Ramblings of an old Doc

 

Very recently, the Commission on the Theft of American Intellectual Property released an interesting (if 84 page long) report on preventing theft of IP. You can read it here: http://ipcommission.org/report/IP_Commission_Report_052213.pdf

It’s interesting because it proposes the use of malware to prevent theft. In other words, they suggested that malware (spyware, rootkits, ransomware and Trojans) can be deployed to test your computer for pirated software and lock it until you confess to some law enforcement agency!

“Software can be written that will allow only authorized users to open files containing valuable information. If an unauthorized person accesses the information, a range of actions might then occur. For example, the file could be rendered inaccessible and the unauthorized user’s computer could be locked down, with instructions on how to contact law enforcement to get the password needed to unlock the account. Such measures do not violate existing laws on the use of the Internet, yet they serve to blunt attacks and stabilize a cyber incident to provide both time and evidence for law enforcement to become involved.”

and

“While not currently permitted under U.S. law, there are increasing calls for creating a more permissive environment for active network defense that allows companies not only to stabilize a situation but to take further steps, including actively retrieving stolen information, altering it within the intruder’s networks, or even destroying the information within an unauthorized network. Additional measures go further, including photographing the hacker using his own system’s camera, implanting malware in the hacker’s network, or even physically disabling or destroying the hacker’s own computer or network.”

This is Stuxnet. It also isn’t new. “Brain” was the first PC virus ever created and was designed to do to do exactly this. Guess how that turned out, and what do viruses do today? How about Sony and Rootkits? All they did was compromise computer stability. Surprise: Like Brain, they did nothing to the Pirates except give them another tool to harm you with. Even Sony’s “removal tool” caused BSODs, and could be used to elevate privileges on a system. Also, it could be used by hackers to run code remotely on your PC or to allow websites to do the same. Trying to remove them would remove access to CD and DVD drives. Wonderful.

The ends do not  justify the means. No one should be allowed to unleash this kind of thing on the net, or have it pre-installed on your OEM with or without your knowledge. They will destabilize and/or make your computers more exploitable.

I am continually amazed by those who think that by simply laying on a coat of paint, they’ve solved the problem of the underlying rust. Painting stripes on a giraffe will not turn it into a zebra.

Malware is malware. It cannot be turned into goodware or secureware. It will become disseminated and it will be used for nefarious purposes.

You don’t have to believe me. Ask Alfred Nobel about how dynamite ended warfare.

Even worse!

What about the heuristic software used to reveal malware by its behavior? By encouraging such idiotic nonsense, these people are actually proposing the neutralizing of a very important class of software which actually does do good things to secure your computers.

While I learned of this through an Emsisoft email (they make heuristic software as well as other security software), I do not favor their software more than others as an “instead of”. I consider it at most an additional layer of security. I did not receive financial or other considerations from Emsisoft (and/or their affiliates/partners) now or in the past for any review or mention of their software.

In no way should this be taken as advocacy of piracy or theft of IP simply because I disagree with a certain proposed method of defense. Theft is theft, just as malware is malware. No layer of pretty paint is going to change that.

Source:

http://www.emsisoft.com/en/kb/articles/ticker130606/?ref=news130606&utm_source=newsletter&utm_medium=newsletter&utm_content=tec130606&utm_campaign=news130606


Comments (Page 1)
2 Pages1 2 
on Jun 05, 2013

Good article Doc! No way are they getting into my PC! Oh, and what should be done to people who create this malware and stuff? You don't want to know my opinion...

on Jun 05, 2013

My son's pc was bsod'd and required a complete hd wipe after he purchased five CDs at Best Buy.  Two of them were Sony CDs with their root kit.

If I had not been computer savvy he would have had to pay a computer repair shop or would have lost legal data he had on his own PC.

Ironically, around  that same time, then senator Orin Hatch was proposing exactly these sort of solutions.

What these sort of measures imply is that if you buy your own computer and software and regardless of what sort of personal work it is used for--including writing code, creating personal artwork, storing archival, research and financial data of any level of value--is that the rights of a company or product creator justify the poential accidental loss of this data in order to protect their own rights--regardless of the relative value of their product.

