FreeRepublic , LLC
PO BOX 9771
FRESNO, CA 93794
STOP BY AND BUMP THE FUNDRAISER THREAD
Posted on 01/17/2003 10:15:03 AM PST by AdA$tra
Opinion A lot has happened since my Right to Defend column in SecurityFocus Onlinr last July, and the subsequent presentation I made at the Blackhat Security Briefings in Las Vegas. The idea has withstood a lot of criticism.
To refresh, I believe you should have the right to neutralize a worm process running on someone else's infected system, if it's relentlessly attacking your network. I've even written code to demonstrate the process. Though the initial news coverage of the concept was grossly inaccurate in conveying my ideas, it has stirred up a constructive dialog.
I knew my idea was controversial, but I was wrong about something-- I figured everyone in the security biz would "get it" and that the hard part would be convincing everyone else that if they can't or won't secure their machines, we as the defenders would have the right to terminate the process attacking us.
It has turned out to be the opposite.
TechTV's Cybercrime news magazine show did a segment about strikeback, where I talked about my goals and demo'd a couple of my neutralizing agents. Though the audience of Cybercrime is a much more generalized group of computer users and enthusiasts, the very people I thought would cry foul the loudest, I did not receive a single negative e-mail in response. Every last message was wonderfully supportive, and most of them eagerly offered assistance and asked how they could participate.
It has been the "security experts" who have grouped as the opposition, some even with a level of condescension. For instance, Eugene Schultz of U.C. Berkeley's Lawrence Berkeley National Laboratory wrote in an issue of SANS Newsbites that he "hoped no one would take Mr. Mullen seriously" about this technology, as if it were some joke I was playing on the community.
To the contrary, I am dead serious -- because we need strikeback. In fact, had the technology been in place when Nimda first appeared, institutions like the University of California at Berkeley, for example, could have been spared the embarrassment of having Nimda rip through their infrastructure, infecting untold numbers of innocent external machines just because their IT staff couldn't secure IIS.
I think the main reason for the knee-jerk criticism from the likes of Schultz is that they work largely in a theoretical rose-colored world of security, where all problems are solved after a cup of coffee and a bit of pontification. Those who actually work in the operational end of network and system security see things as they really are. The men and women who work the trenches of system administration know that fast spreading worms like Nimda are a real problem that must be addressed, and are willing to work for a solution.
No Accountability, No Rights
I was surprised to see Bruce Schneier try to draw a bit of the red, red krovvy by lumping strikeback with legislation that the RIAA is pushing -- and U.S. Representative Howard Berman is sponsoring -- that would permit record companies to legally hack file sharing networks. He even includes a quote from the "Declaration of the Rights of Man and of the Citizen" in order to illustrate how such technology goes against the rights of the people.
I'm not sure of the relevancy of a document the French National Assembly drafted 200 years ago, but let's ignore that for now. If anyone's rights are at issue here, it's yours and mine -- the people whose systems are being attacked by worms and viruses running rampant on negligently unprotected machines.
Schneier's reasoning ignores fundamental differences -- opposites, really -- between the RIAA proposal and what my strikeback technology does. Under the Berman bill, the RIAA could legally hack only people infringing their copyrights -- people the RIAA already have ample legal remedies against.
In contrast, my strikeback technique is aimed at an attacking worm-infected box whose owners have no legal responsibility, and to whom justice turns two blind eyes. We have no legal recourse against these people. Maybe in the distant future we can prove that every owner of a system connected to the Internet has a duty to perform due diligence in securing their assets, but today proving such a duty would be quite difficult, even in instances of the most grievous neglect.
Logic dictates that anyone who opposes a bill allowing corporate entities to attack our systems should support a technique to stop worm-ridden systems from doing the same.
As the debate continues, I'd like to suggest a new way of thinking about the parties involved in a strikeback scenario.
Since the owner of a system has no responsibility for the actions of a worm, or any malicious process, that runs without their knowledge, I submit that they also have no rights to the process. No responsibility means no rights.
So, if they have no rights to the process, there is no infringement against them when we neutralize it. If someone wants to claim that their rights were violated by our taking out the attacking process, then they should be held accountable for the actions of the process from its inception. They can't have it both ways.
