Personal Data Protection and Breach Accountability Act of 2014 would enact criminal penalties for "intentionally or willfully" concealing a security breach

Thanks in part to the recent security breaches at Target and Neiman Marcus, pressure for a federal response to data security has become increasingly popular. Numerous bills have been introduced in the House and the Senate that call for new legislative enactments to answer the data security problem.

A somewhat popular proposal for many of these bills is a new criminal statute for individuals who knowingly and willingly fail to report a known security breach. I recently introduced readers to Senator Patrick Leahy’s Personal Data Privacy and Security Act of 2014, and detailed some of the bill's criminal proposals, including numerous amendments to the Computer Fraud and Abuse Act. The bill also included a proposed criminal statute that would read,

Whoever, having knowledge of a security breach and of the fact that notice of such security breach is required under title II of the Personal Data Privacy and Security Act of 2014, intentionally and willfully conceals the fact of such security breach, shall, in the event that such security breach results in economic harm to any individual in the amount of $1,000 or more, be fined under this tile [sic] or imprisoned for not more than 5 years, or both. 

Last Tuesday, ahead of a Senate Judiciary Committee hearing addressing the Target and Neiman Marcus data breaches, Senator Richard Blumenthal and Senator Ed Markey introduced the Personal Data Protection and Breach Accountability Act of 2014. According to a recent press release, Senator Blumenthal stated that the bill “will give consumers much stronger, industry-wide protections against massive thefts of private financial information” and that “[s]tiffer enforcement with stringent penalties are vital to assure that retailers use state of the art safeguards.” Similar to Senator Leahy’s bill, the Personal Data Protection and Breach Accountability Act of 2014 would include a new criminal statute that would read, 

Whoever, having knowledge of a security breach and of the fact that notice of such security breach is required under title II of the Personal Data Protection and Breach Accountability Act of 2014, intentionally or willfully conceals the fact of such security breach and which breach, shall, in the event that such security breach results in economic harm or substantial emotional distress to 1 or more persons, shall be fined under this title or imprisoned not more than 5 years, or both.

A notable difference between these two proposals is the Personal Data Protection and Breach Accountability Act’s requirement that the breach “results in economic harm or substantial emotional distress to 1 or more persons.” In my eyes, this would encompass significantly more security breaches than in Senator Leahy's already broad proposal.

In a recent op-ed for the International Association of Privacy Professional’s online publication, Privacy Perspectives, I question whether criminal liability for failing to disclose a data security breach would be a prudent move, focusing specifically on Senator Leahy’s bill. My concerns would extend to this new proposal as well.

It will be interesting to see, with such an outcry for a federal response, what (if anything) will be adopted, and whether some variation of these "criminal concealment of a known security breach" proposals will be included.

Read More

CFAA amendments, new criminal statute proposed in Senator Leahy’s bill

On Wednesday, Senator Patrick Leahy (D-Vt.) introduced the Personal Data Privacy and Security Act of 2014. Senator Leahy’s bill, first introduced back in 2005, intends to "better protect[] Americans from the growing threats of data breaches and identity theft,” according to a press release issued by the Senator.

Included within the bill are amendments to the Computer Fraud and Abuse Act (18 U.S.C. § 1030). Senator Leahy stated that the bill “includes the Obama administration’s proposal [full text] to update the Computer Fraud and Abuse Act, so that attempted computer hacking and conspiracy to commit computer hacking offenses are subject to the same criminal penalties, as the underlying offenses.” The bulk of Senator Leahy’s amendments to the CFAA occur in Title I: Enhancing Punishment for Identity Theft and Other Violations of Data Privacy and Security (Sections 101 through 110). These changes would include adding the CFAA under the Racketeer Influenced and Corrupt Organizations (RICO) Act (Section 101),  maximizing penalties under the CFAA (Section 103), and clarifying that both "conspiracy" and "attempt" to commit a computer hacking offense are subject to the same penalties as completed, substantive offenses (Section 105), just to name a few.

