[LACNIC/Seguridad] Another Researcher Hit With Threat Of German Anti-Hacking Law

[Fernando Gont]

FYI

Pregunta: Alguien conoce como es la situación en estos aspectos en los
países latinoamericanos?

Fuente:
http://www.darkreading.com/vulnerability-management/167901026/security/vulnerabilities/229402356/another-researcher-hit-with-threat-of-german-anti-hacking-law.html

Another Researcher Hit With Threat Of German Anti-Hacking Law
German software firm warns researcher who disclosed a vulnerability in
its software and offered his help

By Kelly Jackson Higgins
Darkreading
Another security researcher is facing possible legal action based on the
3-year-old "hacker clause" in a German law that basically forbids anyone
from selling and distributing hacking tools.

An independent researcher who goes by "Acidgen" was recently threatened
with a lawsuit by a German software company that he alerted about a
buffer overflow vulnerability he discovered in the vendor's music
application. Acidgen, who is based in Sweden, found a stack buffer
overflow bug in Magix AG's Music Maker 16 software (version 16.0.2.4)
and promptly passed the information to Magix. After several friendly
email exchanges with the vendor in which Acidgen also provided Magix
with what he describes as a "nonharmful" proof-of-concept (PoC) to
demonstrate how the flaw could be exploited and his plans to publish the
flaw and PoC after it was patched, the researcher received a not-so
friendly email from company's lawyer threatening a lawsuit for alleged
extortion for his plans to release a proof-of-concept on the flaw.

"It came out of nowhere," Acidgen says of the legal threat. He was
awaiting word on when the vendor would be issuing a patch: "Then I get
back a really threatening lawsuit letter that they are going to press
charges for extortion for [the] exploit code," says Acidgen, who says
the PoC he gave Magix is a benign one that just starts up the Windows
Calculator.

Magix also told him it was alerting antivirus companies of "new viruses"
that would "spread" due to his PoC, he says.

Acidgen isn't the only researcher recently to be threatened by the
German law: German security researcher Thomas Roth was served with an
injunction in January just prior to his talk at Black Hat DC in response
to his plans to release an open-source tool at the conference. The tool
uses Amazon's GPU processing services to crack SHA1-based passwords at
high speeds. His apartment was raided, his bank account frozen, and he
had to refrain from releasing his tool during Black Hat.

Roth's legal troubles came after a German newspaper mistranslated
English-speaking news reports on his research. The German newspaper
incorrectly reported that Roth had said he would be turning a profit as
a sort of a hacker-for-hire. That led to a German telecommunications
firm taking legal action against the researcher: "They misunderstood
that I was getting money for doing this ... and illegally breaking into
networks," says Roth, a researcher and consultant for Lanworks AG.

Roth spent the next few months clearing his name and calling out the
German newspaper for its inaccurate report and the intent of his tool.
The German telecommunications firm that went after Roth accused him of
illegally breaking into wireless networks and planning to release
rainbow tables to be used for hacking into company networks. He was
eventually able to clear up the misunderstanding, and he finally
released his tool last month.

Meanwhile, the case against Acidgen doesn't appear to have legs, either,
says one security expert knowledgeable about the German law. "This was
Magix's legal department doing some sabre-rattling," he says. "It's
usually the first thing that a lawyer does: write a letter with an
official letterhead and see if the other side backs down."

But Acidgen says he has no intention of backing down. He disclosed the
Magix vulnerability yesterday, but stopped short of publishing the PoC.
He's still hopeful that Magix will either patch the flaw or provide him
with a date when they plan to do so.

His disclosure steps were typical of most researchers -- alerting the
vendor of the flaw and asking for its patch time frame. But what might
have helped trigger Magix's legal response was Acidgen's offer to help
the vendor further: he mentioned that he could fuzz for more
vulnerabilities "for free." "I stated and made clear that I'm not trying
to extort them or make money," he says.

In the letter to Acidgen from Magix's attorney, the attorney notes that
Magix "appreciates" the researcher's sharing his finding with the
company, and that it will use the information to "improve its products."

The next paragraph of the letter takes on a different tone: "On the
other hand MAGIX does not appreciate that you are intending to publicly
release the Exploit and to cause irreparable harm. As you maybe aware it
is illegal to release software which is intended to commit computer
sabotage (e.g. Sec. 202c I No. 2 German Criminal Law). In addition this
announcement together with your offering to have the vulnerability fixed
by your company may be considered as an attempted extortion. You may
rest assured that MAGIX will enter into all necessary and appropriate
legal steps in this regard. In addition MAGIX will inform manufacturers
of antivirus software that there might be a new virus based on your
code," the attorney wrote.

Magix had not responded to press inquiries as of this posting.

Acidgen thinks the whole thing could be a misunderstanding of how
security researchers operate. He says he had no intention of hurting
Magix or the security of its clients: That's why he is still awaiting a
fix before releasing the PoC.

His case is another example of where the German hacker law is vague and
broad, experts say. "The law is very broadly phrased, and any piece of
software can really fall under the law," notes the security expert
knowledgeable about the hacker law. "What it does help against is the
openly selling of tools from Germany. But even then, it's in the way
it's advertised."

It's all about intent. "'Evident intent' is everything," he says. "If
you advertise something for illegal purposes, you're immediately"
operating illegally under the law, he says. Even offering Windows XP for
sale for hacking purposes would be considered illegal. Under the law,
"intent is everything, not the actual capabilities of the software."

-- 
Fernando Gont
e-mail: fernando en gont.com.ar || fgont en acm.org
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1