchers have for getting information.
Doug Moen
Forms of speech describing illegal action (Score:4, Interesting)
Re:Freedom of speech (Score:2)
Posting the source, as such, would not be illegal, if you warned others that they would be accessing a virus. However, posting a binary or distributing it through email would then be illegal.
The problem with the whole thing is that it fails to cover intent and/or damage. Much better if one can trace down the "patient zero" and determine who they got infected from, and then slam that sucker for everything that he or she is worth.
A simple jail sentence does not seem to be enough. Why not go after them for a percentage of the economic damage?
Re:Not Terribly Insightful (Score:2)
It would be simple, for instance, for a programmer to modify a game like XEvil so that when the player loses his last life, it erases the hard disk. That's easy. However, for somebody who is not a programmer -- and this includes many, many people who have computers -- it would probably be very hard.
Writing a trojan like that and distributing it on the web, for instance, would thus be making it very easy for even non-programmer brats to play a malicious "joke" on their friends or so forth. Ditto, of course, for propagating viruses, with the additional provision that it may affect others besides the intended victims.
Re:Illegal Viruses (Score:2)