Also added within the bill would be a new criminal statute: 18 U.S.C. § 1041 Concealment of security breaches involving sensitive personally identifiable information. According to Senator Leahy, the new statute would provide "tough criminal penalties for anyone who would intentionally and willfully conceal the fact that a data breach has occurred when the breach causes economic damage to consumers.” According to the section-by-section summary, the new statute would

makes it a crime for a person who knows of a security breach which requires notice to individuals under Title II of this Act, and who is under obligation to provide such notice, to intentionally and willfully conceal the fact of, or information related to, that security breach.

So in addition to adding a strict security breach notification law (Section 211 - 221), Senator Leahy's bill would create criminal penalties for intentionally and willfully concealing the security breach or "information realted to" that breach.

Overall, the bill contains a number of amendments that would be of interest to anyone in the information privacy or security field. Senator Leahy has made a section-by-section outline of the bill available, as well as the bill's full text.

Read More

The End of DarkComet RAT - Part 3: Could the creators of RATs (or similar software analogues) be prosecuted (law)

And now, on to the finale - could DarkCoderSc be prosecuted for creating, supporting, and distributing the DarkComet RAT.

NO (in the United States)

First, DarkComet RAT can be easily distinguished from Mariposa and Blackshades, on the following grounds:

1. DarkCoderSc never sold what he made - there was no profit motive, and thus one could argue, no intent to defraud.

2. As far as I know, DarkCoderSc was never affiliated with any illicit group as the Blackshades RAT creator was - which would make that person liable for numerous charges, not the least of which would be conspiracy under the CFAA.

3. At least with respect to Mariposa, DarkComet RAT had legitimate uses. You could use it for remote administration, to monitor your kids, and for legitimate purposes not otherwise specified. On the other hand, it is hard to argue legitimate uses for a botnet such as Mariposa.

Second, as many readers have pointed out, there is the "what about Metasploit and Backtrack argument." Namely, those two tools, combined, have probably pwned more computers than DarkComet RAT, yet the creators of those tools (who do have a profit motive) are not prosecuted for such activity. Circumventing these types of arguments would be a prosecutor's nightmare; I would love anyone's possible argument around those, or a different way to distinguish DarkComet/DarkCoderSc.

As I mentioned in the previous post, an interesting argument could be made along the lines of MGM Studios, Inc. v. Grokster, Ltd., 545 U.S. 913 (2005) - specifically, that a tool that had no legitimate legal uses could be a violation of XXX law. I say XXX law, because the Grokster case was based on the Lanham Act (and a judicially created standard of contributory infringement). However, as stated above, this sort of law might be used to prosecute other software creators - but because DarkComet has legitimate uses (see above), even this law would be ineffective. But, is law XXX, making it illegal to create illicit hacking tools off the table? I don't think it should be. 

In fact, it is the law in other countries - Germany's "Anti-Hacking Law" Section 202c of the StGB states "[w]hosoever prepares the commission of an offence under section 202a or section 202b by producing, acquiring for himself or another, selling, supplying to another, disseminating or making otherwise accessible… (2) software for the purpose of the commission of such an offence" is subject to prison time up to a year.  See this document describing the law a little further with recommendations for security professionals. As the article states, the regular use of penetration testing tools does not fall within the ambit of the law, as long as the purpose is legal, and everything is above board. The law is aimed at those tools that are developed or aimed at perpetrating cybercrime.

Such a law for the United States, to return to a normative argument for a second, should be considered. It would immunize Metasploit, Backtrack, etc., but go after those who create the software solely for criminal intentions.

To see the earlier parts of this series follow the links below:

The End of DarkComet RAT - Part 1: The Introduction
The End of DarkComet RAT - Part 1: The Introduction - Update
The End of DarkComet RAT - Part 2: Should the creators of RATs (or similar software analogues) be prosecuted (ethics)
The End of DarkComet RAT - More Technical Details

Read More

The End of DarkComet RAT - Part 2: Should the creators of RATs (or similar software analogues) be prosecuted (ethics)

I pose the question above at a high level of generality to include in this discussion not just the writer of DarkComet RAT, but writers of other RATs, and more importantly, writers of similar software, for-profit or otherwise. Because I do believe there is one line to be drawn when the person who created the software intended to, or does profit from it. It is clear from my previous post that law enforcement surely does believe that writing software for these motives may be criminal - the Mariposa botnet creator and the Blackshades RAT creator were both taken into custody - however, I would argue that those situations are distinguishable.

