Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

1/18/2012
08:14 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

The Day (Some Of) The Web Went Dark

Online protests today of SOPA/PIPA legislation blur future of anti-piracy efforts as several legislators back down

On a day when Wikipedia went dark, Google blacked out its Doodle, and various smaller sites also went offline in protest of the controversial SOPA/PIPA anti-privacy bills on Capitol Hill, several key legislators behind the bills withdrew their support.

But whispers of a possible retreat by some lawmakers yesterday didn’t slow the drumbeat of loud online anti-SOPA/PIPA protests. Nor did it seem to affect the latest threat by the Anonymous hacktivist group, which says it will again attack Sony -- a SOPA supporter -- next week in what this time could be a more aggressive hack.

The Stop Online Piracy Act (SOPA) is the House bill written by Rep. Lamar Smith (R-Tex.), and the Protect Intellectual Property Act (PIPA) is the Senate bill, written by Sen. Patrick Leahy (D-Vt.). The Senate is poised to vote on PIPA on Jan. 24, but with several key members dropping their support for the bills today in the wake of the blackout protests, its future, as well as that of the House’s SOPA bill, are now uncertain.

Critics of the bills say it won’t be easy to kill them. “Part of this bill is to make America look serious about IP protection ... so we won’t look weak,” says Robert Graham, CEO of Errata Security, whose website went dark today in solidarity with the online protest.

Several online websites donned blacked-out sections of their sites to demonstrate what a censored Internet could mean. Wikipedia and Reddit went completely dark, while Mozilla and others posted their concerns about the legislation on their home pages with black pages and information on the bills and how to contact Congress.

The bills are aimed at protecting copyrights and intellectual property online, and protecting consumers from counterfeit goods sold online by forcing Internet companies to block access to those sites. The legislation gives the U.S. more leverage to institute court orders against overseas websites engaging in these practices.

But critics say the legislation would censor the Internet and impose damaging regulations on U.S. businesses. As Google explained today on its website, the bills would allow the feds to block sites “using methods similar to those employed by China. Among other things, search engines could be forced to delete entire websites from their search results.”

Internet firms would be forced to monitor network usage, but in the end, says Google, it would not stop piracy. “These sites will just change their addresses and continue their criminal activities, while law-abiding companies will suffer high penalties for breaches they can’t possibly control,” according to Google.

Some security experts have been outspoken on the bills’ impact on the Domain Name Service's (DNS) emerging security protocol, DNSSEC, which is gradually rolling out new high-level domains. Several key players in security and Internet infrastructure wrote a white paper last May explaining how forcing millions of recursive servers to filter out DNS requests to blacklist and block domain names of servers offering pirated music or other illegally obtained intellectual property would basically cripple DNSSEC, which basically provides verification that a site a user visits is indeed that site and not spoofed or redirected.

Dan Kaminsky, one of the authors of the paper, said the DNS-filtering approach called for in the legislation wouldn’t work and could be bypassed: "It's like trying to make a telephone that won't carry swear words," Kaminsky said.

Not everyone agrees that the bills would affect DNSSEC. Errata’s Graham, for instance, says they would basically confuse DNS, not break DNSSEC. “You’d have a confused DNS, but not hinder rolling out DNSSEC," he says. “It would not hinder the signing of DNS domains.”

Cricket Liu, vice president of architecture at Infoblox, says the bills might not hurt DNSSEC deployments right now, but it could affect later phases. “I think that while it might not affect DNSSEC deployments in their current form, it would hamstring us when we moved on to an end-to-end deployment. As soon as we try to do validation on clients or in Web browsers, filtering responses would wreck DNSSEC,” Liu says.

Meanwhile, the online fallout today prompted Sen. Marco Rubio (R-Fla.) to withdraw his support for the bill, as did Sen. John Cornyn (R-Tex.). Orrin Hatch (R-Utah), a co-sponsor of SOPA, tweeted: “After listening to the concerns on both sides of the debate over the PROTECT IP Act, it is simply not ready for prime time. That’s why I will not only vote against moving the bill forward next week but also remove my cosponsorship of the bill.”

Next Page: Can anti-piracy legislation fly in some form? Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MS8699
50%
50%
MS8699,
User Rank: Apprentice
2/10/2012 | 12:05:59 PM
re: The Day (Some Of) The Web Went Dark
These sites will just change their addresses and continue their criminal activities, while law-abiding companies will suffer high penalties for breaches they canGt possibly control.
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
US Counterintelligence Director & Fmr. Europol Leader Talk Election Security
Kelly Sheridan, Staff Editor, Dark Reading,  10/16/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9417
PUBLISHED: 2020-10-20
The Transaction Insight reporting component of TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System, TIBCO Foresight Archive and Retrieval System Healthcare Edition, TIBCO Foresight Operational Monitor, TIBCO Foresight Operational Monitor Healthcare Edition, TIBCO Foresight Transaction...
CVE-2020-15264
PUBLISHED: 2020-10-20
The Boxstarter installer before version 2.13.0 configures C:\ProgramData\Boxstarter to be in the system-wide PATH environment variable. However, this directory is writable by normal, unprivileged users. To exploit the vulnerability, place a DLL in this directory that a privileged service is looking ...
CVE-2020-15269
PUBLISHED: 2020-10-20
In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.
CVE-2019-9080
PUBLISHED: 2020-10-20
DomainMOD before 4.14.0 uses MD5 without a salt for password storage.
CVE-2020-15931
PUBLISHED: 2020-10-20
Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain Administrator (that is configured within the product in its installation state) by generating a single Kerberos Pre-Authentication Failed (ID 4771) event on a ...