1
00:00:10,330 --> 00:00:11,010
Boo!

2
00:00:13,130 --> 00:00:20,610
Well, I'm Chuck Willis and as you can see on my presentation here, this talk is called Trends in Licensing of Security Tools.

3
00:00:20,910 --> 00:00:22,970
Sorry, I'm going to try to keep speaking into the mic.

4
00:00:23,190 --> 00:00:27,950
If you can't hear me or anything, just give me one of these or just say something.

5
00:00:27,970 --> 00:00:30,350
I want to make sure that you guys can hear what I'm saying.

6
00:00:30,350 --> 00:00:32,170
And I also want to hear what you're saying.

7
00:00:32,170 --> 00:00:45,870
This is meant to be an interactive presentation and in a way it's good we've got a small crowd here that we can uh maybe people will feel more free to talk a little bit about this because I I certainly don't intend to come up here and say that I have all the answers.

8
00:00:46,030 --> 00:01:00,830
It's really just more of a kind of uh my slides are going to try to provoke some thoughts from you all and give kind of what my thoughts on are as far as uh where licensing is going and security tools and and uh what might be some problems with that.

9
00:01:00,850 --> 00:01:04,470
So anyway, as I mentioned, I'm Chuck Willis.

10
00:01:04,470 --> 00:01:10,270
Um these slides are a little updated from what's on your uh CD so you can go to my website and download them if you want.

11
00:01:10,270 --> 00:01:13,110
There's nothing real substantial in the way of changes.

12
00:01:14,490 --> 00:01:18,430
And just uh in case you uh couldn't figure it out from the title.

13
00:01:18,450 --> 00:01:31,070
So what we're going to be doing is uh I I want to discuss uh the trends as far as the kind of the changes that I've seen in licensing of security tools and uh and also talk about how that affects the security community.

14
00:01:31,610 --> 00:01:36,070
And uh I also want to discuss you know how licensing could be improved if if necessary.

15
00:01:36,070 --> 00:01:39,750
I mean maybe maybe you all think there's not a problem with what's going on.

16
00:01:39,770 --> 00:01:56,010
And uh and also as kind of a kind of a secondary thing that you I expect that you know maybe some of you all will learn something about uh security tool licenses in that there's a lot of tools that I'm going to talk about that um you think are are free open source tools that that really aren't.

17
00:01:56,010 --> 00:01:58,330
And again this this is meant to be interactive.

18
00:01:58,330 --> 00:02:05,190
So I'm I'm going to ask a lot of questions and I hope that you all will will have some uh some thoughts and share share those with us.

19
00:02:06,490 --> 00:02:08,630
Uh just a few disclaimers here.

20
00:02:08,630 --> 00:02:13,150
Um I I am going to talk about specific tools that have uh restrictions in their licenses.

21
00:02:13,210 --> 00:02:19,930
And uh this is not meant to be like just ragging on these people or you know trying to talk bad about people.

22
00:02:19,930 --> 00:02:26,390
But I just think it makes the talk much more interesting if you've got concrete examples to talk about rather than a bunch of abstract stuff.

23
00:02:26,750 --> 00:02:33,190
Um and and and I do think that the authors of those tools have done a service to the community by releasing them under the license that they're under.

24
00:02:33,210 --> 00:02:40,390
I mean they could a lot of the tools that I'm going to mention could easily be you know strictly commercial tools that you have to spend thousands of dollars for.

25
00:02:40,530 --> 00:02:43,810
So certainly the authors are going to be commended for what they've done.

26
00:02:43,810 --> 00:02:49,230
And also I wouldn't be talking about the tool if I didn't think it was a useful tool that people uh people use.

27
00:02:49,230 --> 00:02:52,150
So I'm not going to be talking about real obscure stuff I don't think.

28
00:02:52,550 --> 00:02:56,830
And uh finally the licenses may have changed since I put these slides together.

29
00:02:56,830 --> 00:02:58,650
Uh licenses change all the time.

30
00:02:58,650 --> 00:03:03,930
So this is uh the this is a disclaimer there that stuff might have changed since I put this together.

31
00:03:04,270 --> 00:03:09,290
And the you need to go out and read the license if you're going to use these tools.

32
00:03:09,290 --> 00:03:11,930
You know this don't just rely on what I'm going to tell you.

33
00:03:13,130 --> 00:03:15,230
Okay so a little bit about me.

