CyberNadir: Former Pilot Randomly Speculates (Incorrectly) That Recent Airbus Crash Could Be The Work Of Hackers

from the all-the-'news'-that's-fit-to-cram-into-a-24-hour-sprawl dept

CNN and Fox had the market cornered on ridiculous airplane crash theories, up until recently. When Malaysia Airlines Flight 17 just up and vanished, CNN produced wall-to-wall coverage seemingly cribbed from low-rent conspiracy theory sites. UFO? Black hole? Any and all theories were entertained.

Fox News hasn't exactly been the epitome of restraint, either. While it managed to avoid following CNN down these plane crash rabbit holes, it too has entertained some theories better left to operations that don't claim "news" to be a major part of their offerings. Fox News host Anna Kooiman suggested the metric system was to blame, what with kilometers being different than miles and Celsius and Fahrenheit not seeing eye-to-eye, potentially leading to some sort of in-flight calculation error.

MSNBC has decided it won't let its competition be the only "news" agencies spouting ridiculous theories. In an effort to get out ahead of the facts -- black box recordings indicated the co-pilot of the aircraft deliberately crashed the plane after locking the commanding pilot out of the cockpit -- MSNBC allowed the following theory to be presented -- completely unchallenged -- by one of its guests.

“There’s one possibility that no one has brought up, and I wonder could this be a hacking incident?” former commercial pilot Jay Rollins told MSNBC’s Diaz-Balart. “This is very similar in my mind to what happened when the U.S. lost that drone over Iran. The same thing, suddenly the aircraft was responding to outside forces…"

Rollins said that the plane’s descent was “worrisome” because “it makes me think about hacking, some sort of interference into the computer system.”

Now, hacking a plane isn't impossible. At 2013's Hack in the Box conference, German security consultant Hugo Teso used his own app -- PlaneSploit -- to demonstrate that an Android phone could be used to reroute a plane, send it diving towards the ground or to set off every alarm in the aircraft.

Or not. Teso's demonstration involved sending flight information to airborne planes with these instructions (in a simulated environment, of course) via ACARS (Aircraft Communications and Response Addressing System) to the FMS (Flight Management System). But there were multiple problems with his plan. First of all, the flight computer has to accept the new instructions and, secondly, pilots would have to be unable to override bad instructions. Neither of which are a distinct possibility.

Patrick Smith, another commercial airline pilot, albeit one far less likely to openly speculate on "hacked" planes than Jay Rollins, pointed out the flaws in Teso's hack.

The problem is, the FMS — and certainly not ACARS — does not directly control an airplane the way people think it does, and the way, with respect to this story, media reports are implying. Neither the FMS nor the autopilot flies the plane. The crew flies the plane through these components. We tell it what to do, when to do it, and how to do it. Whatever data finds its way into the FMS, and regardless of where it’s coming from, it still needs to make sense to the crew. If it doesn’t, we’re not going to allow the plane, or ourselves, to follow it.

The sorts of disruptions that might arise aren’t anything a crew couldn’t notice and easily override. The FMS cannot say to the plane, “descend toward the ground now!” or “Slow to stall speed now!” or “Turn left and fly into that building!” It doesn’t work that way. What you might see would be something like an en route waypoint that would, if followed, carry you astray of course, or an altitude that’s out of whack with what ATC or the charts tells you it ought to be. That sort of thing. Anything weird or unsafe — an incorrect course or altitude — would be corrected very quickly by the pilots.

So, the problem isn't that hacking is impossible. It's just very, very unlikely. And in this case, hacking had nothing to do with the plane crash.

No, the problem is that news agencies looking to wring every bit of ratings possible from a tragedy are willing to make viewers stupider under the guise of "news." When facts just aren't available, 24-hour news teams lean heavily on whatever theory will provide the most entertainment (for lack of a better word). Former pilot Jay Rollins may have three decades of experience, but his speculation draws on none of it. Instead, it just takes a bit of what's selling right now (anything "cyber") and what has always sold (fear) and leaves the viewers with less information than they would have obtained by skipping the coverage completely. The truth, however, is simultaneously more horrific (in that there's little that can be done to thwart a pilot determined to crash a plane) than the "hacked plane" theory and more mundane -- at least in terms of "exciting" news coverage.

Filed Under: cable news, hackers, jay rollins, msnbc, plane crash, speculation

Keith Alexander: I'm Worth $1 Million Per Month Because I'm Patenting A Way To Stop Hackers (Which I Didn't Tell The NSA)

from the say-what-now? dept

The Keith Alexander story just keeps getting more and more bizarre. Almost immediately after retiring from the top position at the NSA, where he oversaw the total failure of the NSA's supposed "100% auditing" system, allowing Ed Snowden (and who knows how many others) to escape with all sorts of documents, Alexander announced that he had set up a cybersecurity firm -- with the ridiculously Hollywood-ish name of IronNet Cybersecurity. A month ago, it was revealed that he's going around asking banks to pay him $1 million per month for his "expertise." That caused a few to wonder if he's selling classified info, because really, what else could he offer?

