Risk
9/28/2010
04:24 PM
Jim Rapoza
Jim Rapoza
Commentary
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Government Puts The Hurt On The Internet

There are a lot of problems that face the Internet and technology today, from major security flaws to increasing infrastructure demands, you name it. But by far the biggest threats are the regular attempts by government and special interests to control the Internet and technology, attempts which would usually end up causing severe damage.

There are a lot of problems that face the Internet and technology today, from major security flaws to increasing infrastructure demands, you name it. But by far the biggest threats are the regular attempts by government and special interests to control the Internet and technology, attempts which would usually end up causing severe damage.The first is yet another proposed bill from a group of Senators, Democrat and Republican (though maybe they should all be called Entertainment Industry Senators), that is designed to limit piracy and file sharing. This bill, called the Combating Online Infringement and Counterfeits Act (COICA), would give the Justice Department the ability to block access to sites that are deemed to be dedicated to infringing copyright.

Even worse, there's no judicial review, if someone says a site is infringing and the Justice Department agrees, the site gets blocked. And from the bill it looks as if it would be very hard to get off that blocked list once on there.

So maybe you're saying, so what, those sites shouldn't be involved in piracy and infringing copyright. But just what entails infringing copyright? The bill is pretty vague and if we go by things that the entertainment industry has considered tools of piracy, it could be just about anything.

Among the technologies that entertainment heads have accused of existing mainly to abet piracy there's: the VCR, cassette tapes, DVRs, MP3 players, Internet backup services, CD and DVD burners, and even search engines. And what about sites that promote free use rights and attack bills like that one? Maybe they should be added to those block lists as well.

Hopefully this bill will never pass a full vote of Congress but you never know. There are a lot of powerful names attached to it. If it does pass it looks like it has more than a few Constitutional issues but I would hate to have to rely on the courts to stop this idiocy.

Of course Congress isn't the only one trying to break the Internet and take away the rights of users everywhere. The Obama administration has signaled that it is planning to put forward a bill that would essentially force all encrypted Internet services; from email to secure web sites to peer to peer conversations to systems like Blackberry mail; to put in a back door hole to allow law enforcement to tap those communications.

Now some will say that this is needed to fight terrorists and is no different from tapping phone calls. But there are some significant differences.

First off, we aren't talking about a centralized phone network, we're talking about the Internet. Given the decentralized nature of the Internet, we aren't talking about one back door, we're talking about maybe thousands of back doors.

Once you cut a hole in a wall and add a back door, you are instantly less secure. If these holes exist it will only be a matter of time until bad guys can take advantage of them as well. So there goes the whole idea of secure communications on the Internet.

Even worse, once these back doors were put in, the U.S. wouldn't be the only government to insist on access to them. China, Saudi Arabia, Iran, pick your country of choice. They will all have access to these backdoors.

And like most of these efforts, it wouldn't even really work. Sure, some stupid criminals would get caught. But most would be able to easily figure out ways to get around these controls, which means that the main victims of this lessened security would be legitimate users and businesses.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: No, no, no! Have a Unix CRON do the pop-up reminders!
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.