34
00:03:15,230 --> 00:03:18,490
Um I I work for a government contractor.

35
00:03:18,610 --> 00:03:27,730
Um I don't work for and yeah the reason I say that is I don't work for a consulting firm or software firm which is who releases most of the security tools as far as companies.

36
00:03:27,830 --> 00:03:31,850
And then a lot of security tools are released just by individuals that do it in their spare time.

37
00:03:32,390 --> 00:03:35,370
So I think I'm a a bit independent in that sense.

38
00:03:35,490 --> 00:03:37,270
Um I'm not a free software zealot.

39
00:03:37,270 --> 00:03:40,010
I'm not going to come up here and say that everything should be GPL.

40
00:03:40,250 --> 00:03:42,110
Um cause I don't I don't think that's the case.

41
00:03:42,110 --> 00:03:47,610
And I use commercial software along with open source software and all sorts of other software.

42
00:03:47,770 --> 00:03:50,650
And and again I'm not a lawyer this is not legal advice.

43
00:03:51,310 --> 00:03:55,470
So but I I do think I'm a pretty typical security tool user.

44
00:03:55,470 --> 00:04:10,810
I mean I I use a lot of tools in my work and also at home when I'm messing around with stuff and uh and I and I kind of wanted to illustrate this to show that uh you guys I think are typical security tool users as well but we're different from normal software users.

45
00:04:10,810 --> 00:04:13,710
You know I I use both Linux and Windows.

46
00:04:13,710 --> 00:04:20,030
I occasionally use other Unix variants but um you can't say that certainly about standard software.

47
00:04:20,030 --> 00:04:21,710
Most people just run Windows.

48
00:04:21,810 --> 00:04:24,490
Um and and also I'm not a full time programmer.

49
00:04:24,490 --> 00:04:29,890
So I don't necessarily have access to all the programming tools, Visual Studio and all that kind of stuff.

50
00:04:29,970 --> 00:04:36,970
And uh and also I'm I can I can tinker around with stuff but I'm not necessarily someone that wants to spend all day coding.

51
00:04:37,410 --> 00:04:39,290
But I but I compile tools.

52
00:04:39,290 --> 00:04:41,570
That's certainly uh something that we can all do.

53
00:04:41,570 --> 00:04:52,590
Uh we can debug compilation issues if you've ever had to import something from Linux to Windows under like the Cygwin um APIs or to BSD or something like that.

54
00:04:52,590 --> 00:04:55,130
I'm I'm sure that's something that's pretty typical for people here.

55
00:04:55,270 --> 00:04:58,670
Um and I I like to build little tools and scripts to automate things.

56
00:04:58,670 --> 00:05:00,690
I hate doing busy work you know.

57
00:05:00,690 --> 00:05:03,330
So I I like to be able to do that kind of stuff.

58
00:05:03,330 --> 00:05:13,550
And I also I modify tools that if I download a tool from the internet or from something that someone has posted to a mailing list um I'm gonna take it and start tweaking it if it's not doing exactly what I want.

59
00:05:14,490 --> 00:05:18,590
And I also like to share my tools and modifications with other people.

60
00:05:18,590 --> 00:05:22,310
So if I if I do something I think is cool I post it onto a mailing list.

61
00:05:22,670 --> 00:05:32,310
So anyway I I wanted to just mention that because again I think this kind of fits everyone that's here but it's definitely different than normal software users.

62
00:05:32,750 --> 00:05:41,890
So my motivation here was that uh I use a lot of security tools as I mentioned and and I actually read the licenses which maybe uh not everybody does.

63
00:05:41,890 --> 00:05:44,990
But uh I've actually been quite surprised by some of the stuff I've found.

64
00:05:44,990 --> 00:05:48,370
A lot of tools that I thought were open source really aren't.

65
00:05:48,370 --> 00:05:54,790
And a lot of tools that uh just have some very strange license restrictions that uh that kind of surprised me.

66
00:05:54,790 --> 00:06:00,970
And and over the years I've noticed some trends that you know it seems like more tools are going to more restrictive license.

67
00:06:01,290 --> 00:06:03,870
So I wanted to talk a little bit about that.

68
00:06:04,350 --> 00:06:06,330
So here's a quick example here.

69
00:06:06,830 --> 00:06:10,170
And uh so uh SensePost's WIC2 tool.

70
00:06:10,170 --> 00:06:12,770
It's a it's a Windows version of uh NIC2 kind of.