Alexander has a new answer: Patents! Yes, Keith Alexander is claiming that he has an amazing new anti-hacker technique that is brilliant and wonderful and deserving of at least nine patents. According to Shane Harris over at Foreign Policy:

Alexander said he'll file at least nine patents, and possibly more, for a system to detect so-called advanced persistent threats, or hackers who clandestinely burrow into a computer network in order to steal secrets or damage the network itself. It was those kinds of hackers who Alexander, when he was running the NSA, said were responsible for "the greatest transfer of wealth in American history" because they were routinely stealing trade secrets and competitive information from U.S. companies and giving it to their competitors, often in China.

Of course, this leads to all sorts of questions. If Alexander had such a brilliant, patentable solution for stopping hackers, why didn't he, you know, use it while he was at the NSA. His response? He and an unnamed "partner" just came up with it in the last couple months after leaving office:

Asked why he didn't share this new approach with the federal government when he was in charge of protecting its most important computer systems, Alexander said the key insight about using behavior models came from one of his business partners, whom he also declined to name, and that it takes an approach that the government hadn't considered. It's these methods that Alexander said he will seek to patent.

The report also notes that Alexander is a named inventor on seven patent applications filed while he was at the NSA (the US government keeps those), but that these new ones are totally separate.

Now, it is entirely possible that Alexander and his partner magically came up with some new way to deal with cybersecurity -- though I'm skeptical. Cybersecurity work involves an awful lot of trial and error in the real world, and Alexander is insisting already that his "fundamentally new approach" will "jump" ahead of existing technology. That's a bold claim for someone who hasn't ever actually done work in the commercial field. One thing that we've pointed out for years, is that people who have no experience in actually building a technology business almost always overvalue the idea, and undervalue the execution. It certainly looks like Alexander is doing exactly that. He thinks that based on the idea alone -- which is totally unproven -- he's worth $1 million per month. He claims three companies have already paid up, though he doesn't say who (or how much they're really paying). It seems likely that any actual payments are more because of Alexander's connections, rather than his brilliant "idea."

Harris spoke to another expert who notes that the approach Alexander is talking about (behavioral modeling) is one that's been talked about and tried for years without success. In other words, it's a perfect example of where ideas sound good, but execution matters. And yet, Alexander insists that his ideas alone -- which haven't been proven yet (and on which he hasn't even filed these supposed patents) -- are so amazing that they will change the nature of cybersecurity?

When Harris asks for more detail about the solution, Alexander wouldn't tell him any more "given the sensitive nature of the work." Except, of course, if he's filing patents on it, the details are supposed to be revealed the public in fairly short order (18 months at most). And, really, if the solution is so great, they should be getting it out there and testing it. Security by obscurity is not the best proving ground. Actually having your solution tested is.

Filed Under: behavior modeling, cybersecurity, hackers, keith alexander, nsa, patents, surveillance
Companies: ironnet cybersecurity

Adding Insult To Injury: Companies DOJ Says That China Hacked Now Facing Probes Over Failure To Disclose

from the really-winning-fans-here dept

Earlier this week, we wrote about the DOJ filing an indictment against some Chinese hackers who are a part of the People's Liberation Army. We found the situation rather ironic, given all that the NSA has been accused of on the cyberespionage front these days. We also found the whole thing to be incredibly counterproductive as it wouldn't do a damn thing to stop Chinese hacking, but would likely lead to other countries filing criminal charges against NSA hackers.

What was particularly crazy was the DOJ's smug announcement about how it finally had "proof" of Chinese hacks, naming some specific companies which had been hacked. In theory, the DOJ thinks it's helping to protect those businesses, but the reality may be the opposite. It appears that the DOJ may have just created a massive headache for those companies, as they may be facing probes and possible shareholder lawsuits about failures to disclose the hacks to investors. It's not entirely clear they needed to do so -- and the companies insist they revealed all material information -- but from the article, it's clear that class action lawyers will eat this one up and file expensive and wasteful lawsuits.

“The question is would an investor have cared if Chinese hackers broke into a company and were messing around the place?” Jacob Olcott, a principal focusing on cybersecurity at Good Harbor Security Risk Management LLC in Washington, said in a phone interview. “As an investor, show me the evidence that you reviewed this thoroughly.”

So, not only did these companies -- Alcoa and Allegheny Technologies Inc. -- get hacked in a way where it's unlikely that any criminal charges will catch the folks who did the hacking, those same companies may face another legal headache over the failure to reveal they got hacked by the Chinese. So exactly whom is the DOJ helping here?

Filed Under: breaches, china, disclosure, doj, hackers, indictment, privacy, sec
Companies: alcoa, allegheny technologies inc.

Blizzard Still Twisting And Distorting Copyright To Go After Cheaters

from the paved-with-good-intentions dept

The road to Hell, as they say, is paved with good intentions. The lesson in that axiom is that one should always be wary of the potentially adverse consequences of actions intended to be good. Blizzard, unfortunately, appears to be something of a performance art piece on this concept. For many years now it has, under the auspices of protecting the larger portion of its customers' gaming experience, gone after hackers and cheaters in its games by twisting copyright law into a tortured pretzel. It began with Starcraft and then transitioned into World of Warcraft, both relying on a morose entwining of copyright law and terms of service. That combination essentially creates a cascade of faulty nonsense, starting with the concept that software is only licensed and not sold to customers, that ToS agreements are so binding that breaking them breaks the license, and finally that breaking the license negates the ability for fleeting copying that the software employs, creating a copyright infringement. If your head is spinning, you aren't alone.

