Slashdot

ping - a hacker tool used for detecting computers connected to the internet for the purpose of breaking in to them

Great! Well, problem solved. We can all stop patching our servers and running firewalls now! Yippee!! :D

Default and why is he installing hacking tools in Linux distro's ?

On a serious note doesn't this basically make watching dvds on a linux computer illegal as well ? Sounds to me like this can be wide open for abuse much like our beloved DMCA.

Can't RTFA since the laws are in German.

How are hacking tools really different from locksmith's tools?

I certainly have found a locksmith to be very useful in very legal ways - but then again, I'm the kind of person who has key problems ;)

...when will they start requiring computer professionals to have to become licensed by the govt in order to to possess and use the tools necessary for them to do their jobs?

Prohibition of computer safety tools opens Bundestrojaner door and gate

May 25, 2007 (46halbe)
The Bundestag has today the prohibition of computer safety tools invariably durchgewunken (criminal law law of change for the fight of the computer criminality, more again 202 StGB). To be punished is in particular a manufacturing, a programming, a leaving, a spreading or providing software, which is urgently necessary for the daily work of network administrators and safety experts.

The Bundestag has today the prohibition of computer safety tools invariably durchgewunken (criminal law law of change for the fight of the computer criminality, more again 202 StGB). To be punished is in particular a manufacturing, a programming, a leaving, a spreading or providing software, which is urgently necessary for the daily work of network administrators and safety experts.

With it the delegates acted against the express advice of the experts belonged in the committees with the consultation of the law out of science and practice. Also on the part of the InterNet economy and from the Upper House of Parliament the law change had been criticized sharply. With exception of the Party of Democratic Socialism and a lonely SPD delegate now the completely large coalition that votierte notion lots to make Germany the professional disqualification zone for computer safety experts.

By expressed far version law becomes possession, which production and the spreading of preventive tools, with which security can be examined by computers, in Germany punishable. These tools are however essential, in order to ensure the security from computer systems to. The general prohibition of this software is to be forbidden about as helpfully as the production and the sales of hammers, because sometimes thereby also damages are accomplished.

Andy Mueller Maguhn, speaker of the chaos computer club, commentated: "the prohibition of the possession of computer safety tools opens also for the employment of the Bundestrojaners door and gate industry and citizen systematically the possibility is taken of examining their systems adequately for security. This prohibition endangers the security of the IT location Germany."

As the automobile industry, is examined in the computer industry the system security makes its vehicles with Crashtests safer by the controlled employment by attack programs. It will be legally no longer free of doubts possible in the future for sensitive computer systems will test whether they are safe or not.

On the yearly congress of the federal office for security in the information technology (BSI) Minister of the Interior Schaeuble announced planned certifying "more trustworthily" to Sicherheitsdienstleister. With this step obviously the abilities and the knowledge, which are necessary for effective safety examinations of computer systems, are into which hands by yard suppliers handread out by the government are monopolized, while the independent computer safety research can be kriminalisiert as desired selectively.

CCC speaker Mueller Maguhn in addition: "the explanations of the Minister of the Interior for computer security are pure lip-service. Here systematically the legal and organizational framework is created, in order to make citizens and enterprises defenseless opposite computer attacks, restaurant economics and also the Bundestrojaner. Safety research can take place only in an unacceptable legal gray area."

You can use a browser to hack poorely written web apps (some forum software springs to mind). Doesn't this effectively make all browsers illegal?

So how they are going to distinguish hacking tools from security software? Nmap can be used as both, and I sincerely cannot imagine securing anything without it. Next, packet loggers. Will Ethereal be banned too? It's one of the best tools IMO that gives a user the power to see exactly what he is sending or receiving, showing potential problems and vurnabilities, but it, of course, can be also exploited beyond any limits. And it's the case with all the rest of popular networking software.

If "hacking tools" are outlawed, only outlaws will have "hacking tools."

I imagine the list of tools useful only to hackers is pretty short. And I imagine that german hackers will find ways to use "legit" software to their ends.

On another note, expect little in the way of secure software innovation out of Germany in the next few years.

This sounds like banning guns in a hypothetical country where there's a lot of gun violence, and people commonly wear bulletproof vests. (Note the "hypothetical" here; this is just for the sake of argument.) Suddenly, a new law banning guns is passed, and the vest-making companies can't develop new vests because they have no way of testing them.

Brilliant.

Another parallel: this is like making it illegal to wreck a car, whether by accident or intentionally. With a law like this, cars can't be crash-tested, and auto crash safety research comes to a stop.

Of course, in the real world, computer simulations can be used to get around these problems. But with this new real-world law, the simulations themselves are illegal!

