Re: [ebook-community] DMCA updated – toaster penetration testing gets green light in America

About time. Manufacturers of low-cost internet connected devices are not ta=
king=20
device security seriously, and there have been several recent online attack=
s=20
making use of poorly implemented home video camera and video recorder devic=
es.


These devices are used to create a DDoS (Distributed Denial of Service) att=
ack.=20
Such an attack rarely poses a security risk such as leaking information, bu=
t it=20
renders servers unable to communicate with equipment out on the rest of the=
=20
internet.


Poor security meant that these many devices in consumers homes could be tak=
en=20
over by attackers, and then told to direct large amounts of data - such as =
a=20
video stream - at a server of the attacker's choice. Access to tens or hund=
reds=20
of thousands of such devices results in the target server being the destina=
tion=20
for large volumes of unwanted data. These volumes are larger than even the=
=20
biggest commercial ISPs are capable of dealing with. The large volume of=20
unwanted data results in some inbound data being dropped, with a high=20
likelihood that data coming from expected sources never gets to the destina=
tion=20
intended.


One such attack was directed at the servers running the province of Ontario=
's=20

recent Grade 10 English Literacy test in Canada. It's estimated that about=
=20
150,000 students were affected because their school computers could not=20
communicate with the testing servers. These tests - and much of the plannin=
g=20
that went into them - will need to be redone, for a test date likely in Mar=
ch.=20
The costs are not completely tallied, but the online pilot project was=20
estimated at $250,000 and the technical implementations may need serious re=
work=20
to deal with this problem, not simply a re-run at a later date.


Manufacturers appear to only listen to the outcry of the public. If they di=
d=20
this security research in private on their own devices, the problems would =
be=20
found, fixed, and never reach the public eye. They have established that th=
ey=20
will try to make do with the absolute minimum effort in creating these devi=
ces,=20
and then use any legal tools available to prevent any negative information=
=20
coming to light about their poor work effort.


This DMCA exemption is necessary to prevent legal suppression of informatio=
n we=20
all need to maintain the health of the data networks we are all using and a=
re=20

increasingly dependent on.


I expect that the choice of a toaster in the original post was designed to=
=20
avoid pointing fingers at any one significant device or market segment.=20
Internet connected toasters are relatively rare.


https://www.engadget.com/2016/10/28/that-time-your-smart-toaster-broke-the-=
internet/








On Mon, 31 Oct 2016, Joseph Harris joe9438-/[email protected] [ebook-community] wr=
ote:


>=20
>=20
> EXEMPTION ALLOWS SECURITY RESEARCH, FOR TWO YEARS AT LEAST
>=20
> http://www.theregister.co.uk/2016/10/28/toaster_penetration_testing_green=
_lighted/
>=20
> " "The new temporary exemption is a big win for security researchers and =
for consumers who will benefit from increased security testing of the produ=
cts they use," said Aaron Alva, Tech
> Policy Fellow at the Federal Trade Commission, in a=A0blog post.
>=20
> "Security researchers still have to abide by the Computer Fraud and Abuse=
 Act. In addition, the terms of the exemption specify that reverse-engineer=
ing or deobfuscating code must be
> "carried out in a controlled environment designed to avoid any harm to in=
dividuals or the public." "
>=20
>=20
> "Furthermore, any information gained from such activity must be used to p=
romote the security of the type of device on which the code runs or the sec=
urity of the people using the device.
> And the fruits of such research must be maintained in a way that avoids f=
acilitating copyright infringement.
>=20
> " "So, if you meet all of the requirements, this temporary exemption allo=
ws you to test a connected toaster to assess the risk that an attacker migh=
t cause your bagel to combust or
> remotely monitor your toaster pastry habit," Alva said. "But, of course, =
it does not authorize anyone to steal a toaster, hack into a neighbor's toa=
ster, or set toasters on fire in close
> proximity to flammable materials." "
>=20
>=20
> "For its part, the EFF would prefer to see the entire DMCA rulemaking pro=
cess burn to the ground. "DMCA 1201, and the rulemaking process, create unc=
onstitutional restraints on speech, and
> need to be struck down by a court or fixed by Congress," said Walsh.
>=20
> "The EFF filed a=A0lawsuit=A0to do just that in July."
>=20
>=20
>=20
>=20
>=20
>




: chris smith ::::::::::::::::::::::::::::::::::::::::::::::::::
: nihil tam munitum quod non expugnari pecunia possit - cicero :


[Non-text portions of this message have been removed]




------------------------------------

------------------------------------

------------------------------------------------------
Post a message:   ebook-community [[at]] *
Unsubscribe:      ebook-community-unsubscribe [[at]] *
Switch to digest: ebook-community-digest [[at]] *
Switch to normal: ebook-community-normal [[at]] *
Put mail on hold: ebook-community-nomail [[at]] *
Administrator:    ebook-community-owner [[at]] *

(* =3D=3D yahoogroups.com)
-------------------------------------------------------
------------------------------------

Yahoo Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/ebook-community/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:
    http://groups.yahoo.com/group/ebook-community/join
    (Yahoo! ID required)

<*> To change settings via email:
    [email protected]=20
    ebook-community-fullfeatured-hHKSG33TihhbjbujkaE4pw@public.gmane.org

<*> To unsubscribe from this group, send an email to:
    ebook-community-unsubscribe-hHKSG33TihhbjbujkaE4pw@public.gmane.org

<*> Your use of Yahoo Groups is subject to:
    https://info.yahoo.com/legal/us/yahoo/utos/terms/