Yet, Blizzard continues on, now going back into the Starcraft realm to sue "hackers" for copyright infringement in the name of protecting the larger audience of the game.

Blizzard filed papers in a California court on May 19th alleging that an unidentified group of programmers infringed on the publisher's StarCraft II copyright with a series of cheats and in-game exploits collectively known as the "ValiantChaos MapHack." Designed to give StarCraft II players any number of competitive advantages when playing the game online, the MapHack was made available online through the ValiantChaos forum—provided that forum members paid $62.50 for access to its VIP section. The complaint Blizzard filed says that the company is taking action against the programmers in order to "protect the sanctity of the StarCraft II experience" against "hacks, mods or any other unauthorized third-party software" that undermines the competition central to the game's online multiplayer.

It would be quite easy for any Starcraft 2 player to cheer Blizzard on at this point. I don't play this particular game, but I've wished all manner of ill in the past on those that were obviously using cheats and hacks in online games in the past. Counter Strike, in particular, did more to teach me how much I hate cheaters than any other single experience in my entire life. That said, we still have the same problems as before.

Blizzard's filing again lays out its view that its software is licensed, rather than sold in the traditional meaning -- and that a violation of its ToS and EULA agreements nullifies that license. In addition, it claims both that the hacks created by the hackers (even if their copies were purchased legitimately) constituted a modified end-product, or illegal derivative work, and that this resulted in both direct and contributory infringement in the instance of every copy of the hack they provided, used or sold. It also, of course, argues that anti-circumvention clauses of the DMCA apply.

The problem with all of this is that it still relies on the twisted assumptions that Blizzard customers don't actually own what they bought and that ToS and EULA agreements are so binding that violation of them negates the license that the company insists was all that was purchased. As I mentioned, this may be done in a valiant effort to keep most of its customers as happy as possible, but that doesn't make it right. The wider implications of these rulings is horrifying. There simply will be unintended consequences in this that will prove to be far more harmful than any annoying game-hackers can create with their irritating products.

This may seem crappy, but the best course for everyone involved would be for Blizzard to simply jump back into the arms race with these cheaters and hackers and try its best to keep them off the company's servers. Going the legal nuclear option and twisting copyright into the mix may only amplify the amount of harm being done all around.

Filed Under: cheaters, copyright, games, hackers, license, sales, software, starcraft
Companies: blizzard

Gov't Contractor Uses Copyright, Fear Of Hackers To Get Restraining Order Against Open Source Developer

from the the-same-goddamn-hammers-used-every-time dept

A recent copyright infringement (+ "threat to national security") lawsuit filed by a government contractor against its former employee highlights two terms the government frequently fears: open source and hacking.

Open source software (especially free open source software) is often portrayed by government officials as inherently unsafe to deploy. If anyone can see the source code then surely anyone can exploit it, they state. This is institutional resistance is aided greatly by companies like Microsoft who would prefer to see lucrative software licensing contracts continue indefinitely. Not that "closed source" software is any more secure, as Microsoft itself (along with Adobe) can certainly attest. But that irrational fear remains, and greatly hinders the adoption of open source software by government agencies.

Hacking is another of the government's favorite boogeymen. The oft-abused CFAA has turned exploration of software and systems into a crime. The government uses the words "hacking" and "hacker" almost exclusively to denote criminal activities and criminals. This continues long after the words have entered the mainstream to reflect positive activities. (See also: the extremely popular Lifehacker website; any number of events with the word "-hack" appended that result in extremely constructive outcomes.)

Andreas Schou brought this restraining order granted by an Idaho judge to many people's attention on Google+. (H/T to unnamed Techdirt reader for the submission.) It's an ultra-rare "no notice" restraining order that resulted from a wholly ex parte process involving only the plaintiff, government contractor Battelle Energy Alliance. The restraining order allowed Battelle to seize its former employee's computer, as well as prevent him from releasing the allegedly copied software as open source.

Schou details how he heard about the case.

Yesterday afternoon, my good friend (and former client) got a panicked call from his wife. Attorneys for the government contractor he formerly worked for had showed up at his door with some sort of order, demanding to be let in to seize his computers. While his wife was held out on the lawn by private attorneys, the contractor's counsel tried to call in the sheriff to -- I guess -- break down his door.

My first thought, obviously, was: this is all some sort of misunderstanding. Because Corey [Thuen] -- who's a professional security researcher -- has worked for the government his entire career, both at the FBI and as a security researcher specializing in SCADA systems, cyberterrorism, and critical infrastructure. He's a straight-laced, church-attending guy with three kids and an admittedly strange job.

And here's what he's been accused of: threatening national security by open-sourcing a network visualization and whitelisting tool.

The arguments made in Battelle's original complaint were bought almost in their entirety by Judge B. Lynn Winmill. Battelle claims copyright infringement, citing Corey Thuen's software, Visdom, resembles its own Sophia software. As evidence of this, it offers the following:

- Thuen worked on Sophia and had access to the code.
- Visdom's name is remarkably similar to Sophia. (The short version: Sophia is the goddess of wisdom. Wisdom/VISDOM.)
- There's no way Thuen could have come up with his own program in such a short period of time without copying substantial amounts of Sophia's code.

