5 ms·

How is this not a criminal act?

by thisarticle 5y ago

bejelentkezni 5y ago
It is.
matanshavit 5y ago
What law are you proposing was broken?
- alexlur 5y ago
  18 U.S. Code § 1030
  - matanshavit 5y ago
    Oh, I see. I understand how this would apply. Now I'm curious if it has been successfully used in any case of malicious open-source software.
jeroenhd 5y ago
I do wonder how the eventual criminal justice case is going to work out. This package won't appear on your computer by magic, you have to tell NPM to fetch it somehow. Now, the goal was obviously destructive, but the code execution and initiation of the payload was explicitly started by the user. Further complicating matters is that the actual crime, the destruction of data and the installation of the software in case of destructive behaviour, all happens overseas, in Russian jurisdiction. The USA isn't going to extradite this guy any time soon in the current political climate and if the checks all work well, no destructive code is actually executed on computers within the USA. I'm sure prosecutors will find a way to get the guy convicted, after all, they managed to abduct Kim Dotcom to the USA at the request of the copyright lobby, but it's going to be an interesting case.
- inopinatus 5y ago
  It’s not complicated. Mailing a letterbomb doesn’t make the opener responsible for the explosion; the sender is still the terrorist. What’s more, there’s damage to account for everywhere, because everyone now has to audit for this malware and remove it, which has a cost. Culpability can’t be shielded by software licenses, because the law is not a programming language.
  - jeroenhd 5y ago
    Receiving a letterbomb is an entirely passive process whereas pulling in dependencies requires action from the receiving side to initiate. I don't think the situations are comparable. I also doubt the added cost will be very high because everyone already had to audit for malware. Everyone might require an update of their malware definition files, but it's nothing new. I'm not aware of any American convictions where a package maintainer sabotaged a repository of code for only foreign computers. It's definitely illegal (at the very least it's a GDPR violation) but the details might make it hard to get a quick and easy conviction out of this.
    - inopinatus 5y ago
      I didn’t say receiving a letterbomb, I very carefully said opening it. Do not underestimate the impact of actually cleaning up following any kind of incident, especially at enterprise scale. What’s more, just because we are already repelling malware, this doesn’t offset the culpability of an actual identifiable culprit; very little malware is so easily traced. Many prosecutors would be salivating at the prospect of making an example of such an easy target. As for the geographical scope of impact, again beware, because geolocation by IP is approximate. I know of an Australian startup whose hosting was misidentified by IP as Russian and lost access to certain APIs, for example. Nations that border the intended recipients of the payload, such as other former Soviet republics, are even more likely to trip up. Even the parochial assumption of only thinking the US matters fails because US entities do still operate in Russia. Including government entities who would be very shirty about being targeted.
deleted 5y ago
[deleted]

How is this not a criminal act?

bejelentkezni 5y ago

It is.

matanshavit 5y ago

What law are you proposing was broken?

alexlur 5y ago
18 U.S. Code § 1030
- matanshavit 5y ago
  Oh, I see. I understand how this would apply. Now I'm curious if it has been successfully used in any case of malicious open-source software.

jeroenhd 5y ago

I do wonder how the eventual criminal justice case is going to work out. This package won't appear on your computer by magic, you have to tell NPM to fetch it somehow. Now, the goal was obviously destructive, but the code execution and initiation of the payload was explicitly started by the user. Further complicating matters is that the actual crime, the destruction of data and the installation of the software in case of destructive behaviour, all happens overseas, in Russian jurisdiction. The USA isn't going to extradite this guy any time soon in the current political climate and if the checks all work well, no destructive code is actually executed on computers within the USA. I'm sure prosecutors will find a way to get the guy convicted, after all, they managed to abduct Kim Dotcom to the USA at the request of the copyright lobby, but it's going to be an interesting case.

inopinatus 5y ago
It’s not complicated. Mailing a letterbomb doesn’t make the opener responsible for the explosion; the sender is still the terrorist. What’s more, there’s damage to account for everywhere, because everyone now has to audit for this malware and remove it, which has a cost. Culpability can’t be shielded by software licenses, because the law is not a programming language.
- jeroenhd 5y ago
  Receiving a letterbomb is an entirely passive process whereas pulling in dependencies requires action from the receiving side to initiate. I don't think the situations are comparable. I also doubt the added cost will be very high because everyone already had to audit for malware. Everyone might require an update of their malware definition files, but it's nothing new. I'm not aware of any American convictions where a package maintainer sabotaged a repository of code for only foreign computers. It's definitely illegal (at the very least it's a GDPR violation) but the details might make it hard to get a quick and easy conviction out of this.
  - inopinatus 5y ago
    I didn’t say receiving a letterbomb, I very carefully said opening it. Do not underestimate the impact of actually cleaning up following any kind of incident, especially at enterprise scale. What’s more, just because we are already repelling malware, this doesn’t offset the culpability of an actual identifiable culprit; very little malware is so easily traced. Many prosecutors would be salivating at the prospect of making an example of such an easy target. As for the geographical scope of impact, again beware, because geolocation by IP is approximate. I know of an Australian startup whose hosting was misidentified by IP as Russian and lost access to certain APIs, for example. Nations that border the intended recipients of the payload, such as other former Soviet republics, are even more likely to trip up. Even the parochial assumption of only thinking the US matters fails because US entities do still operate in Russia. Including government entities who would be very shirty about being targeted.

deleted 5y ago

[deleted]