May 20, 2022

May 20

Huge news. The Feds won’t use the CFAA to go after security researchers, pinky promise!

Wow. DOJ has announced a significant policy shift in how it will bring computer hacking charges under CFAA in the future. "The policy for the first time directs that good-faith security research should not be charged." justice.gov/opa/pr/departm…

Very important caveat.

Blake E. Reid @blakereid

@thegrugq NB: this doesn't extend to civil liability, which is a major practical problem for many researchers.

The EFF is all over it.

Chris Wysopal @WeldPond

…it stops far short of requiring that a defendant defeat a technological restriction in order to exceed authorized access.

DOJ’s New CFAA Policy is a Good Start But Does Not Go Far Enough to Protect Security ResearchersThe Computer Fraud and Abuse Act (CFAA), the notoriously vague anti-hacking law, is long overdue for major reform. Among many problems, the CFAA has been used to target security researchers whose work uncovering software vulnerabilities frequently irritates corporations (and U.S. Attorneys). The...eff.org

https://arxiv.org/abs/2205.07759

There are so many problems with this paper I’m not sure where to start. I guess I’ll start with the conclusion: they are correct. Many APTs use public vulnerabilities rather than 0day.

A short summary of some problems with the paper. Their goal when writing this paper was to answer the question “does timely patch protect an enterprise against APT threats? If so, how timely?” Keep this in mind, they’re thinking about enterprises and patching.

So an early problem is that they assume APTs are an ontological unit. They are not. The term “APT” is a broad generalisation used to collectively refer to many different kinds of these actor.

Another issue is that they assume the reports from as far back as 2008 are reliable, which I am not sure is a safe assumption.

The paper uses APT clusters which are known to be flawed. For example, the WINTI group was more of an umbrella term for different people using the same tools from a particular vendor. Much like one could talk about the “REvil group” to collectively refer to everyone using that ransomware brand, the reality is that affiliates each have different threat profiles. What they use post exploitation says nothing about how they gain access.

These are more epistemology failures.

Understanding campaigns is complicated. Firstly, for a nation state the purpose of breaking into a computer is to do something after breaking in. Gaining access is just step 0. A chore that needs to be done before moving on to the scut work of cyber espionage.

They need to gain access, but they don’t have many concerns about *how* they gain access. Of course, cheaper is better, and faster is better, but those are just guidelines. There are many conditions which could change the calculus here, such as expediency, security, time pressure, resource constraints, procurement pipeline issues, and so on.

For the majority of cases though, they can use whatever works and just get on with the job. Not every operation is about disrupting an adversary before a deadline.