Battelle also points out that Thuen's company, Southfork, made a bid to license Sophia but withdrew it a short while later, inferring that Thuen's allegedly infringing copy made licensing software an unneeded expense. (Thuen's response claims that Southfork withdrew its bid when it became apparent Battelle wasn't interested in pursuing an open source option.)

Schou points out that if Battelle had done any due diligence, it would have realized that its infringement claim -- especially the claim that Thuen couldn't have created competing software in that time frame without copying Sophia -- is just plain wrong.

Somehow, despite spending a great deal of money on a BigLaw firm and getting an unprecedented ex parte order for the seizure of critical business infrastructure, they didn't check Github. And if they had, they'd have found out that the open-source project is built in a different language, using open libraries. They'd have been able to check the code commits to look at the period the software was written in.

And they wouldn't have sued to begin with.

Thuen breaks it down even more simply in his response:

Visdom, unlike Sophia, makes heavy use of third party open source libraries to accomplish many of the tasks for which the Sophia development team had to write code ourselves. An example for illustration: as part of my work on Sophia, I created a scrollbar from scratch, which means I had to implement the click and drag behavior (along with buttons) that causes a scrollbar to do what the average user expects a scrollbar to do. Visdom, on the other hand, builds on top of other, third party components that make scrollbars inherent. In other words, on Sophia development I spent significant time creating basic components to a user interface, whereas Visdom did not require such efforts. Visdom's heavy use of open source libraries facilitated its development in a matter of several months.

As Schou states, it's also written in a completely different coding language. Battelle and its representation may think it's just a simple copy-paste job to "port" software from one language to another, but Thuen dismantles this misperception.

Visdom was written in HTML, Javascript, and Go. As previously mentioned, Sophia was written in C. Visdom is not a translation of Sophia from C to the languages in which Visdom is written. We did not have the Sophia code when we created Visdom.

Further, a program written in one programming language cannot be cut-and-pasted into another programming language. Programming languages have different lexicographical grammars. As an example, if I'm writing code in C I have to deal with memory management; I have to keep track of the resources used by my programs. Javascript has no such concept, and any C code that does these functions would be impossible to translate into Javascript. Further, Javascript is an interpreted language and C is a compiled language. In other words, C creates software that runs on hardware, whereas Javascript creates software that runs in programs that run on hardware.

No two programmers who translate from one language to another, or from C to Javascript in particular, would produce the same output for any complex program. Those two languages, and their paradigms, are incompatible. A program written in C will inherently solve the problem to which it is directed in a different way than a program directed at the same problem but written in Javascript.

In developing Visdom, I specifically avoided any code, modules, sequences, routines, structures, screenshots, or any other materials that may have constituted some part of Sophia, based on my knowledge of Sophia as of the end of my access to it on or about August 2, 2012. Visdom is intended to solve the same problems as Sophia, but it is not a copy of Sophia, just as an electric car is not a copy of a gas-powered car simply because both are used for the same purpose.

What the judge determined to be "adequate circumstantial evidence" to justify ordering a no-notice restraining order (which included the seizure of Thuen's computer -- because he's a "hacker" -- more on that in a bit) completely falls apart when confronted with technical knowledge and observable facts.

Thuen's project is still listed at github where anyone can view related information, including development time, commits and, most importantly, the source code itself, where anyone with the technical knowledge would have seen that a) it pulled from other sources to speed production and b) is written in a completely different language.

Unfortunately, Battelle also abused the term "hacking" to justify the seizure of Thuen's computer without notice. Its arguments in the original complaint quotes one of its own employees in support of its "if we notify him, he'll just wipe the hard drive" theory. The court cites this in its justification of the ex parte restraining order

[B]attelle asserts that defendants are likely to wipe the hard drives on Thuen's computer, thus destroying direct evidence of wrongdoing. Battelle suggests that either of these actions would render further prosecution of the lawsuit fruitless...

The Court finds it significant that defendants are self-described hackers, who say, "We like hacking things and we don't want to stop."

A well-known characteristic of hackers is that they cover their tracks… This makes it likely that defendant Thuen will delete material on the hard drive of his computer that could be relevant to this case...

The Court has struggled over the issue of allowing the copying of the hard drive. This is a serious invasion of privacy and is certainly not a standard remedy, as the discussion of the case law above demonstrates. The tipping point for the Court comes from evidence that the defendants - in their own words - are hackers. By labeling themselves this way, they have essentially announced that they have the necessary computer skills and intent to simultaneously release the code publicly and conceal their role in that act. And concealment likely involves the destruction of evidence on the hard drive of Thuen's computer. For these reasons, the Court finds this is one of the very rare cases that justifies seizure and copying of the hard drive.

The supposedly damning declaration by Thuen comes from Southfork's home page.

We're pretty good at hacking things. The idea is:

Identify what you want looked at
We hack it
You fix it

Your customers love you and you gain a little bit more peace of mind. We wouldn't mind bringing your people in to participate and see first-hand how an attacker views your system. We'd love to train ourselves out of a job.

Southfork will test system security when hired by a company specifically for that purpose. Battelle's filing attempts to spin Southfork's technical knowledge into a purely evil thing. According to Battelle, hackers are always adversaries, even when the company's own front page statement proclaims otherwise. Just because the knowledge is there doesn't mean it will only be deployed to cause damage. Thuen's response points out the flaw in this reasoning.