But what should the collective "we" think about DarkComet and its creator? And more importantly, how does an enforcement scheme fit within the framework of existing "hacker" software, such as Metasploit (for profit), Backtrack (totally free - but... paid training - Offensive Security) , Samurai WTF (free), Katana (free, and even more underground) -- yes, I could go on. And, is there a "paid-for" vs. "free" dichotomy?

I want to approach this question normatively, first, because I believe this to be somewhat of a novel issue, wrapped inside an already contemplated dilemma; however I am (secretly, but not so much anymore) really hoping to hear at least one person propose an outcome similar to MGM Studios, Inc. v. Grokster, Ltd., 545 U.S. 913 (2005), based not necessarily on statutory law (contributory infringement is not in the Lanham Act), but through judicial interpretation. Remember, forget the law - we're proposing what the law should be, here.

I would like to reiterate that the purpose of this series is to strike a lively debate. First, the easiest analogue to this debate is the "guns kill people" argument. Namely, we don't outlaw guns, even though we know they can kill people but are also used lawfully (the majority of the time); therefore, the argument goes, we can't punish makers of guns because of the potential harm they may cause - we leave the criminal consequences at the doorstep of the individual, instead - they are boxed in by the confines of the law as their state has legislated (most often) and absent just cause (e.g., the Castle Doctrine), murder is murder. But can we dispose of this argument that simply? I (personally) don't think so.

You can't just say DarkCoderSc made a program that is used nefariously and should have known that it would be used in unethical, criminal, and fundamentally immoral ways - and thus he should be punished. Because can't the same argument be used for makers of guns (as the simplified argument above asserts), or maybe the makers of Metasploit (HD Moore), Backtrack, the list goes on.  And, you can't walk away arguing the converse; see below. At the center of the issue is the question - who is more culpable - the tool creators, or the tool users? Or, to put it a couple of other ways - who is more responsible - (a) the gun maker or the shooter; or (b) the scientist who described the process to enrich uranium or the nation-state who launched the nuclear bomb.

So, let's dig in to the heart of the issue. Not surprisingly, it reverberates on a variety of fronts - ethical, legal, and even moral. To name a few: personal responsibility v. governmental intervention; notions of negligence, duty of care, and the reasonable person; foreseeability; national security (the budding argument); material or conspiratorial assistance; and if you want to delve into morality, the argument against such assistance based on natural law (a la righteousness) -- (for example, see Romans 1:18-32). 


I do not propose to have the right answer to this question (in all honesty I am troubled by it), but - I also do not agree with the blanket assertion that because we have already implicitly condoned tools such as Metasploit and Backtrack, that we cannot walk that back. Conversely, I think that would be an inspiring debate. And remember the parallel (yet disparate) personal responsibility argument that turns this issue on its head - it goes like this: we cannot control the end result of every societal interaction, but, we can control the predicate for those interactions. For the lawyers out there, I analogize this (maybe in an over-simplistic way), to the stream of commerce argument. Do you provide a framework to punish the original maker of the faulty product (see Asahi) or do you rein that in and inject (not my words) "objective rationality" (see Dunlop) to shield makers from unintended and unforeseeable outcomes?

Back to the monetary debate - because I like the theme of this argument - that the Blackshades RAT creator and the Mariposa botnet creator went down because they were a part of the criminal enterprise that was taken down. And furthermore, that we look down on individuals who attempt to profit from the (insert belief word here (moral, ethical, religious)) wrong that they have caused. Clear example - we do not allow murders to profit from the story of their offense. Is that analogous to the DarkComet RAT? Should a profit motive be involved?

In the last (third) part of this series, I will discuss whether or not DarkCoderSc (or other RAT creators) could be prosecuted or held legally liable for his RAT.

Just as a little poke - my first post should make it clear that use of DarkComet RAT as a hacking tool is transcendently clear. If you attempt to use lack of foreseeability as the basis of your argument, you automatically lose. Let the debate begin.

Read More

The End of DarkComet RAT - Part 1: The Introduction - Update

I forgot to mention the story from last year about how DarkComet was ported to Mac computers - facts are important -  if for no other reason than to bolster the argument that DarkComet's uses are likely more malicious than condoned.

