Ramblings of an old Doc

 

No one (except maybe hackers) loves hackers.

President Obama will propose new laws against hacking that could make either re-tweeting or clicking on a link illegal.

The (proposed) new laws make it a felony to intentionally access unauthorized information even if it’s been posted to a public website. The new laws make it a felony to traffic in information like passwords, where “trafficking” includes posting a link.

Here’s the proposed law: http://www.whitehouse.gov/sites/default/files/omb/legislative/letters/updated-law-enforcement-tools.pdf

“Even if you don’t do any of this, you can still be guilty if you hang around with people who do. Obama proposes upgrading hacking to a “racketeering” offense, means you can be guilty of being a hacker by simply acting like a hacker (without otherwise committing a specific crime). Hanging out in an IRC chat room giving advice to people now makes you a member of a “criminal enterprise”, allowing the FBI to sweep in and confiscate all your assets without charging you with a crime. If you innocently clicked on the link above, and think you can defend yourself in court, prosecutors can still use the 20-year sentence of a racketeering charge in order to force you to plea bargain down to a 1-year sentence for hacking.”– Wired

So why the sledge hammer? “Something needs to be done!” (relating to the huge data breaches over the past couple of years has stirred the mighty to act).

Unfortunately, if all one has is a scalpel, all disease tends to be viewed with a “Heal with steel!” surgical bias, just as if the only tool one had were a hammer, one would relate to screws and bolts as if they were nails.

I recommend a different approach: Forget the “This is BAD! We have to do something!

What we need is to understand that a law or series of them won’t change a thing. Hacking is international, and anonymous…with states and/or major cyber criminal organizations responsible. You can’t put on trial those you can’t even apprehend. The “War on Hackers” will be as effective as the “War on Drugs” and the “War on the Poor”. Oops. I meant, the “War on Poverty”.

We should instead generate a whole new system of cyber-identity, not requiring passwords and idiocy of that variety utilizing biological markers such as a retinal fingerprint or image of the iris, with the second factor being a voiceprint or the like.

Actually, software security firms will by definition be outlawed by this crazy new legislation, and worse: There will be massive Internet Surveillance…and guess what, that’s another administration proposal. The new surveillance law will strong-arm companies and corporations into sharing their firewall, ISPs and antiviral information with the government. A whole new take on who’s “transparent” and who isn’t.

These crazy laws will generate the Cyber Police State. Guaranteed.

It’s time to stop over criminalizing every activity that innocent people will be entrapped by and it’s about time to roll back the nonsense and start using the gray matter to ensure security rather than prison terms.

After all, America has 5% of the world’s population but 25% of the world’s prisoners. That’s got tell you something.

Sources:

http://www.wired.com/2015/01/president-obama-waging-war-hackers/?mbid=social_twitter


Comments
on Jan 16, 2015

Good read, Doc.  

on Jan 16, 2015

and then there's good hacking... 

https://au.news.yahoo.com/world/a/25953438/anonymous-to-avenge-charlie-hebdo-victims/

 

The person says hacktivists from around the world will track down all jihadist activities online and close down all of their social media accounts.

"You will not impose your sharia law in our democracies, we will not let your stupidity kill our liberties and our freedom of expression,” the masked spokesperson says.

“We have warned you; expect your destruction, we will track you everywhere on the planet, nowhere will you be safe."


America has 5% of the world’s population but 25% of the world’s prisoners.
[/quote]

scary numbers...  

 

[quote who="teddybearcholla" reply="1" id="3516572"]
Good read, Doc.

agreed....

on Jan 16, 2015

I think using the term 'overkill' to describe this crazy attempt to rid the world of hackers is an understatement, to say the least.  It's like cutting a person off at the waist to get rid of a boil on the bum.... it goes way too far and is excessive.

So I'm guessing the old tracking down a bricks and mortar location from an IP address and taking a rocket launcher is off the agenda since the bin Laden raid was conducted and criticised by various nations?

For mine, summarily exectuting a number of the harder to find hackers on the spot would make those easier to find fear discovery and every single knock at the door.