As a cybersecurity professional, I am aware of, and possess ability for, many “hacking” techniques that may be used in illegal ways, but I put them to use improving my customers’ security. In other words, I’m much like a locksmith who possesses the ability to pick a lock and uses his knowledge to help as a contributing member of society… In my career, I have held government clearances with the Federal Bureau of Investigation and the United States Department of Energy, which required me to pass multiple lie detector tests, psychological tests, extensive background checks, and other miscellaneous tests.

Battelle's goes even further than this in its complaint, painting Thuen's hacking ability and his "threat" to take his project open source as a danger to national security.

BEA's copyrighted software is called Sophia and protects the United States' energy infrastructure by alerting utility administrators of potential hackers or other threats to the integrity of the nation's energy grid.

Given the nature of Sophia, Defendants' actions have implications for our national security. Defendants know of these implications but have ignored them.

Fortunately, this stretched argument doesn't weigh in the judge's restraining order, but it's still a part of Battelle's complaint against Thuen. This argument is baseless as well, relying heavily on the allegation that Thuen's code is Battelle's code. Theun points out the flaw in Battelle's portrayal of open source code as inherently dangerous.

I disagree with Battelle that security software like Sophia or Visdom cannot be open source because then hackers would have access to the source code. Security systems are better served by being open source so that complicated things, like cryptographic algorithms and implementations, can be reviewed by independent expert auditors rather than sitting behind smoke screens. The plethora of open source software used in secure systems today completely debunks the notion that you cannot have valuable and secure software that is also open source…

In the statements dealing with irreparable harm, Battelle claims it wouldn't be able to compete with Southfork's Visdom if Thuen chose to give it away (earning money from support packages and custom modules). Clearly, Battelle and its lawyers are unaware that top selling programs like Microsoft Office (LibreOffice) and Photoshop (GIMP) compete with fully-featured (and open source) free programs all the time.

There are many more flawed arguments in Battelle's filing, but it appears that both the plaintiff and the presiding judge had just enough knowledge between them to reach a bad conclusion. Thuen's response tackles every accusation from Battelle's complaint, punching some big holes in its filing. Unfortunately, the court decided to handle this ex parte and is only now aware of the weaknesses of Battelle's allegations.

What this looks like is a government contractor hoping to shut down a competitor by deploying two "chilling" favorites: copyright infringement and "threats to national security." It also hurts itself by falling for government FUD -- "open source is dangerous" and "hackers are bad" -- both of which contributed to the general level of failure contained in its complaint.

Filed Under: copyright, corey thuen, hackers, open source, restraining order, sophia, visdom
Companies: battelle, battelle energy alliance

Angered By The NSA, But Confused By Acronyms, Brazilian Hacker Defaces NASA Websites

from the take-that,-surveillancestronauts! dept

If you're going to go after the world leader in untargeted data collections, you might as well be just as unfocused. After details of the NSA's spying efforts in Brazil drove the president to cancel her trip to the US, some of that anger spilled over to the public. And a certain member of the Brazilian public, one "BMPoc," decided to lash out in the most internet of ways -- by defacing websites linked with the intelligence agency. The only problem was BMPoC was one letter off.

Multiple NASA websites were defaced last week by a Brazilian hacktivist who may have misread the sites' URLs, because he wasn't protesting about the US space agency giving joyrides to inhuman stowaways – he was protesting against NSA spying.

“BMPoC” hit kepler.arc.nasa.gov and 13 other sites with messages protesting against US spying on Brazil, as well as a possible US military intervention in Syria.

Ah, NASA. The non-spy agency whose efforts over the years have resulted in a number of technological advancements we take for granted. NASA is a very, very, VERY outwardly focused agency, which perhaps explains why its internal controls are so lax it's referred to as the "low hanging fruit" of the government website defacement field.

What the hacker lacked in accuracy, he made up for in successful hits and enthusiasm. The following warning graced unsuspecting NASA aficionados for several hours earlier this week.

NASA HACKED! BY #BMPoCWe! Stop spy on us! The Brazilian population do not support your attitude! The Illuminati are now visibly acting!

Obama heartless! Inhumane! you have no family? the point in the entire global population is supporting you. NOBODY! We do not want war, we want peace!!! Do not attack the Syrians.

Coherent, it is not, thanks to the language barrier, a fundamental misunderstanding that all acronyms are not created equal, and the obligatory Illuminati reference. NASA, duly chastened by orders to cease all "spy" and change its unsupported attitude, released the following statement.

"A Brazilian hacker group posted a political message on a number of NASA websites. ... Within hours of the initial posting, information technology staff at the Ames Research Center discovered the message and immediately started an investigation, which is ongoing," he said. "At no point were any of the agency’s primary websites, missions or classified systems compromised."

In other words, the attack was about as harmful as graffiti. Perhaps even safer considering it wasn't scrubbed off the "walls" by a group of low-level criminals putting in community service hours.

Other than the wrong acronym and the Illuminati, BMPoC is absolutely correct. Brazilians do not support the NSA's spying or attitude and most of the world is very definitely not supportive of the US engaging with Syria. (Well, "engaging" by way of bombs, missiles and boots on the ground, anyway.)