71
00:06:12,770 --> 00:06:15,790
It it's got some other features actually that it's built onto the NIC2.

72
00:06:15,790 --> 00:06:21,110
Uh it does some recursion and it's also uh connects in with the Google uh APIs and all that.

73
00:06:21,110 --> 00:06:23,570
So anyone here use that tool?

74
00:06:23,570 --> 00:06:24,530
Find it useful?

75
00:06:24,850 --> 00:06:25,270
Yes?

76
00:06:25,270 --> 00:06:25,830
No?

77
00:06:25,830 --> 00:06:26,330
Okay.

78
00:06:26,330 --> 00:06:26,910
Good.

79
00:06:26,990 --> 00:06:28,770
Um are any of the contributors here?

80
00:06:28,810 --> 00:06:30,630
I I definitely know they're here at the conference.

81
00:06:30,630 --> 00:06:32,770
I I sat in on SensePost's talk earlier.

82
00:06:32,770 --> 00:06:34,430
I don't see any of them in the room here.

83
00:06:34,430 --> 00:06:49,110
Well you're you're lucky they're not in the room because uh if you look at the license for WIC2 you'll see that it starts off with the the full GPL license and then it adds this extra restriction that basically if uh you find the software useful you're supposed to buy them a drink.

84
00:06:49,770 --> 00:06:54,630
So I expect you all to go out and find them after the session's over and make sure you live up to that.

85
00:06:55,730 --> 00:06:56,850
Excuse me?

86
00:06:58,210 --> 00:07:01,470
WIC2 it's a web it's a web uh application scanner.

87
00:07:01,470 --> 00:07:02,810
It's a web server scanner.

88
00:07:04,270 --> 00:07:12,070
So and just in case anyone was wondering I I don't think that's enforceable but I'm not a lawyer so you'll have to talk to your legal about that.

89
00:07:13,530 --> 00:07:20,810
Well it certainly is a violation of the GPL in the sense of well it's not a violation of the GPL but it's not the GPL.

90
00:07:20,810 --> 00:07:24,470
You you can't say that something is GPL and then add extra restrictions onto it.

91
00:07:24,470 --> 00:07:26,290
I don't think the real the two really match.

92
00:07:26,290 --> 00:07:31,090
But if you also if you notice the wording there it says you know it's kind of vague in the wording too.

93
00:07:31,090 --> 00:07:33,330
So it's to be honest it's probably a joke.

94
00:07:33,330 --> 00:07:35,530
So I don't think they actually expect anyone to do that.

95
00:07:35,530 --> 00:07:39,070
But it's just one of those little nuggets that you'll see sometimes in reading licenses.

96
00:07:40,230 --> 00:07:53,830
So the uh just a little bit about the scope that the main thing I'm interested in when I'm talking about these licenses is being able to use the tool for what I want to do and perhaps modify the tool and be able to you know send those modifications to other people.

97
00:07:53,830 --> 00:08:00,250
So in particular I'm not trying to take someone else's tool and build my own tool that I want to sell and make a million dollars for.

98
00:08:00,750 --> 00:08:02,950
That's much more difficult as far as licensing.

99
00:08:02,950 --> 00:08:05,570
Obviously GPL restricts that in a lot of ways.

100
00:08:06,410 --> 00:08:09,650
The BSD license or other licenses like that can allow that.

101
00:08:09,650 --> 00:08:12,070
But that's kind of a different issue for me.

102
00:08:12,570 --> 00:08:14,590
So that's what we're going to talk about.

103
00:08:14,590 --> 00:08:17,590
So let's start off with the trends that I've noticed.

104
00:08:17,590 --> 00:08:19,330
And there's quite a few of them here.

105
00:08:19,330 --> 00:08:22,150
But there's two kind of overwhelming ones that we start off with.

106
00:08:22,390 --> 00:08:28,210
And the first one is that there's a lot of great open source tools out there that that are under an OSI certified license.

107
00:08:28,230 --> 00:08:31,770
That would be usually the GPL or a BSD license.

108
00:08:31,990 --> 00:08:33,930
And uh y'all can read the list.

109
00:08:33,930 --> 00:08:36,770
I'm sure you've heard heard and heard about and used a lot of these tools.

110
00:08:36,770 --> 00:08:40,990
You know the Nmap and Ethereal and the Metasploit framework is written in Perl.