If parents don't vaccinate their children, the state takes them out of school. If a dog consistently attacks people, the authorities put it down. If someone commits three felonies, they are put away for life. This is because the rights of the many outweigh the rights of the one.
And that is the way it should be.
© SecurityFocus Online
Timothy M. Mullen is CIO and Chief Software Architect for AnchorIS.Com, a developer of secure, enterprise-based accounting software.
This is very surprising to me. I think what this gentleman is proposing is that (under circumstances defined by him) he should be allowed to get access to other people's computers and make changes of one sort or another. Killing one or two processes that he doesn't like. His judgement is good. He's trustworthy. He'll do the right thing.
And the security people oppose this? Unbelievable! (/sarcasm)
This is a specious argument. There are less invasive ways for the author to block a malicious process from entering his system.
Who says that it is legal or illegal?
Machines themselves have no rights. IF the owner of the machine claims a malicious process, then that owner would have the right for her machine to not be trespassed (and also would be a likely target for jail), but if the owner of the machine makes no such claim (the odds on favorite since making such a claim would send you to jail), then the rogue process in question has no legal owner.
Without a legal owner, and since machines themselves have no legal rights, who is to say whether or not someone being attacked by that rogue process can shut it down or not?
Your reply is proof that you can read just about anything into anything, if you try hard enough.
I'm not so sure about this -- and I've been there! Years ago, back in the days of Usenet and slow modems (and almost the entire network exchanged e-mail and postings via periodic dial-up connections). Somebody had requested a file, which I sent him (uuencoded -- sort of an attachment). The message was quite large. Something went awry with his university's machine and every 20 minutes a copy of this thing was flung back at me, eating up modem time and my employer's connection to the world.
This went on for days while I sent e-mails to the recipient, the machine's super-user, called various people at the college... Could I have killed that process remotely I would have.
But I'm still not convinced this is a good idea...
No, author, it's because the rights of a one are being violated in the two cases other than the goobermint school example. The collective has no more rights than an individual.
Someone owns that box. Someone paid for it to be hooked to the net and someone is paying for the bandwidth. There are ways to get these folks' attention; if a process on the box is messing with other boxes, that alone violates the TOS of just about every ISP or colo that I know of... the box can be disconnected and remain so until it gets cleaned up.
OTOH, if you prefer to take the bull by the horns and invade another box and kill some processes, that action just puts you in legal hot water.
Fence it off and complain to the hostmaster and the ISP.
By analogy - a rogue process (eg a worm) that has infested your machine and is irritating other machine owners is like a stray dog that gets into your yard and barks all night, keeping the neighbors awake.
(1) Its not your dog. (Its not your worm/process.)
(2) Its on your property. (It got into your machine.)
(3) You may choose to ignore the problem - its not your dog, after all. (Its not your worm!)
(4) But then the neighbors have the right to shut the dog up by calling animal control. (Hmmm...this implies there should be some form of, not "net police", but "net sanitation engineers" or "net pest control" that then should have the legal right to enter your machine and shut down the worm.)
Fact is, even if you have a tight firewall, the Nimda virus that has infested someone elses machine still causes your web server to write log messages even if you are not running a Microsoft web server. Thus it is consuming your bandwidth, and your disk space by flogging your webserver. Thus, like the neighbors irritated by a barking dog at night, you should have some recourse.
Perhaps that recourse is not to go bust into someone elses machine and kill the worm yourselft (climb over your neighbors backyard fence and shotgun the damn barking dog.) But it does look like we could use some kind of pest control organization that could contract with ISP's, whereby if you get net access from that ISP you agree to let the pest control onto your property (into your machine) to kill pests. And if you don't like that, then find some other ISP that provides net access (e.g. Ann Rand Web Access, Inc.) that has no such contract with a pest control company. Of course, I can see how in the future 5 or 10 years, ISP's that don't do active pest controlling will find their IP addresses blocked off from the web (can't send or receive email from there, pointless to host a website from there.)
Not saying I think this is the solution, or should be the solution, but it would work (while introducing problems like noncompliant ISP IP address ranges getting banned from general net access.)
Comments?
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.