As for apportioning guilt or blame to somebody for knowing or hanging around with a hacker/hackers, well that's just bullshit of the highest order.  It's like all those people who knew, befriended and/or lived next door to serial killers, yet knew nothiing of their clandestine activities.  Are they on death row by association?  No, of course not, and knowing/hanging around with a hacker should be no different unless it can be proven conclusively that the person engaged in illicit activities with said hacker[s]

On a different but related note: the FBI is here in Australia prosecuting an 18 year old hacker from Sydney, which is something I find quite unacceptable.  The US gov't wouldn't allow one of our law enforcement agancies to enter the US to prosecute a US citizen, so why does the fechen US gov't believe it has the right to do on our soil what it would NOT allow to be done there?  Pisses me off severely, that, very much so!

on Jan 17, 2015

Don't expect the newly sworn in amateur Democrats to put a stop to this.

on Jan 17, 2015

Daiwa

Don't expect the newly sworn in amateur Democrats to put a stop to this.

So the other bunch is gonna do it any better?   I don't think so!

Nope, it's going to take somebody with brains and reasoning, and sadly, neither bunch seems to have either.... just an abundance of WTF?, "let's throw the military at it.".

The people most likely to takle the issue with some degree of success would be the industry leaders aready tackling malware and other cyber crimes, so the smarter legislation would be to give them broader, far reaching powers to bring these virulents to justice.... cos government of any flavour anywhere in the world ain't goinna do it... PERIOD! 

Governments and bureaucrats are too hamstrung with bullshit, red tape and infighting to be effective, so best they leave well alone and hand the reigns of power in the matter to the experts.

on Jan 17, 2015

We should instead generate a whole new system of cyber-identity, not requiring passwords and idiocy of that variety utilizing biological markers such as a retinal fingerprint or image of the iris, with the second factor being a voiceprint or the like.


I do not agree that this would be a great idea, it would allow for more control and isn't that what the NSA and Obama wants?
  NO thanks. For several reasons

The whole thing shows how desperately they try to get more n more control established.
The thing is that even with upping all those laws he will not be able to stop a botnet, it is by far too complicated to find the puppet master behind it and on the route to solving the mystery there would/will be to many civilians that haven't done a thing wrong.
I believe the main agenda behind it are not chasing hackers, this looks like another attempt to establish more surveillance in general. YEah it is.
Clicking on an illegal link, i get mad reading something like that. How should your average user know if a link is legal or illegal in the first place when the most of them barely know how to use the computer to surf the www. But it makes sense in the world of OBAMA a place where up is down.

They will likely find enough that wobble their head without thinking ahead about it, but if the mass is also concerned about it, with the help of a little fear things will even go faster.
What one could do with enough rights established is insane, but it seems by only raising the word Hacker it indeed becomes easier, people will avoid thinking ahead while blindly trusting insanity.


Latest attacks by LizSquad directed at PSN and XBLive?
Well that was messed up, no question! Simply because it was a no brainer targeted at the wrong folks = EndUser
But let us be reasonable here and think this through, one needs protection and that protection is available, the only problem is it costs money, and
what is it you do, if you earn enough money? Exactly you do not buy it, because you will have a better gain in numbers to show up in the end, the denial of service would only affect the users that already have bought a product using unprotected D. Servers, it seems that pardon me “not giving a shit” is better than buying software for your server that puts a stop to it.
It is like sleeping with over 1 million people in the shortest time and hoping to avoid a disease.
DDos Protection exists they just did not use it and still don’t probably.



on Jan 17, 2015

benmanns, how on earth would using biomarkers increase control by the NSA, or anyone else, for that matter? Having a NON-PASSWORD identification system would INCREASE security, not DECREASE it.

The increase in surveillance and demanding security companies' software/passwords, etc. WOULD.

If this isn't obvious, read the source articles... This is obvious, and the reason companies are trying to get away from hackable passwords and defective logon software.

on Jan 17, 2015

Everytime USA declares "War on..." something, you know that a disaster is coming. War on drugs, war on terror, war on whatever, all of them were flops. 

 

I suspect that the shady semi-secret govt agencies who boosted their power nicely after the media-induced fear from 9/11 events would like to boost the cyber aspect of their little police state within a state. They have their torture chambers, they can bomb whatever target abroad they with whenever their corporate sponsors want, they can chase and kidnap people all around the world, but those internets still elude them. Time to get some nice new laws approved...