111
00:08:40,990 --> 00:08:44,650
Almost all tools that are written in Perl are released under Perl's license.

112
00:08:44,650 --> 00:08:48,390
The artistic license which is uh basically you know it's an open source license.

113
00:08:48,390 --> 00:08:49,470
OSI certified.

114
00:08:50,110 --> 00:08:54,330
Um so I think these people deserve a lot of credit for what they've done.

115
00:08:54,330 --> 00:09:01,710
And everyone who's written open source software contributed to open source software that uh they've done a lot of great service for the community here.

116
00:09:01,810 --> 00:09:08,630
And uh I just wanted to say this up front to make so that when I start talking about all the other tools later that doesn't sound like you know everything's a problem.

117
00:09:08,710 --> 00:09:12,890
Uh there's certainly a lot of great uh truly open source software out there.

118
00:09:14,210 --> 00:09:18,270
And but I do see that uh more security tools are strictly commercial.

119
00:09:18,270 --> 00:09:23,150
And when I say strictly commercial I say that basically if you want to use the tool you've got to pay money.

120
00:09:23,510 --> 00:09:29,910
Um they they may have some sort of free version that allows you to download it and try it out for 30 days or on a certain number of IP addresses or something.

121
00:09:30,010 --> 00:09:34,270
But for the most part it's a uh it's a commercial tool.

122
00:09:34,390 --> 00:09:40,830
And uh and unfortunately those commercial tools restrict many of the things that security tool security tool users want to do.

123
00:09:40,950 --> 00:09:46,230
And uh that's really one of the things we're going to talk about for this session is a lot of those restrictions.

124
00:09:46,630 --> 00:09:49,150
And uh so I guess I'll just kind of throw the question out there.

125
00:09:49,150 --> 00:09:52,670
Is is there a place for commercial security tools?

126
00:09:52,670 --> 00:09:53,850
Do you guys think yes?

127
00:09:53,850 --> 00:09:54,310
No?

128
00:09:54,310 --> 00:09:55,290
Shake your head.

129
00:09:56,510 --> 00:09:58,070
A lot a lot of blank stares.

130
00:09:58,070 --> 00:09:59,370
Well I I I do.

131
00:09:59,370 --> 00:10:03,310
I don't like I said I'm not an open uh free software uh zealot.

132
00:10:03,310 --> 00:10:08,130
I think that there's a place for commercial security tools especially when there's not an open source equivalent.

133
00:10:08,190 --> 00:10:11,970
If if people are willing to pay money for it then then that makes sense.

134
00:10:12,050 --> 00:10:19,550
But um my other question would be should commercial security tools be licensed differently from other software?

135
00:10:20,470 --> 00:10:21,950
Yes or no?

136
00:10:22,150 --> 00:10:23,730
Again more blank stares.

137
00:10:23,730 --> 00:10:25,190
And I I think definitely yes.

138
00:10:25,190 --> 00:10:32,990
I think commercial commercial security tool users are much different than other tool users or other software users.

139
00:10:32,990 --> 00:10:36,770
So I think that the license can allow the kind of things that we want to do.

140
00:10:36,770 --> 00:10:42,510
And some tools do have pretty um pretty uh how do you say less restrictive licenses.

141
00:10:42,510 --> 00:10:46,310
Um IDA pro for example allows you to reverse engineer it.

142
00:10:46,430 --> 00:10:49,230
Which is kind of funny because it's a reverse engineering tool.

143
00:10:49,230 --> 00:10:54,890
But I guess they kind of saw that that was kind of a of something that a lot of commercial software doesn't allow you to do.

144
00:10:54,890 --> 00:11:02,770
And uh and also if you look at uh some of the vulnerability uh penetration testing tools like uh core impact or canvas.

145
00:11:02,770 --> 00:11:07,750
That those are commercial software that you have to pay for but they come with all the source code.

146
00:11:07,750 --> 00:11:10,650
So you can go ahead and modify the tool if you want to.

147
00:11:10,650 --> 00:11:14,550
Which is a which is a nice thing and it's certainly something that security tool users want to do.

148
00:11:16,010 --> 00:11:22,870
And uh the other kind of overarching uh theme that I've seen is that a lot of tools are released with what I call a custom license.

149
00:11:22,870 --> 00:11:27,030
Which is basically somewhere between commercial and open source.

150
00:11:27,030 --> 00:11:30,290
So there's a it permits some uses without cost.