If the secret to fighting a successful battle is knowing your enemy, BMPoC is no Sun Tzu (or even Ambrose Burnside, for that matter). On the plus side, website defacing is much more anonymous and less prone to crippling embarrassment than an in-person protest -- especially one that finds the protester a few blocks away from his or her intended target, yelling at equally confused people about actions they never took and things they never said.

Filed Under: brazil, hackers, nasa, nsa, nsa surveillance, protest

US Government War On Hackers Backfires: Now Top Hackers Won't Work With US Government

from the what-did-they-expect? dept

Techdirt has noted the increasing demonization of hackers (not to be confused with crackers that break into systems for criminal purposes), for example by trying to add an extra layer of punishment on other crimes if they were done "on a computer." High-profile victims of this approach include Bradley Manning, Aaron Swartz, Jeremy Hammond, Barrett Brown and of course Edward Snowden.

But as this Reuters story reports, that crass attempt to intimidate an entire community in case anyone there might use computers to embarrass the US government or reveal its wrongdoings is now starting to backfire:

The U.S. government's efforts to recruit talented hackers could suffer from the recent revelations about its vast domestic surveillance programs, as many private researchers express disillusionment with the National Security Agency.

Though hackers tend to be anti-establishment by nature, the NSA and other intelligence agencies had made major inroads in recent years in hiring some of the best and brightest, and paying for information on software flaws that help them gain access to target computers and phones.

Much of that goodwill has been erased after the NSA's classified programs to monitor phone records and Internet activity were exposed by former NSA contractor Edward Snowden, according to prominent hackers and cyber experts.

The article goes on:

Closest to home for many hackers are the government's aggressive prosecutions under the Computer Fraud and Abuse Act, which has been used against Internet activist Aaron Swartz, who committed suicide in January, and U.S. soldier Bradley Manning, who leaked classified files to anti-secrecy website WikiLeaks.

A letter circulating at Def Con and signed by some of the most prominent academics in computer security said the law was chilling research in the public interest by allowing prosecutors and victim companies to argue that violations of electronic "terms of service" constitute unauthorized intrusions.

This latest development also exposes a paradox at the heart of the NSA's spying program. Such total surveillance -- things like GCHQ's "Tempora" that essentially downloads and stores all Internet traffic for a while -- is only possible thanks to advances in digital technology. Much of the most innovative work there is being done by hackers -- it's significant that the NSA's massive XKeyscore program runs on a Linux cluster. But as the NSA is now finding out, those same hackers are increasingly angry with the legal assault on both them and their basic freedoms. That may make it much harder to keep up the pace of technological development within the spying program in the future unless the US government takes steps to address hackers' concerns -- something that seems unlikely.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: employment, hackers, nsa, surveillance

Prenda Lawyer Says Georgia Court Should Ignore Judge Wright's Order Because... Look! Hackers!

from the great-moments-in-lawyering dept

Remember Jacques Nazaire? He's the local counsel for Prenda in a case in Georgia who was trying desperately to get the judge there to ignore Judge Wright's order in California, which lays out how Prenda's lawsuits are highly questionable, and likely against the law. He was so desperate that he said the judge should ignore the ruling in California because California recognizes gay marriage, among other differences, despite that having nothing to do with anything related to the actual case (which covers federal copyright laws, rather than state laws, and which was filed in the case to provide additional background, rather than as any sort of binding ruling).

Well, it appears that Nazaire seems to believe that if he just keeps telling the court crazier and crazier things, perhaps it will ignore Judge Wright's ruling. The latest filing tries, once again, to give the judge in Georgia a reason to ignore Judge Wright's ruling, but again it doesn't make much sense. The filing is rambling and somewhat wacky, seemingly trying to argue that, even though Prenda and AF Holdings are implicated in both cases, they're completely and totally unrelated. He also seems to argue that these filings are just designed to rack up higher billing fees. Note, for example, the slightly paranoid use of capital letters:

That motion was NOT written by the undersigned; nevertheless the defense has filed it in THIS docket apparently for two reasons. 1) to bill for the same and 2) to give THIS Court the impression that either the undersigned or a friend of his drafted and filed the same.

But where it gets really wacky is when Nazaire just starts tossing in totally random claims about hackers:

Why would the defendant in this case file a copy of a motion (ECF No. 31, Defendant’s Exhibit B) from the California case and into THIS docket when that motion has nothing to do with this case?

The undersigned does not know the answer to that question. However, it must be noted that defendants (not the one herein) in these types of cases, typically employ various crafty and intimidating schemes against prosecutors and plaintiff’s attorneys. A newspaper article mentioning other types of intimidation is attached hereto as Plaintiff’s Exhibit A.

What is Exhibit A, you ask? Why it's a random story about hackers claiming to be a part of Anonymous hacking into Paypal. What does that have to do with anything? The answer is nothing.

Here's what I find most incredible about Nazaire's line of reasoning. It is basically "please ignore this other case where the same companies that I'm working for have been called out for fraud on the court, because that's totally unrelated, even though they're the same companies" while at the same time saying "we can't trust anything the defense says because, hackers! And, as proof, here's a random totally unrelated story about hackers."

He goes on to suggest that these hackers are after him, because some moron sent him a stupid email.

Furthermore the undersigned has been personally harassed by these types of defendants (not the defendant in this instant case nor the individuals listed in Exhibit A) because of THIS case alone. (Please see Plaintiff’s Exhibit B attached hereto).