Before you rail against me - let me note as an aside that I recognize the Metasploit, Backtrack, Core Impact, etc, etc, etc. argument against criminal enforcement. They are legal tools that do the same, and they generate more money (exponentially) than DarkCoderSc could have ever made with DarkComet. That's the beauty of a three-part series. At the end, rail away. Comments are not only allowed, but encouraged throughout the process. But please, vindicate or vilify me when appropriate.

~J

Read More

The End of DarkComet RAT - Part 1: The Introduction

If you are not aware, the author of the DarkComet RAT (Remote Administration Tool) has stopped offering the software, and stopped updating it - a move that has somehow been argued to be a victory for law enforcement, although they didn't actually do anything.  Yes, I have heard of deterrence. However, I will leave for another day whether or not the creator of this software should or could actually be liable for the damage it has caused. Thus, in this three part series, I will: (1) introduce the tool, (2) discuss whether there should be legal implications for creators of such tools, and (3) discuss whether there could be legal implications.

THE INTRODUCTION
From the beginning - a RAT is a Remote Administration Tool. Essentially, this type of tool allows a remote user to exercise control over your machine - it take pictures of the user of the computer, make changes to the computer's configuration, read/write documents, and pretty much anything else you can think of - in hacker terms, you have been "pwned." It is a complete invasion of privacy for the individual, and a complete breach for a corporation. Hackers prepare to take advantage of a RAT by "packing" it - which means the guts of the program are rearranged (code-wise), or the tool is compressed using a novel method. A good packer will allow this program to scoot by an average (or high-security) user's anti-virus, and coupled with an exploit, allow the hacker to take full control as described above. There are a plethora of "packers" and new ones everyday - so anti-virus companies (whose methods are typically signature based) cannot keep up with the evolution of newly packed malware that, in the end, is the same malicious piece of software. Hackers will often test their newly packed versions against VirusTotal - a site which runs a binary through a multitude of anti-virus products, and reports whether or not it is picked up. The holy grail is 0/40, aka undetectable - and this is even taking account of the heuristics and "learning" that AV vendors claim to have injected into their detection engines.  Individuals might also use "crypters," which encrypt the code in various ways to defeat antivirus detection - see below.

What is novel about the DarkComet RAT is that it has always been free to whomever wanted to use it, for whatever purpose. Now, instead of being able to download it, users are greeted with a message from the creator, DarkCoderSc, noting his decision to stop allowing it to be downloaded and further updated. There has been speculation that this decision was tied to the discovery of Syria using this tool to spy on dissidents as well as the software writer's fear that he could be prosecuted for the criminal acts of others - from his statement: "Like it was said above because of the missuse [sic] of the tool, and unlike so many of you seem to believe i can be held responsible of your actions [sic], and if there is something i will not tolerate is to have to pay the consequences for your mistakes and i will not cover for you."

If you doubt the prevalence or wide-spread use of this tool - allow me to demonstrate. The images below are from hacker forums (one underground, one a russian clearnet site):

Click image to enlarge

The first image is from an underground hack bulletin board, asking for information about how to use tor and DarkComet. The second post is a person advertising a "crypter" - which is like a "packer" but as the name states, it encrypts instead of packing. As I described above, using crypters or packers makes anti-virus unlikely to detect the trojan. The service this person is offering is to make it "100% FUD" which is hacker jargon for "(F)ully (U)n(D)etectable," updated every 24 hours to continue to evade antivirus.

There is no doubt that DarkComet is all over the place, and even as he has withdrawn it from the market by not allowing anyone to download it from his site anymore, there are plenty of versions floating around the interwebs - so it is not going away soon.  As others have reported, the author's change of heart likely arises from the arrests of the Mariposa botnet creator and also, more recently, the arrest of the Blackshades RAT creator as part of the Carder Profit bust.

I think the creator of DarkComet can be separated from the cases above, though, because he has always offered his software for free, and thus does not make a profit on illicit use of it. A small distinction, but a legally significant one.


In the next part I will discuss whether or not DarkCoderSc (or other RAT creators) should be prosecuted or held legally liable for his RAT.