 

"The US gov't wouldn't allow one of our law enforcement agancies to enter the US to prosecute a US citizen, so why does the fechen US gov't believe it has the right to do on our soil what it would NOT allow to be done there?  Pisses me off severely, that, very much so!"


Because it's a friggin empire, and the throne is not in Sidney, but in Washington DC!

on Jan 17, 2015

DrJBHL

benmanns, how on earth would using biomarkers increase control by the NSA, or anyone else, for that matter? Having a NON-PASSWORD identification system would INCREASE security, not DECREASE it.

The increase in surveillance and demanding security companies' software/passwords, etc. WOULD.

If this isn't obvious, read the source articles... This is obvious, and the reason companies are trying to get away from hackable passwords and defective logon software.

 

There is nothing wrong with passwords, if you deploy them sensibly. For example, to protect encrypted private keys locally, and use only those private keys for authentication/encryption purposes via asymmetric cryptography. 

on Jan 17, 2015

Whenever technology is used on a larger scale there is a potential for cybercrime software will be developed and Bots will be able to gather data. These scanners are most likely to be attached to the machine a machine that is connected to the net obviously it would need more than three module protection that your “parts” or scans of it are secure. But as we all know no protection is bulletproof.
I do not understand what you mean with biomarkers, if you meant medical conditions measured I just don’t see how that would be more secure than a password. 
As i understood it you meant eye scans or finger scans.
Just think about what a simulated retina scan could do to your financials if it falls into the wrong hands - can’t replace your eye as easy as a password.
Also you can simulate a pulsing finger... Finger scanners for example are not as safe as they seem to be.

How could the NSA make use of it? How could they make use of things such FB? Any information counts.
It would benefit locating you as soon as you interact with a computer, your every step in the Internet could be protocolled and you could not deny your habits, proof that it was you writing an anonymous text, no more need for social network anymore you would become totally transparent by just having such a “bio” password.

Not sure if you understand what I mean by that.
I enjoyed reading the topic as usual but that was a thought I had that doesn’t sit well with me could be that I understood it wrong.
Let me know

Edit:

The thing is the hardware that would be used would run on software and without protection the data is unsafe, a password can be changed a body part can be as well but it is way more complex process. Once lost you are screwed.
I do not spot the potential in better security for the end user or myself in such a path, however I sense another great potential use for other things in it as I explained in my previous post. 

Take online banking for example, meanwhile we have a bankcard a bankcard scanner and software that will display a code where you need to have both physical objects, the scanner and the card in your possession, to scan the displayed code
from the screen to generate a code for a transaction, keep in mind you also need to have your login info to get to these steps, still this can be hacked.
Sometimes the issue isn’t the software, it can be the company that sells information or information that gets leaked through employees, or a gap in security that can/is taken advantage off as mentioned.
SO even if you would have things like retina scans for the home user base, would you trust a single company with that information?
Since either way it is likely to end up in the wrong hands.
That is the reason why I think I´d rather support some abstract module based password protection.
Since I still have the option to lockdown and change the validation after I brought proof that `my person is really me and not some guy sitting at the other side of the planet buying stuff from eBay with my retina scans.
I know that if in trusted hands this could be a real potential like you pointed out Doc no doubt it could but money rules the world.
What is worth more than money, Information since Information is control control is power.
And if the article is pointing this out aswell it might also has the reason that along this path like in the production line, software developement, and so on is also money to be made.

The question is how more secure would it realy be once breached. 

 

on Jan 17, 2015

The worlds worst bunch of hackers are called NSU and if this law puts them + their associates for 10 years behind bars I would support it!

***

Problems of biological markers: They are equally hackable, all of them. It has been done, and as technic progresses, becomes more and more easy. The Chaos Computer Club recently made a working fingerprint of the german Minister of Defense simply from photos that were shot by a mobile phone, and used that to breach into secure rooms. Back in 2008 this was done with another politican. They also fool optical scanners with specialized prints etc pp.

And no matter how much you develop these systems, the method of hacking can also advance to a point where it is broken open.

Passwords can be changed, or used many different, biometrics stay always the same, that is, if someone gets access to biometrics and knows how to hack with them he will get total access to a whole (virtual) life of a person. 

And if biometrics become a general replacement for passwords then you can be sure that alot of new databases containing them will emerge.

on Jan 17, 2015

smh.

on Jan 17, 2015

was my comment this far off ?