151
00:11:30,290 --> 00:11:36,930
Usually it means that if it's uh you know for personal use or for non-commercial use it'll say you can use it.

152
00:11:37,390 --> 00:11:41,850
Um but it it usually requires either payment or something like that for something else.

153
00:11:41,850 --> 00:11:45,930
And it restricts some of the other things that we want to do uh that we'll get into later.

154
00:11:46,350 --> 00:11:52,570
And that's really what I'll talk about for the rest of this session is is those restrictions and uh and tools that have them.

155
00:11:53,010 --> 00:12:02,070
And and just as kind of an aside many of these tools that are kind of somewhere between open source and commercial are released by companies and not individuals.

156
00:12:02,070 --> 00:12:12,710
And that's because um the companies have have put money into developing this tool and they want to use it either they're gonna sell it to people or they want people to know that it came from them.

157
00:12:12,710 --> 00:12:16,930
That they don't want other people releasing uh modified versions of the tool and that sort of thing.

158
00:12:17,050 --> 00:12:17,790
Yes?

159
00:12:19,450 --> 00:12:21,010
A bait and lure?

160
00:12:21,390 --> 00:12:23,350
Um how how do you mean that?

161
00:12:28,340 --> 00:12:38,920
Oh certainly uh some some tools are like that uh uh like uh they'll have a uh a more restricted version that uh maybe only works for up to a certain number of IP addresses or whatever.

162
00:12:38,920 --> 00:12:47,500
And even even if you look at something like Nessus which I'll get into more a little later um Nessus is a great vulnerability scanner but it doesn't necessarily scale real well.

163
00:12:47,500 --> 00:13:00,220
And one of the things that Tenable the company that uh that is pretty much in charge of Nessus now that they uh they have some like web interfaces and other consoles that they'll sell you that uh allow you to manage uh Nessus scanners.

164
00:13:00,280 --> 00:13:15,880
So yeah certainly it is part of it that it's it's really marketing is what it comes down to to a large extent that a lot of these companies the consulting type companies you know they release free tools because they want to draw people to their website and uh and be able to then sell them consulting services and software and all that sort of stuff.

165
00:13:18,280 --> 00:13:27,020
Okay so now let's get a little bit more into the specifics uh and and the first one is just basically that that you sometimes you have to pay to use these tools.

166
00:13:27,200 --> 00:13:34,740
And uh and usually these are tools like I said that can be used for free in some situations and then uh in other situations you've got to pay.

167
00:13:35,200 --> 00:13:48,620
And uh sometimes they the license will say that the tool is for like personal use or non commercial use but there's it doesn't say anything about if you want to use it commercially how to buy it or how much it costs and there's no information on their website or anything.

168
00:13:48,620 --> 00:14:00,700
And that is very confusing for users that it kind of to me it's like if you're gonna charge if you want to charge money or you don't want people to use your software for commercial use you should make it easy for them to stay within the law.

169
00:14:00,700 --> 00:14:03,880
You should make it easy for them to buy the software if they want to buy it.

170
00:14:03,940 --> 00:14:05,880
And uh so that's kind of confusing.

171
00:14:06,120 --> 00:14:10,560
And also uh here's some examples of that and uh you can read through those.

172
00:14:10,560 --> 00:14:15,980
Um THC's are you there and is a is a tool that requires uh permission.

173
00:14:15,980 --> 00:14:18,820
It doesn't you you don't have to pay for it but it does require permission.

174
00:14:18,820 --> 00:14:30,020
And I lump payment and permission together because I kind of think that if you require permission for people to use it for commercial use then you're kind of leading up to maybe you're gonna start charging for it later.

175
00:14:30,280 --> 00:14:34,040
And uh and it really comes down to the same the same issues.

176
00:14:34,220 --> 00:14:40,040
Um Foundstone's free tools are that way that they their license says it's for personal and non-commercial use.

177
00:14:40,340 --> 00:14:43,700
Um but it doesn't say anything about how to purchase it for commercial use.

178
00:14:43,760 --> 00:14:54,880
Um the registered plugins for Nessus and also the VRT certified rules for Snort are uh are that way as well that you you need to register in order to be able to download these.

179
00:14:54,920 --> 00:15:04,580
Uh both of them use very similar business models in that they uh um the rules will be about 5 days out of date um if you're gonna use the uh free of cost version.

180
00:15:05,060 --> 00:15:10,220
Um and then if you wanna pay you know I think it's for Nessus it's like uh $1200 a year.