Sure, some people think he sounds paranoid...but he's right. It'll take time for things to get really bad...but they will get there, slowly.

http://www.gnu.org/philosophy/right-to-read.html [gnu.org]

This is going to stop a lot of software companies from opening up German software houses. Just trying to maintain any computer network for regular developers would probably be illegal under these rules, because a lot of network maintanence tools could be considered "hacking tools" under this definition. Without those tools, it would be prohibitive to try to support an enterprise infrastructure.

Brains are the best hacking tools of them all, and the only ones necessary--anything else can be rebuilt from scratch, or worked around. (Though it would take a while, in some cases.)

So they've outlawed brains.

Brilliant. =)

That's humorous (in a scary way) considering the following:

The commission communication "towards a general policy on the fight against cyber crime" [europa.eu]

There is no agreed definition of "cyber crime". From a strictly legal point of view, it can be questioned whether there is any need for the term at all - it could be argued that "cyber space" is just a new specific instrument used to commit crimes which are not new at all. The term may thus be most interesting from an operational point of view, i.e. the operational instruments and procedures to fight against this type of crime must be developed.

With that said, as an American, I can almost indicate any connection to me as being an illegal one and cost the German taxpayers a bucketload of money with false claims. Let's consider the following scenario.. Ping. Simple administrative tool, can also be used for DoS attacks. Suppose I start a business ... eFishSkinSales.com that sells fish skins... I find a German counterpart GermanFishSkin.com... I take their IP addressing and spoof a pingflood to my routers and send German authorities the logfiles. Would they know what a spoof is for one. How about the following... A German websurfer visits my page and does not close his browser. For the next nMinutes where n equals the amount of time he has his browser on my page, he will make repeated GET's thus resulting in a DoS attack of the lamest kind. What then. Are browsers hacking tools?

Let's take it a step further into XSS (cross site scripting)... The browser IS THE TOOL. Should all browsers be banned now. Oh those Germans. I know... What about a German, with a shell on a server in America developing tools. Now those tools don't reside ANYWHERE in Germany then what. I would have laughed that law all the way to the bitbucket. But... You're likely dealing with e-Incompetent lawmakers driving Beamers and Benz' who care little about the advances in LIFE as a whole thanks to computing both good and bad (malicious hacking has forced companies to improve themselves).

Just make sure the evil bit [wikipedia.org] is unset on your "hacking tools", and they'll be hunky-dory.

To criminalize so-called hackers.

Most policy wonks that deal with this sector have already spread the word that computers are dangerous tools in the wrong hands. So, step 1 is to make the tools illegal. For example, "Your honor we found hacking applications wireshark installed on the defendants computer." No questions about approved uses are allowed because that makes things too complicated.

Don't bother with legal challenges, the objective is to make computers a content delivery device. Anything else is too threatening to governments, regardless of their borders.

Best case scenario as other posts have pointed out, the government gives out licenses that allow you to use/own "hacking" software. In the U.S., probably a process similar to getting a clearance would be required. This is happening internationally.

Since this is the /. echo chamber, no one will do anything but whine and go back to their work/entertainment.

Required reading for Americans unhappy with their political process: http://www.vanityfair.com/politics/features/2007/0 6/murphy200706?printable=true&currentPage=all [vanityfair.com]

My university(in America) has the same rule for any computer connected to there network. I have always had etherape, ethereal, nmap, tcpdump, etc on my computers since I do computer repair. I decided to leave them on and just never tell anyone. Once I got a job in the CS department I noticed everyone had the same tools and really no one cared. Germany will probably do the same thing, no one will care about you having "hacking tools" until they really want you to go away, then you'll be charged for every program that can do anything that would manipulate data. Anyway shouldn't they have made cracking tools illegal?

How about requiring any software manufacturer that sells software in the country make public a detailed log of security testing that went into their product and require citizens to be responsible for the security of their home systems? You wouldn't need to have much of a penalty for citizens, perhaps something like a traffic violation where you have to attend a class on how to secure your computer if your system is found to have been compromised and used to attack some other party?

Back in the 90's when I was working at Data General I was on a team of people who were reading the source code to every function in the C library, operating system and utilities. For each function we wrote a document saying roughly "Here's what the function does, here are any potential side effects, here is the source code we used to make sure the function didn't break or compromise security in interesting ways." Data General was a pretty small company and yet they managed to find the resources to do this. I'm sure Microsoft or Intel would have no problem assembling a team that could do this. This would improve security of systems worldwide a lot more than some foolhardy attempt to prevent a set of applications from being developed.

that they outlawed Sony CDs there........