- Community Home
- >
- Servers and Operating Systems
- >
- Operating Systems
- >
- Operating System - HP-UX
- >
- Illegalization of admin tools
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Forums
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-06-2007 11:57 PM
тАО08-06-2007 11:57 PM
Illegalization of admin tools
although this is foremost a forum for the exchange of technical topics and not to be hijacked for venting susceptably politically incorrect ones,
I darepost this because I am very interested in the views of other possibly affected sysadmins as well as software distributors (like HP) of programs that henceforth most likely will be deemed so called "hacker tools" and thus whose creation, distribution and usage will be prohibited by law, at least in some countries.
What grieved me, was to note by certain local press releases (unfortunately only those that probably are mostly read by IT affiliated people only) that an amendment to our criminal law ($$ 202 StGB) has passed, almost unanimously without causing the faintest debate to be noticed by the public, our Federal Assembly "Bundesrat" (Parliament of Federal States).
These new modifications to our Criminal Law, which already have been signed by our Federal President by which the final stage in our Legislative has been passed, and now only need to be promulgated to become effective,
are said to also make culpable the usage of programs and APIs such as Nmap, Tcpdump, Wireshark, libpcap, Nessus, to name but the most prominent.
Interestingly, our Federal Office for the Security of IT (BSI) still is advertising its Nessus based security scanner for the masses called BOSS on its website.
Afaik, some of the mentioned programs are also distributed by HP within their Inetrnet Express release.
My colleagues and I sometimes require to do some packet sniffing with some of these tools for trouble shooting as part of our admin work.
As far as I have seen, though I have to admit not having perused completely the legal jargon yet, there are no exemptions for some "white hat", or "ethical hacking" usage of these tools in the current caption.
I wonder how the admin job will render when programs that in the wrong hands or with nefarious intent may constitute "cyber crime"
and which will no longer be legally available while our attackers don't care anyway?
How about you?
Are there similar traits in your political environment that may impair your work?
I am also curious how vendors and distributors like HP would react.
I hope this thread will not be banned by the moderators though.
FYI, for those of you who can read German:
http://www.heise.de/newsticker/meldung/92334
http://www.bundesrat.de/cln_051/nn_6906/sid_3F08EF1F2FDE19F92588C5742985533F/SharedDocs/Beratungsvorgaenge/2006/0601-700/676-06.html?__nnn=true
http://www.bundesrat.de/cln_051/nn_8336/SharedDocs/Drucksachen/2006/0601-700/676-06,templateId=raw,property=publicationFile.pdf/676-06.pdf
http://www.bsi.de/produkte/boss/index.htm
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-07-2007 12:11 AM
тАО08-07-2007 12:11 AM
Re: Illegalization of admin tools
If you are interested you must go to the starting page and search for "hacker tools" or similar.
http://www.bundesrat.de/cln_051/nn_8336/DE/Home/homepage__node.html?__nnn=true
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-07-2007 01:33 AM
тАО08-07-2007 01:33 AM
Re: Illegalization of admin tools
Most of the Security Audits firms and Security Organization rely on these tools(If not, atleast the logic) to do the network assessment . We admins use the tools for finding issues which cant be seen with default tools or not taught anywhere because thats possible with these tools like ethreal/ wireshark. Many issues which were going stray with the solution, came to sol. due to multi dimensional investigation and R&D using them.
I hope the same is the reason for HP providing them in part of its Internet Expresss Package.
"Till you know what you need to secure and how it can be stolen, you cant really secure that!!!"
Cheers!!
Anshu
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-07-2007 03:00 AM
тАО08-07-2007 03:00 AM
Re: Illegalization of admin tools
So it looks like the first thing they talk about (At least the babelfish translation seems to indicate), is the illegal use of the tools in a closed envoronment. I missed the part in it that outlawed the tools themselves, but I don't read German, so I'll have faith it's in there.
