Hello world, the United States has announced new rules effectively banning sales of hacking
software and equipment to certain countries. A 65 page document filled with jargon, explains
the new changes, but will the new export rules make a real world difference to the numerous
human rights abuses perpetrated with hacking tools, or is this announcement merely a token
gesture meant to appease you and I in the wake of the drama surrounding NSO group’s
Pegasus spyware being used for nefarious means and the news of NSA hackers recently being
caught helping the UAE hack political activists?
Make your guess now, and at the end of the video leave a comment letting me know if you
were right. So, up till now it’s been perfectly legal to do business with authoritarian countries,
the law has taken a hell of a long time to catch up in particular because the US has
a large cyber industry and so it’s important America doesn’t damage it, whilst at the
same time implementing some meaningful restrictions on selling hacking tools to autocracies - as
such the new rules have been in the works for years.
The document published by the department of commerce uses the term “intrusion software”
to refer to hacking tools, and I’m afraid the whole thing is written in legal speak
jargon, so for my interpretation of the changes I’ve had to lean on other sources, which
I will of course link below.
The rules are patchy at best, I can’t understand how any of this will make a real world difference
in the slightest. Let's take one example: An American company would not be able to sell
“intrusion software” to a country under restrictions like Saudi Arabia (unless they
had an export license to do so, but licenses are typically hard to get, so we’ll put
that to one side) - but they could sell “intrusion software” to a non-government company within
Saudi Arabia if the software would only be used for defensive purposes like penetration
testing.
The problem being, there’s no way to ascertain if said software would only be used for defensive
purposes, because defensive software is for all intents and purposes “offensive software”
but only used to test the security of a company’s own network, as opposed to using it to test
the security of political activists, only to cut them up into little pieces, ALLEGEDLY.
And so, I don’t see why a country that really wanted its hands on certain software couldn’t
just create a fake company, a shell company if you will, and then buy the software through
that company and proceed to use it for nefarious purposes. That being said, there are two countries
which will require a license to export to, if a company wants to ship any “intrusion
software” to them for any reason, those two being China and Russia, no surprises there.
Another reason these new rules will likely have little impact is the fact that a lot
of “intrusion” tools are open source and freely available on github. There has even
been some talk that github may have to start geo blocking access to some repositories from
ip’s in certain countries. Because VPNs totally aren’t a thing.
Also, cybercrime gangs and even state backed hackers often use legitimate “intrusion
software” which has been leaked or cracked. The best example of this is cobalt strike.
It’s a legitimate pentesting toolkit used by white hats to audit networks. It’s developed
and sold by the American company helpsystems. However, over the past couple of years it’s
had its source code leaked and shared widely online. And because cobalt strike is actually
a solid piece of kit, it’s become an industry standard tool used by bad actors, even the
Russian GRU hacking team have been observed using it, as well as a North Korean cyberespionage
group. And so, whilst Cobalt strike may be a perfect example of where these new rules
would apply, it wouldn’t make a scrap of difference.
This is kind of reminiscent of the export restrictions on RSA encryption back in the
90s, back in 98 the US restricted the export of encryption of over 40 bits due to matters
of national security. At the time a lot of people felt this was kinda dumb, so they had
t-shirts made with the RSA encryption algorithm printed on it, in order to protest the restrictions.
These t-shirts were legally classed as munitions and couldn’t be exported or even shown to
foreigners.
The most prominent example in the present day of “intrusion software” being sold
for profit to authoritarian regimes is undoubtedly NSO group’s Pegasus spyware. I made a video
on it recently when the new leaks were published, I highly recommend you go watch that video,
the capabilities of the Pegasus spyware are legitimately scary and the allegations of
how the spyware has been used in human rights abuses is rather shocking. However, Pegasus
is developed and sold by an Israeli company, and so these new rules which come into force
3 months from now will have absolutely no effect on their business whatsoever.
There doesn’t seem to be much anger if at all, regarding any restrictions the new rules
will have on security researchers, the new restrictions seem to have been very carefully
written so as to not impede the activity of white hats.
This video is sponsored by roboForm. The easiest thing you can do to level up your security
is use a password manager. Roboform keeps your passwords encrypted until you need them
and notifies you if any of your passwords have been included in a data breach helping
you stay secure. Roboform is one of the og-est password managers, they’ve been around since
the 90’s - I also use them myself.
Use the link in the description to grab 30% off an annual subscription, bringing it to
just $16, and there’s a 30 day refund policy if you aren’t happy with roboform for any
reason.
If you enjoy this kind of video make sure to help me out by fondling the like button
for the youtube AI as well as turning on those sub notifications.
If you want to see what goes on behind the scenes make sure to follow me on the instagrams,
I’m @jhonti I will of course link it in the description.
And if you’re looking for something to watch next go check out my previous video on how
a cybercrime gang’s plot to trick ethical hackers into doing evil was exposed.
As always sources will be linked in the video description, stay tuned for more hacking videos,
and have a good one.