http://www.techworld.com/security/news/index.cfm?newsID=9113 By Matthew Broersma Techworld 11 June 2007 Web security research is being seriously hampered by laws that punish researchers for even attempting to locate flaws in web software, much less disclosing those flaws, according to a new study. The report is the first by the Computer Security Institute (CSI), a research and training organisation under the aegis of CMP Technology. It draws on discussions by a broad working group, including security researchers and representatives of US law enforcement agencies. The upshot is that current legal frameworks designed to allow prosecution of web attackers also make it next to impossible to legally spot security flaws in the "web 2.0" applications quickly becoming ubiquitous on the Internet. Those researchers who do feel safe probing web software for flaws are probably not aware of their real legal position, the report said. Unlike researchers who address offline software and operating systems, web software researchers face significant legal restrictions designed to trap attackers, according to Jeremiah Grossman, chief technology officer of White Hat Security and a member of the working group. "Under some laws, a researcher could find himself prosecuted for simply looking for website vulnerability, much less disclosing it publicly," he said in a statement. The report is to be released on Monday at CSI's NetSec '07 conference in Scottsdale, Arizona. It suggests that changes may be needed if the emerging ecosystem of web applications is to be kept secure. That could include changes in the law, including to the assignment of liability, how "damage" is quantified and how disclosure and criminal intent figure into the picture, the report said. Short of changes to the law, the report suggested websites could encourage vulnerability disclosures through anonymous tip lines or the use of "dummy" sites specifically for the use of researchers. The working group included organisations such as Fortify Software, SPI Labs, the US Department of Justice, Cenzic and the Electronic Frontier Foundation. _____________________________________________________ Attend Black Hat USA, July 28-August 2 in Las Vegas, the world's premier technical event for ICT security experts. Featuring 30 hands-on training courses and 90 Briefings presentations with lots of new content and new tools. Network with 4,000 delegates from 70 nations. Visit product displays by 30 top sponsors in a relaxed setting. Rates increase on June 1 so register today. http://www.blackhat.com
This archive was generated by hypermail 2.1.3 : Tue Jun 12 2007 - 00:14:19 PDT