If I were presented with this problem, I would take this to my department, and get them to approve the use of the specific tools I need. Then I would be sure to use them on those boxes I had responsibility for only, and never on any others. I would also never retain any of the traces in a file past the time of the analysis.
I'm not sure how they could enforce this, especially inside a corporation that isn't willing to sacrifice their SysAdmin for doing their job.
Do you have that kind protection available in your job?
John
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-07-2007 03:08 AM
тАО08-07-2007 03:08 AM
Re: Illegalization of admin tools
I wonder if the US and Canada will follow.
There is a plus side - this means that whenever a networking ticket comes in - I can send it back - stating something like "sorry, it is a criminal offence for me to resolve this issue" :)
Rgds...Geoff
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-07-2007 08:39 AM
тАО08-07-2007 08:39 AM
Re: Illegalization of admin tools
Security through obscurity does not work. Ever.
At best it creates a hurdle, a slowdown.
At worst some folks might be convinced they are secure.
The 'good guys' will stop using tools to identify security issues.
The 'bad guys' don't care eitherway, they'll just create a fresh, similar tool or keep using previously available variants.
Oh well,
Hein.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-07-2007 08:58 AM
тАО08-07-2007 08:58 AM
Re: Illegalization of admin tools
Yeah,
another voice of deep concern here.
Our best help tools _MIGHT_ infringe on privacy, so: "Forbid them!"
They _MIGHT_ be used to get to "confifential" data.
So: "Forbid them!"
For comparison: Cars MAY be used to run people over. Forbid them?
Chemistry MAY be used to make poisons. Forbid it?
.. Legislation MAY be used to squeeze people. Forbid it? (Maybe THAT would be an idea to put forward to legislators!)
To put it shortly: ANY tool can be used or abused. But until recently the potential abuse of a tool has not prevented its use....
And formal abolishment has NEVER in history limited abuse, although it has severely hindered proper use.
"May you live in interesting times".
If you still have the appetite: Proost.
Have one on me.
jpe
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-07-2007 02:35 PM
тАО08-07-2007 02:35 PM
Re: Illegalization of admin tools
+crack +"Randall Schwartz"
... and yes, it's that Randall Schwartz.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-07-2007 07:09 PM
тАО08-07-2007 07:09 PM
Re: Illegalization of admin tools
thanks for sharing your thoughts.
This amendment actually is justified in its preamble as being Germany's part of meeting harmonization attempts that shall lead to a common EU law against "cyber crime".
(note, this is *my* rather liberal translation of what I understand from the legislative wording, and I have no juridical background whatsoever).
In fact the text is full of references to earlier resolutions of the EU Assembly or related panels.
So I fear that similar aproaches are already targeted (or maybe even established) in the legislation of quite a few other countries.
Maybe if you are interested enough,
you could browse the websites of your governments, parliaments or courts to find out how far similar attempts have materialized?
At least one great advantage of democracies is the fact that most of these plans and papers are made public.
Unfortunetly however, often the affected populations/electorate show very little interest.
This seems especially true for what is decided in the EU parliament and associated institutions.
Let alone the participation in EU elections is gruesome overhere.
I haven't heard yet of the prosecution of Randall for "crack"-ing passwd files on Intel servers back in the nineties.
Very interesting indeed.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-07-2007 07:30 PM
тАО08-07-2007 07:30 PM
Re: Illegalization of admin tools
The EU or Israeli response to many issues like this is to legislate first, think later.
Something similar happened here with bank fees. The government set limits which the banks found ways around instead of openning up the market to competition.
The same thing is happening with these tools. Any tool, even the simplest can be mis-used. I mean the sendmail binary can be used to do denial of service attacks or with a script violate the canned spam act in the US. Does that mean it should be outlawed? Certainly not.
A patently idiodic response.
I used nmap to figure out the other day that a system I thought was listening on port 3389 was indeed not listening.
Nothing awful and ugly about that.
Good use of a good tool. Can it be used for denial of service? Yes. Should it be banned? No, but we'd better stay on our legistlators cases in these matters.
SEP
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com