Read More

LinkedIn's negligence in failing to adequately secure user passwords

As most of you are aware, LinkedIn's site has apparently been hacked, and 6.5 million passwords of users were exposed (if you weren't aware, change your password); the likely attacker operated out of Russia. Take all I say with a grain of salt, as LinkedIn has recently tweeted "[o]ur team continues to investigate, but at this time, we're still unable to confirm that any security breach has occurred. Stay tuned here." But, I doubt that this is a false alarm, and for the uninitiated, let me translate that tweet in honest technology speak - "We've realized a breach occurred, we are panicking in a board room and attempting to spin this in the least damaging light possible."

In this day and age it is unsurprising that a large site has been owned by hackers; I think most would agree that this has become commonplace. But, it appears that corporations are failing to evolve based on the failures of their compromised brethren. While LinkedIn should be applauded (quietly) for their use of SHA-1 hashes to store passwords, they should then immediately be criticized for failing to also salt the passwords, or use a more cryptographically strong algorithm such as SHA-256, or SHA-512.

A quick explanation will make their negligence clear. Let us assume that the chance of disclosure of passwords is merely a function of exposure to the internet, multiplied by the traffic of (aka attacks on) the company, divided by the security measures in place to prevent data disclosure. The equation can be noted as EXP * TR / SEC = DISC(%). That equation is of course not scientific, but it helps to explain the current atmosphere of the internet. The variables EXP and TR are hard to control by any company that is out on the internet, and in fact, most companies interested in making a profit want those values to increase. The key to business viability, trust of the consumer (industry respect), and meeting the responsibility placed on you as a data steward is the company's SEC value. I would also argue that the more vital the service you are offering on the internet is, the more responsibility and obligation you have to increase your SEC value.

By using unsalted SHA-1 hashes, LinkedIn essentially conceded that the value of DISC would be enormous, and it did so by negligently failing to salt those passwords. I say negligently because it is commonly understood in the industry that use of a salt makes cracking password significantly harder. Take for example the NIST Enterprise Password Management Guide, which states:

The use of salts also makes cracking more difficult—for example, using 48-bit salting values effectively appends a 48-bit password hash to the original password hash, assuming that the attacker does not have access to the salting values and that the salting values are well-chosen. So a salted password might have the same effective length, and therefore be roughly as time-consuming to crack, as an unsalted password  that is several characters longer. Also, salts typically use the full range of possible values, unlike passwords that have limited character sets, so salts can strengthen the effective password complexity. Policies for password expiration, length, and complexity should take into account the use of salts.

The use of salts defeats, or at least slows down the use of "rainbow tables," which are tables of already calculated hashes of passwords. So, if I know that your site uses SHA-1 hashing, I take a wordlist of X number of words, and hash all of those into a database. Then, when a Russian hacker discloses all of your passwords, I merely correlate the values disclosed with the values in my table to discover passwords. I may not get all of the passwords, because the dictionary file originally used normally does not have every word or possible combination of letters, numbers, and symbols used by individuals, but I am guaranteed to get a large portion because users typically have bad passwords (or shall I say weak/predictable passwords).

The use of salting defeats rainbow tables because the hope is that the potential "cracker" of the passwords is clueless on the salt used to hash the passwords by the particular site, so a traditional rainbow table is useless. Thus the hacker would need to create a rainbow table for every possible iteration of the salt - an extremely time consuming task, and wholly not worth it. In all of these password cracking scenarios, there is a race condition going on. Specifically, that the number of entrants to the race decreases exponentially as the complexity and difficulty of the passwords that could be cracked increases (the value of SEC increases). As an internet company you need not outrun the bear behind you that is attempting to expose your security weaknesses, you merely need to be running faster than the others around you.

It is no argument for LinkedIn to assert that they could not have feasibly implemented a salt on their SHA-1 hashes, nor is it an argument for them to assert that others are using SHA-1 hashes. It is widely known that SHA-1 has been significantly weakened, and SHA-2 (256, 512) algorithms are better alternatives - the federal government urged federal agencies to stop using SHA-1 in March, 2006, and a competition has been running since 2007 to come up with SHA-3.

We must assume that password hashes are going to be disclosed because of the plethora of weaknesses in software currently implemented worldwide. What we shouldn't assume is that the stewards of our data are failing to exercise due diligence in protecting our information. The driver of an increase in the value of SEC is the real world accountability for preventable security failures.

Update: As expected, LinkedIn has confirmed the breach.

Read More