Exhibit B is a silly email from someone using the email address "evilpiratemonkey@gmail.com" saying:

You are about it get justifiably screwed by the justice system.

It's nice to see.

You aren't very smart, are you?

Of course, this is a stupid email by whoever sent it, but it's hard to see how that's necessarily "harassment," nor does it show that the person who sent that email is one of "these types of defendants." It's just a stupid email from someone mocking Nazaire (the email address should have been a giveaway on that front).

Either way, if I'm the judge in this case, each of these filings only makes me more interested in whatever must be in Judge Wright's order...

Filed Under: georgia, hackers, jacques nazaire, otis wright, rajesh patel
Companies: prenda, prenda law

Rep. Gohmert Wants A Law That Allows Victims To Destroy The Computers Of People Who Hacked Them

from the do-these-people-even-listen-to-themselves? dept

Last week, we had talked about some concerns about how various cybersecurity provisions would allow those hit by malicious hackers to "hack back" or, as some call it, engage in an "active defense." There were significant concerns about this, but as Marvin Ammori briefly mentioned in last week's favorites post, Rep. Louis Gohmert seems to not only think hacking back is a good idea, but that it should be explicitly allowed under the CFAA (Computer Fraud and Abuse Act). You can see his explicit statements to this effect below during last week's House Judiciary Committee hearing on the CFAA. It appears he heard a story about someone installing some malware on a hacker's computer to get a photograph of them, and has decided "that's a good thing, that helps you get at the bad guys," without ever thinking of the very, very long list of dangerous consequences of allowing such things: In case the video embed is not working above, I created a short highlight that just covers the ~5 minute exchange involving Gohmert.

Here's the basic transcript. The really crazy part is where Gohmert says he doesn't care as long as the hack back is "destroying that hacker's computer."

Rep. Gohmert: It's my understanding that under 18 USC 1030 that it is a criminal violation of law to do anything that helps take control of another computer, even for a moment. Is that your understanding?

Orin Kerr: It depends exactly what you mean by "taking control." If "taking control" includes gaining access to the computer, assuming a network your not supposed to take control of, then yes, that would clearly be prohibited by the statute.

Rep. Gohmert: For example, my understanding is that there was a recent example where someone had inserted malware on their own computer, such that when their computer was hacked and the data downloaded, it took the malware into the hacker's computer, such that when it was activated, it allowed the person whose computer was hacked to get a picture of the person looking at the screen. So they had the person who did the hacking, and actually did damage to all the data in the computer. Now, some of us would think 'that's terrific, that helps you get at the bad guys.' But my understanding is that since that allowed the hackee to momentarily take over the computer and destroy information in that computer and to see who was using that computer, then actually that person would have been in violation of 18 USC 1030. So I'm wondering if one of the potential helps or solutions for us would be to amend 18 USC 1030 to make an exception such that if the malware or software that allows someone to take over a computer is taking over a hacker's computer, that it's not a violation. Perhaps it would be like for what we do for assaultive offenses, you have a self-defense. If this is a part of a self-defense protection system, then it would be a defense that you violated 1030. Anybody see any problems with helping people by amending our criminal code to allow such exceptions or have any suggestions along these lines?

Orin Kerr: Mr. Gohmert, that's a great question that is very much debated in computer security circles. Because, from what I hear there is a lot of this "hacking back" as they refer to it. But at least under current law, it is mostly illegal to do that.... The real difficulty is in the details. In what circumstances do you allow someone to counterhack, how broadly are they allowed to counterhack, how far can they go? The difficulty, I think, is that once you open that door as a matter of law, it's something that can be difficult to cabin. So I think if there is such an exception, it should be quite a narrow one to avoid it from becoming the sort of exception that swallows the rule.

Rep. Gohmert: Well, I'm not sure that I would care if it destroyed a hacker's computer completely. As long as it was confined to that hacker. Are you saying we need to afford the hacker protection so we don't hurt him too bad?

Orin Kerr: (brief confounded look on his face) Uh... no. The difficulty is that you don't know who the hacker is. So it might be that you think the hacker is one person, but their routing communications... Let's say, you think you're being hacked by a French company, or even a company in the United States...

Rep. Gohmert: Oh and it might be the United States Government! And we don't want to hurt them if they're snooping on our people. Is that...?

Orin Kerr: No.

Rep. Gohmert: I don't understand why you're wanting to be protective of the hacker.

Orin Kerr: The difficulty is first, identifying who is the hacker. You don't know when someone's intruding into your network who's behind it. So all you'll know is that there's an IP address that seems to go back to a specific computer. But you won't know who it is who's behind the attack. That's the difficulty.

First off, kudos to Orin Kerr for keeping a (mostly) straight face through that exchange. There are many amazing things about this particular exchange, but the fact that Rep. Gohmert is one of the people in charge of how the CFAA gets reformed, and doesn't understand these very basic concepts, is immensely troubling. Among the headsmackers in that exchange: the idea that hackers are bad -- and not just partially bad, but apparently obviously and totally bad, like out of a movie. Also: that they're somehow easy to identify and that a freebie on hackbacks wouldn't be abused in amazing ways. Further, as Kerr pretty clearly points out that you can't automatically track back and (without saying so directly, but clearly implying) that hackers likely would shield their identity or fake someone else's identity, Gohmert still doesn't get it and somehow thinks that Kerr is saying we don't want to allow hackbacks on US government snooping (which, again, Gohmert seems to have no problem with). Yikes. Please do not let people like this near laws that have anything to do with computers. To me, this level of misunderstanding is worse than the whole "series of tubes" garbage from a few years back by Senator Stevens.

