DEF CON 31 War Stories - The Risks of Pointing Out the Emperor is Buck Naked - Renderman, Tom Dang

Post 9/11, the phrase “If you see something, say something” became ubiquitous. If you saw something of concern, better to report something that was nothing than let something bad happen. Problem is, no one let the authorities know that they should apply this to the online realm too. Threats of arrest and criminal investigations have the opposite effect and chill anyone from wanting to report security vulnerabilities that affect everyone.

Lack of clear reporting paths, misunderstandings, jurisdiction issues, superseding laws, and good old fashioned egos can make trying to do the right thing turn into a nightmare that can cost livelihoods, reputation, criminal charges and even worse, particularly when government systems are involved.

This talk will cover the presenters personal experiences with poorly written or a lack of vulnerability disclosure policies with their governments and what it cost them in trying to make things better. The presentation will then move to a discussion about what should be done and what is being done to make sure that reporting a vulnerability doesn’t cost you everything. Anyone who is responsible for writing such disclosure policies or legislation will benefit, but so will any hackers that want to make it safer to report issues they find by advocating for changes.

[quillclock]

most defcon intro. the bottle drop was perfect
moral of the story: don't fire your hackers for finding stuff. give them raises and they will gleefully fix it for you

[cogspace]

One of the many reasons we need reliable, trusted journalists is because while we should absolutely fight for better legal protections, there will always be some risk associated with going public with this kind of information, so it will always be safer to drop an anonymous tip to a reputable news outlet rather than go directly to the government.

[sjoervanderploeg]

This is so funny, because I have a relatable case!

I reported QR collisions to the Dutch government and got faced with the "these are non-issues" e-mail. Basically for the COVID QR code they used a TOTP based on first letter of name and first letter of surname plus date of birth.

So any "SP" born on my birthday could use my QR codes with my credentials.

Even worse was the fact that you could simply generate any QR code yourself, the app didn't use any API to fetch codes... no it just generated codes based on a secret bundled with the app.

So much for "non"-issue, never heard anything from anyone. No cops tho, no cops!

[JustPlainRob]

The moral of the story, kids, is that when you discover a vulnerability you shouldn't report it and instead should sell it to shady folks on the dark web.
Or at least that's what punishing well-meaning hackers causes.

[stiLLa]

God Bless Dan Kaminsky - R.I.P. - missed but never forgotten

[Derbauer]

This should be required watching for all bug researchers.

[craigslist]

"what are the problems here"

it's frustrating how much 'laughing it off' there was about their two anecdotal experiences. How many people could survive being attacked by powerful systems, whether the banks or the government, losing your job suddenly, having to pay lawyers, etc... and even for these guys who have the social and financial support to survive those attacks, nothing was done to make it right. I'm sure lawyer fees were never reimbursed, and a government fine of 5k is nothing to sneeze at. Many people could not absorb that easily, although the lawyer fees dwarf it.

Governments and these companies are effectively waving a gun around like a madman at anyone knowledgeable about security and hacking and making it clear that when you find a vulnerability you can't have a rational discussion with this nutjob. Your only option is to put on your black hat and monetize exploits otherwise nothing will ever be done to fix them.

Anyway, great talk but it's a dark topic when you consider what might be happening to people with less voice or knowledge in navigating the corruption.

[timothyblazer]

When hackers realize en masse that the government is lying when it says it cares about security is when this changes. There is no reasoned argument that will convince an apparatchik that a real problem is more important than the governments reputation.

If you report something embarrassing or issue an ultimatum to those people, most will respond with guns ( police and prosecution ).

[thatlamp]

Still have one of these service medals pinned to my Def Con bag.

[LordNAg]

THIS is how I find out Kevin Mitnick is dead?? RIP

[moonasha]

god, the canadian government is such a joke sometimes. Sometimes i think we have it bad in the states, then I see stories like this, where a guy gets fined $7500 for reporting a freaking vulnerability... jesus. They act like he published the info online and didn't save their butt.

[jvsonyt]

The only thing I learned from this is "See something, shut tf up."

[DavidConnerCodeaholic]

“A hacker with time on their hands is dangerous”

yeh in 2005ish I knew what Snowden reported. I’ve basically only ever had one job. Go figure. But it was really a bad idea for society to punish me by preventing me from having a job. They really assume that if they destroy your career early in, that you’ll never become anything. They undervalue talent and natural intelligence, thinking that (as it was in earlier decades), if they just prevent you from ever being respected/employed in society then somehow you won’t be intelligent. We have things like github, Wikipedia, free online education…

[RoamingAdhocrat]

Doors and corners, kid. Don't come into the room too fast.

[MadeAnAccountOnlyToReplyToThis]

Damn Renderman is still kicking, respekt

[MyThreeLivesASMR]

12:59 I think there was a mistake here. The HTML "hacking" case occurred in Missouri, not Mississippi.

[MadeAnAccountOnlyToReplyToThis]

Damn the Defcon audience has either gotten super stuffy or (impossible) they fixed the audio finally

[Stjaernljus]

say nothing to anyone, you will only get yelled at.

[GregoryMacPherson]

The problem is stated succinctly at the beginning - the lawyers. The attorneys told the CISO that they HAD to be heavy-handed from the jump, otherwise if it turned out to be a LEGITIMATE THREAT, then they (the government) would be liable. The problem is that attorneys have ZERO CLUE about what constitutes a legitimate threat versus "responsible disclosure." Hence the talk. Bottom line, educate the attorneys (and their minders) to recognize the difference between responsible disclosure and "Yuri the Ransomware Czar."

[Cyber-IoT-bhqv]

5 minutes of "wow I'm so great"