Analytics
1/18/2012
08:14 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

The Day (Some Of) The Web Went Dark

Online protests today of SOPA/PIPA legislation blur future of anti-piracy efforts as several legislators back down

On a day when Wikipedia went dark, Google blacked out its Doodle, and various smaller sites also went offline in protest of the controversial SOPA/PIPA anti-privacy bills on Capitol Hill, several key legislators behind the bills withdrew their support.

But whispers of a possible retreat by some lawmakers yesterday didn’t slow the drumbeat of loud online anti-SOPA/PIPA protests. Nor did it seem to affect the latest threat by the Anonymous hacktivist group, which says it will again attack Sony -- a SOPA supporter -- next week in what this time could be a more aggressive hack.

The Stop Online Piracy Act (SOPA) is the House bill written by Rep. Lamar Smith (R-Tex.), and the Protect Intellectual Property Act (PIPA) is the Senate bill, written by Sen. Patrick Leahy (D-Vt.). The Senate is poised to vote on PIPA on Jan. 24, but with several key members dropping their support for the bills today in the wake of the blackout protests, its future, as well as that of the House’s SOPA bill, are now uncertain.

Critics of the bills say it won’t be easy to kill them. “Part of this bill is to make America look serious about IP protection ... so we won’t look weak,” says Robert Graham, CEO of Errata Security, whose website went dark today in solidarity with the online protest.

Several online websites donned blacked-out sections of their sites to demonstrate what a censored Internet could mean. Wikipedia and Reddit went completely dark, while Mozilla and others posted their concerns about the legislation on their home pages with black pages and information on the bills and how to contact Congress.

The bills are aimed at protecting copyrights and intellectual property online, and protecting consumers from counterfeit goods sold online by forcing Internet companies to block access to those sites. The legislation gives the U.S. more leverage to institute court orders against overseas websites engaging in these practices.

But critics say the legislation would censor the Internet and impose damaging regulations on U.S. businesses. As Google explained today on its website, the bills would allow the feds to block sites “using methods similar to those employed by China. Among other things, search engines could be forced to delete entire websites from their search results.”

Internet firms would be forced to monitor network usage, but in the end, says Google, it would not stop piracy. “These sites will just change their addresses and continue their criminal activities, while law-abiding companies will suffer high penalties for breaches they can’t possibly control,” according to Google.

Some security experts have been outspoken on the bills’ impact on the Domain Name Service's (DNS) emerging security protocol, DNSSEC, which is gradually rolling out new high-level domains. Several key players in security and Internet infrastructure wrote a white paper last May explaining how forcing millions of recursive servers to filter out DNS requests to blacklist and block domain names of servers offering pirated music or other illegally obtained intellectual property would basically cripple DNSSEC, which basically provides verification that a site a user visits is indeed that site and not spoofed or redirected.

Dan Kaminsky, one of the authors of the paper, said the DNS-filtering approach called for in the legislation wouldn’t work and could be bypassed: "It's like trying to make a telephone that won't carry swear words," Kaminsky said.

Not everyone agrees that the bills would affect DNSSEC. Errata’s Graham, for instance, says they would basically confuse DNS, not break DNSSEC. “You’d have a confused DNS, but not hinder rolling out DNSSEC," he says. “It would not hinder the signing of DNS domains.”

Cricket Liu, vice president of architecture at Infoblox, says the bills might not hurt DNSSEC deployments right now, but it could affect later phases. “I think that while it might not affect DNSSEC deployments in their current form, it would hamstring us when we moved on to an end-to-end deployment. As soon as we try to do validation on clients or in Web browsers, filtering responses would wreck DNSSEC,” Liu says.

Meanwhile, the online fallout today prompted Sen. Marco Rubio (R-Fla.) to withdraw his support for the bill, as did Sen. John Cornyn (R-Tex.). Orrin Hatch (R-Utah), a co-sponsor of SOPA, tweeted: “After listening to the concerns on both sides of the debate over the PROTECT IP Act, it is simply not ready for prime time. That’s why I will not only vote against moving the bill forward next week but also remove my cosponsorship of the bill.”

Next Page: Can anti-piracy legislation fly in some form? Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MS8699
50%
50%
MS8699,
User Rank: Apprentice
2/10/2012 | 12:05:59 PM
re: The Day (Some Of) The Web Went Dark
These sites will just change their addresses and continue their criminal activities, while law-abiding companies will suffer high penalties for breaches they canG«÷t possibly control.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6117
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

CVE-2014-0174
Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CVE-2014-3485
Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

CVE-2014-3499
Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVE-2014-3503
Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.