Home -> Law Blog Directory -> Legal Commentary Blogs -> Infamy or Praise

Legal Commentary

: Infamy or Praise

Why turn a blind eye when you can turn an all-seeing one?

By Colin Samuels

It's not difficult to join the crowd in criticizing Microsoft for their product, security, and strategic choices. The company's done a lot right, though, and it's a genuine pleasure to recognize that Microsoft can not just display a leadership mentality from time-to-time, but also bring to bear the resources necessary to lead; I congratulate them for leading on security issues at the ToorCon security conference in Seattle recently. The Register reports:

In a first for a major company, Microsoft has publicly pledged not to sue or press charges against ethical hackers who responsibly find security flaws in its online services.

The promise, extended Saturday at the ToorCon security conference in Seattle, is a bold and significant move. While researchers are generally free to attack legally acquired software running on their own hardware, they can face severe penalties for probing websites that run on servers belonging to others. In some cases, organizations have pursued legal action against researchers who did nothing more than discover and responsibly report serious online vulnerabilities.

"This is actually really important because online services - that's our stuff," Microsoft security strategist Katie Moussouris told several hundred researchers. "The philosophy here is if someone is being nice enough to point out your fly is down, they're really doing you a favor and you should thank them rather than calling the cops and saying you're a pervert."

Moussouris said she is pushing to get a provision added to a proposed standard that's making its way through the International Organization for Standardization that would protect ethical hackers who responsibly disclose vulnerabilities in other companies' websites. "If I get my way, it'll be in there," she said.

. . . .

The idea is to make websites safer by taking advantage of the legions of independent researchers who stumble upon security bugs. As she put it: "Don't hate the finder, hate the vulnerability. We don't actually want to discourage people who are trying to help us by being iffy about whether we're going to go after them."

. . . .

"There's definitely a lot of trepidation among legitimate researchers to find flaws in public-facing web applications because you never know how [companies] are going to react," said Alex Stamos, a founding partner at iSEC Partners, a firm that provides penetration-testing services. "That hurts us because the only people finding these flaws are the bad guys."

Full post as published by Infamy or Praise on April 21, 2008 (boomark / email).