Analytics
1/18/2012
08:14 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
Repost This

The Day (Some Of) The Web Went Dark

Online protests today of SOPA/PIPA legislation blur future of anti-piracy efforts as several legislators back down

On a day when Wikipedia went dark, Google blacked out its Doodle, and various smaller sites also went offline in protest of the controversial SOPA/PIPA anti-privacy bills on Capitol Hill, several key legislators behind the bills withdrew their support.

But whispers of a possible retreat by some lawmakers yesterday didn’t slow the drumbeat of loud online anti-SOPA/PIPA protests. Nor did it seem to affect the latest threat by the Anonymous hacktivist group, which says it will again attack Sony -- a SOPA supporter -- next week in what this time could be a more aggressive hack.

The Stop Online Piracy Act (SOPA) is the House bill written by Rep. Lamar Smith (R-Tex.), and the Protect Intellectual Property Act (PIPA) is the Senate bill, written by Sen. Patrick Leahy (D-Vt.). The Senate is poised to vote on PIPA on Jan. 24, but with several key members dropping their support for the bills today in the wake of the blackout protests, its future, as well as that of the House’s SOPA bill, are now uncertain.

Critics of the bills say it won’t be easy to kill them. “Part of this bill is to make America look serious about IP protection ... so we won’t look weak,” says Robert Graham, CEO of Errata Security, whose website went dark today in solidarity with the online protest.

Several online websites donned blacked-out sections of their sites to demonstrate what a censored Internet could mean. Wikipedia and Reddit went completely dark, while Mozilla and others posted their concerns about the legislation on their home pages with black pages and information on the bills and how to contact Congress.

The bills are aimed at protecting copyrights and intellectual property online, and protecting consumers from counterfeit goods sold online by forcing Internet companies to block access to those sites. The legislation gives the U.S. more leverage to institute court orders against overseas websites engaging in these practices.

But critics say the legislation would censor the Internet and impose damaging regulations on U.S. businesses. As Google explained today on its website, the bills would allow the feds to block sites “using methods similar to those employed by China. Among other things, search engines could be forced to delete entire websites from their search results.”

Internet firms would be forced to monitor network usage, but in the end, says Google, it would not stop piracy. “These sites will just change their addresses and continue their criminal activities, while law-abiding companies will suffer high penalties for breaches they can’t possibly control,” according to Google.

Some security experts have been outspoken on the bills’ impact on the Domain Name Service's (DNS) emerging security protocol, DNSSEC, which is gradually rolling out new high-level domains. Several key players in security and Internet infrastructure wrote a white paper last May explaining how forcing millions of recursive servers to filter out DNS requests to blacklist and block domain names of servers offering pirated music or other illegally obtained intellectual property would basically cripple DNSSEC, which basically provides verification that a site a user visits is indeed that site and not spoofed or redirected.

Dan Kaminsky, one of the authors of the paper, said the DNS-filtering approach called for in the legislation wouldn’t work and could be bypassed: "It's like trying to make a telephone that won't carry swear words," Kaminsky said.

Not everyone agrees that the bills would affect DNSSEC. Errata’s Graham, for instance, says they would basically confuse DNS, not break DNSSEC. “You’d have a confused DNS, but not hinder rolling out DNSSEC," he says. “It would not hinder the signing of DNS domains.”

Cricket Liu, vice president of architecture at Infoblox, says the bills might not hurt DNSSEC deployments right now, but it could affect later phases. “I think that while it might not affect DNSSEC deployments in their current form, it would hamstring us when we moved on to an end-to-end deployment. As soon as we try to do validation on clients or in Web browsers, filtering responses would wreck DNSSEC,” Liu says.

Meanwhile, the online fallout today prompted Sen. Marco Rubio (R-Fla.) to withdraw his support for the bill, as did Sen. John Cornyn (R-Tex.). Orrin Hatch (R-Utah), a co-sponsor of SOPA, tweeted: “After listening to the concerns on both sides of the debate over the PROTECT IP Act, it is simply not ready for prime time. That’s why I will not only vote against moving the bill forward next week but also remove my cosponsorship of the bill.”

Next Page: Can anti-piracy legislation fly in some form? Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MS8699
50%
50%
MS8699,
User Rank: Apprentice
2/10/2012 | 12:05:59 PM
re: The Day (Some Of) The Web Went Dark
These sites will just change their addresses and continue their criminal activities, while law-abiding companies will suffer high penalties for breaches they canG«÷t possibly control.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web