I hope every college student,  attorney and author and accountant and artist and researcher will propose vigorous legal remedies for companies that create such software should it cause them a loss of valuable data.

Maybe the first lawyer who loses valuable and confidential legal information will start the ball rolling.

I was furious at what happened to my son because I could just as easily have placed that cd in my own computer and lost years of irreplaceable software and research.

on Jun 05, 2013

“Software can be written that will allow only authorized users to open files containing valuable information. If an unauthorized person accesses the information, a range of actions might then occur. For example, the file could be rendered inaccessible and the unauthorized user’s computer could be locked down, with instructions on how to contact law enforcement to get the password needed to unlock the account. Such measures do not violate existing laws on the use of the Internet, yet they serve to blunt attacks and stabilize a cyber incident to provide both time and evidence for law enforcement to become involved.”

That looks more like the prospect of encasing data [IP] within latent malware...which is activated by unauthorised access to the data.

Much the same concept as a car engine immobilizer which goes on to not 'just' stop the car...but lock the doors [catching the crook] and calling police.

Sounds like a damn good idea, actually.....but probably comes under the precept of 'man-trap' which is illegal most everywhere...

It's currently OK to have your computer 'phone home' to save itself...when stolen.... all they're seemingly suggesting is that after it 'phones home' it 'self-destructs in 5 seconds, Mister Phelps' ...

on Jun 05, 2013

Well why don't we just go ahead and immobilize your car as you drive on the interstate in rush hour when it decides an mp3 playing through it's sound system wasn't paid for?

Maybe we could fix it so your house doors lock and have to be opened by the police too.

I'm thinking China, Iran, Syria and North Korea would love this.

"Dear US/European customer...it appears your purchase is not recognized by the EU/US and your computer will be locked until you turn yourself in to authorities there.  Have a nice day.".

on Jun 05, 2013

Sounds like a damn good idea, actually.....but probably comes under the precept of 'man-trap' which is illegal most everywhere...

If one judges it on historical precedent, it's an ill conceived, self-defeating and destructive idea, actually.

on Jun 05, 2013

Ah....just think of it as 'reactive armour' as used on modern tanks.  Good old 'blow back'.

Works for tanks ....would work for property too.  Imagine the bank vault where instead of a 'silent alarm' it had a few kilos of semtex....

Hey look...no more bank robber....

 

on Jun 05, 2013

Imagine the bank vault where instead of a 'silent alarm' it had a few kilos of semtex....

 

And...no more vault.  

on Jun 05, 2013

I suspect these are the kind of people that would whip up a big batch of DDT and spray it all over the county in an effort to rid their 5x5 tomato patch of a few pesky bugs.

If they are wanting me to stop buying CD's altogether, well that'll do it.

on Jun 06, 2013

These are the people in the US in the 50's who were reporting their friends as communists because the government told them to.

on Jun 06, 2013

Sinperium...sorry, but I don't understand the connection between your reply (#9) and the topic in the OP.

on Jun 06, 2013

I do.

on Jun 06, 2013

Sinperium
I was furious at what happened to my son because I could just as easily have placed that cd in my own computer and lost years of irreplaceable software and research.

So you don't do regular backups?

on Jun 06, 2013

This actually sounds great. I will then study how to remove this bullshit (I am sure hacker community will break this fast) and then offer my "repair" services to local people and earn truck loads of money

Too bad something like this has no chance to become allowed in EU

on Jun 06, 2013

TorinReborn
something like this has no chance to become allowed in EU

If they learn of it.

on Jun 06, 2013

It’s interesting because it proposes the use of malware to prevent theft. In other words, they suggested that malware (spyware, rootkits, ransomware and Trojans) can be deployed to test your computer for pirated software and lock it until you confess to some law enforcement agency!

wouldn't that be taking away one's US Constitutional right to 'Not Self Incriminate" 

I seen enough Judge Judy that someone is suing another, and she dismisses the case do to both parties had dirty hands..

 This Proposal would make their hands dirty as well as the thief of Intellectual Property... two wrongs don't make a right...

 

They need to stop trying to turn the US Constitutional into a roll of Toilet paper and stop trying to flush it away...

2 Pages1 2