This month I’m conducting some research into web hosting security issues and ran into the aftermath of the German law passed in 2007 banning security research publication. The policy has had the effect of silencing security researchers from that country. While investigating issues in PHP security I came upon the Month of PHP Bugs website and when I attempted to download a proof of concept to illustrate what type of security issues PHP had back in 2007 I got an explanation from security researcher Stefan Esser explaining why he no longer feels comfortable publishing results to the Internet. <\/p>\n
Instead of summarizing his explanation I’m going to repost it here:<\/p>\n
\nDear Visitor,<\/p>\n
since Friday 10th, August 2007 a new and very troubling law is enforced in
\ngermany.<\/p>\nIt is no longer legal to create and\/or distribute so called hacking tools in
\ngermany. This includes port scanners like nmap, security scanners like nessus
\nor simple proof of concept exploits like the MOPB exploits. They are now illegal
\nbecause someone COULD use them to commit crimes.<\/p>\nUntil today I had hoped that our Bundespresident would stop this insane law with
\na last minute veto, but now it is official and our government has rendered germany
\nmore or less defenseless against the threats from outside germany.<\/p>\nUnfortunately our government has been deaf to the warnings from lots of experts
\nthat tried to explain how important these so called hacking tools are not only
\nfor the current generation of security consultants to do their daily job, but
\nalso how important they are for the education of the next generation of
\nresearchers and consultants.<\/p>\nIf you do not know how to attack, you will never know how to defend yourself.<\/p>\n
Yours,
\nStefan Esser<\/p><\/blockquote>\nThis is incredibly frustrating for someone like me who is doing legitimate research into security problems that are plaguing the Internet. Security research is a rare and valuable skill set which should be cultivated not destroyed. Yet the German law is likely driving away people from this profession due to the impossibility of publication on the Internet without fear of criminal charges. At best the researchers who are turning away in Germany are finding other less beneficial avenues to explore. At worst they are publishing underground only.<\/p>\n
I had largely forgotten about this law being passed in 2007 because I too had assumed the President in Germany would come to his senses and repeal it. Germany has had a remarkable history with hackers (see Chaos Computer Club) so it is very surprising they went in this direction.<\/p>\n
Some old articles about this:
\nars technica<\/a>
\narticle about aftermath<\/a><\/p>\nI need to do some more follow up on this but so far the results look grim. <\/p>\n","protected":false},"excerpt":{"rendered":"
This month I’m conducting some research into web hosting security issues and ran into the aftermath of the German law passed in 2007 banning security research publication. The policy has had the effect of silencing security researchers from that country. While investigating issues in PHP security I came upon the Month of PHP Bugs website […]<\/p>\n","protected":false},"author":214,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[272],"tags":[],"class_list":["post-392","post","type-post","status-publish","format-standard","hentry","category-digital-warfare"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/posts\/392","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/users\/214"}],"replies":[{"embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/comments?post=392"}],"version-history":[{"count":4,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/posts\/392\/revisions"}],"predecessor-version":[{"id":396,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/posts\/392\/revisions\/396"}],"wp:attachment":[{"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/media?parent=392"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/categories?post=392"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/tags?post=392"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}