By Matthew Broersma
11 June 2007
Web security research is being seriously hampered by laws that punish
researchers for even attempting to locate flaws in web software, much
less disclosing those flaws, according to a new study.
The report is the first by the Computer Security Institute (CSI), a
research and training organisation under the aegis of CMP Technology. It
draws on discussions by a broad working group, including security
researchers and representatives of US law enforcement agencies.
The upshot is that current legal frameworks designed to allow
prosecution of web attackers also make it next to impossible to legally
spot security flaws in the "web 2.0" applications quickly becoming
ubiquitous on the Internet.
Those researchers who do feel safe probing web software for flaws are
probably not aware of their real legal position, the report said.
Unlike researchers who address offline software and operating systems,
web software researchers face significant legal restrictions designed to
trap attackers, according to Jeremiah Grossman, chief technology officer
of White Hat Security and a member of the working group.
"Under some laws, a researcher could find himself prosecuted for simply
looking for website vulnerability, much less disclosing it publicly," he
said in a statement.
The report is to be released on Monday at CSI's NetSec '07 conference in
It suggests that changes may be needed if the emerging ecosystem of web
applications is to be kept secure. That could include changes in the
law, including to the assignment of liability, how "damage" is
quantified and how disclosure and criminal intent figure into the
picture, the report said.
Short of changes to the law, the report suggested websites could
encourage vulnerability disclosures through anonymous tip lines or the
use of "dummy" sites specifically for the use of researchers.
The working group included organisations such as Fortify Software, SPI
Labs, the US Department of Justice, Cenzic and the Electronic Frontier
Attend Black Hat USA, July 28-August 2 in Las Vegas,
the world's premier technical event for ICT security
experts. Featuring 30 hands-on training courses and
90 Briefings presentations with lots of new content
and new tools. Network with 4,000 delegates from
70 nations. Visit product displays by 30 top
sponsors in a relaxed setting. Rates increase on
June 1 so register today. http://www.blackhat.com