I'm sorry, but it seems that if you can't understand that there isn't some magic list that says "these hackers are bad, and therefore we should destroy their computers," I don't think you should have any role in making laws around this topic.

Filed Under: cfaa, destroying computers, hackers, hacking, louis gohmert, orin kerr

Newspaper Editorial Insists Hackers Must Be Punished, While Misunderstanding Nearly Every Detail

from the apparently-never dept

We just recently wrote about a trio of recent situations -- all involving young hackers probing for information, leading to either criminal charges or threats of criminal charges against them -- that show what happens when people in power don't understand how technology works. They were all cases where the individuals involved may have done things that some would think inconsiderate, but that hardly should rise to the level of "criminal" behavior -- especially with threats of many years in jail. Presenting the flipside to that argument: the editorialists at the Toronto Globe and Mail, who show why those who don't understand technology have no business writing about it. The editorial is headlined When did it become wrong to punish hackers?, which already suggests problem number one. Hacker is a generic term that does not automatically imply malicious attacks, yet the Globe and Mail immediately seems to assume otherwise. That might be news to the US government, which just announced its own National Day for Civic Hacking (despite filing charges against such civic hackers...).

A Montreal school is being widely criticized for expelling a student who hacked into its computer system and helped expose flaws in the system’s security. The student now has been offered jobs by computer security companies, including the one that ran the system he hacked into. In the Internet age, the hacker is celebrated as a hero and the school is pilloried for being an overbearing, defensive holdover from a bygone age. It’s an unfair presumption that needs to be corrected.

That's one version of the story. The hacker is celebrated as a hero because he did something useful: exposed a security flaw that could have been used by someone malicious for nefarious purposes. We generally want to celebrate those who spot danger and warn people away from it. And the school is being pilloried because it expelled this person. Without Ahmed Al-Khabaz's help, the data of students would be at risk. Doesn't it seem somewhat overbearing to blame the messenger? What exactly is "unfair" about the presumption? After pointing out that Al-Khabaz "discovered a serious flaw" the editorial still supports his expulsion, apparently entirely based on the fact that the company, Skytech, felt his probing was an attack:

... Mr. Al-Khabaz then went on and carried out what the company considered to be a “cyber-attack” on the school’s production servers. The company notified the school, and Mr. Al-Khabaz was hauled on the carpet. The company accepted the student’s explanation and noted that he “demonstrated great talent in computer science.” They dropped the matter and offered Mr. Al-Khabaz a job, but Dawson’s administrators felt the student had gone too far and expelled him on the grounds he had violated the college’s code of conduct.

What the company considered a "cyber-attack" could also be described as "checking to see if the flaw was fixed." And, clearly, they didn't think it was a huge problem if they offered him a job, and noted his "great talent." So why does the school still think he went too far?

Dawson’s officials are right: Rules exist for a reason, and students cannot expect to break them without consequence. Why have them, otherwise?

Ahhhhhh. Rules are rules. Rules exist for reasons, but sometimes those reasons are bad. And punishing people for breaking rules in ways that help people seems like sending the exact wrong message. Sometimes rules should be broken, because the rules are wrong.

The editorial then moves on to Aaron Swartz:

Swartz, who had a history of depression, was facing a slew of charges for allegedly downloading publicly funded academic journals from a large database that charged a fee for access. His family and supporters blame overzealous prosecutors for his death; the prosecutors insist – again, quite rightly – that “stealing is stealing.”

Uh, "stealing is stealing" is a tautology, so of course it's right. But what's "wrong" is arguing that what Swartz did was "stealing." He stole nothing. He downloaded papers from MIT's open network, which was set up with a site license from JSTOR allowing open downloading of those journal articles, all of which remained on the site for anyone else to download.

Go ahead, explain what was "stolen"?

In the age of the Internet, the massive downloading for free of music and movies and other copyrighted material has muddied the waters for many people.

It seems to have "muddied the waters" for the editorial writers of the Toronto Globe and Mail who don't seem to realize that neither case had anything to do with the "massive downloading for free of music and movies."

They seem to have forgotten that privacy rights and copyright laws are among the foundations of our economy. These are things that are not to be shoved aside by the absolutism of Internet activism.

Oh really? If privacy rights are the foundation of the economy, then, er, isn't it a good thing that Al-Khabaz alerted officials to a hole that exposed the private info of students. He did nothing to compromise anyone's privacy rights at all. Similarly, Aaron Swartz did not violate any copyright law, and he was not charged with copyright law violations.

So, seriously, how does a huge mainstream publication like the Globe and Mail get away with writing a piece of garbage this ridiculous? It claims things that simply aren't true, completely flips around reality, and then seems to wrap it up in some bizarre "rules are rules" argument, that makes no sense since the rules it says people violated... weren't even violated.

And the Globe and Mail thinks people should pay its meter to access this kind of crap?

Filed Under: aaron swartz, ahmed al-khabaz, globe and mail, hackers, punishment, rules