181
00:15:10,220 --> 00:15:17,240
I don't know for Snort how much it costs to buy the uh immediate download so that you know as soon as a new rule comes out you can get it.

182
00:15:17,500 --> 00:15:25,600
Um and then another tool is HTTP print which uh is just a little neat little web uh server fingerprinting tool.

183
00:15:26,220 --> 00:15:29,700
So anyway any questions there?

184
00:15:29,700 --> 00:15:37,120
Any other thoughts as far as other tools that are kinda in this vein or um people think this is a big problem or not?

185
00:15:37,120 --> 00:15:37,920
I don't know.

186
00:15:38,640 --> 00:15:39,960
Yeah go ahead.

187
00:16:09,220 --> 00:16:25,960
Yeah the just for people who didn't hear that basically the idea I think what you're saying is that uh basically violating the license of these tools that if it says it's only for non commercial use and you use it commercially that's the same as you know downloading you know Windows from the internet you know on BitTorrent or whatever.

188
00:16:25,960 --> 00:16:29,660
It's it's it's piracy and the BSA can come after you for it.

189
00:16:37,050 --> 00:16:46,170
Right exactly and that and that kinda illustrates why I put this whole thing together is that you know in my job I was downloading a lot of tools and I wanted to make sure that we were following the license.

190
00:16:46,170 --> 00:16:55,450
I didn't want to get my employer or our our customers in trouble so um yeah it's definitely one of those things that you need to be paying attention to the licenses of the tools that you're using.

191
00:16:57,790 --> 00:17:08,150
Okay uh another another feature that I've seen in a lot of licenses is that more more of them are restricting redistribution and uh basically that means that you can only get the tool from the author.

192
00:17:08,150 --> 00:17:10,770
That you know you can only download the tool from their website.

193
00:17:10,870 --> 00:17:13,910
Which is fine I guess until the the author disappears.

194
00:17:13,910 --> 00:17:30,610
You know if it's a company and it you know goes bankrupt or if the author unfortunately dies or decides he doesn't want to deal with it anymore it it makes it difficult that you know maybe a friend of yours has a copy of the tool but then you you the license says you can't redistribute it so it's one of those things that's uh it's it's kind of a gray area.

195
00:17:30,610 --> 00:17:39,710
It'd be it'd be nice if people would put in their license that you know if you're gonna restrict redistribution you know allow it if the case is that uh people can't find it from you anymore.

196
00:17:40,010 --> 00:17:43,130
And just some examples of those as far as tools that you might have used.

197
00:17:43,130 --> 00:17:49,250
Uh the Sysinternals tools are uh a lot of like little windows tools that uh will show you processes that are running in that.

198
00:17:49,250 --> 00:17:51,010
People use them in incident response.

199
00:17:51,010 --> 00:17:53,950
Um Net Stumbler actually restricts redistribution.

200
00:17:54,150 --> 00:17:59,470
Um and then again the Foundstone tools uh and Nessus and Snart plugins.

201
00:18:00,490 --> 00:18:09,850
So that's the next uh next thing that I've seen a lot of is uh tools that restrict or prohibit uh modification and reverse engineering.

202
00:18:10,050 --> 00:18:17,210
And uh that's really it's it's a problem because this is it it prevents us from being able to fix the tool.

203
00:18:17,210 --> 00:18:23,090
That you know even especially if the tools like uh Nessus the Nessus plugins restrict uh modification.

204
00:18:23,610 --> 00:18:25,850
But it's it's just a script.

205
00:18:25,850 --> 00:18:27,570
You know you've got the source code right there.

206
00:18:27,570 --> 00:18:31,890
You could easily go in there and fix things if you wanted to but the license doesn't allow you to.

207
00:18:32,270 --> 00:18:35,050
And uh and that's some other examples of that.

208
00:18:35,050 --> 00:18:39,110
Uh Kane Enable and also the Foundstone tools again and and Net Stumbler.

209
00:18:39,210 --> 00:18:46,890
Um this is like you can see mostly an issue with uh with Windows tools that you know if you don't have the source code it makes it difficult.

210
00:18:47,070 --> 00:18:50,070
But some of them like I said Nessus uh it is still an issue.

211
00:18:51,230 --> 00:18:55,370
And that's kind of the next issue is that a lot of tools don't come with the source code.

212
00:18:55,370 --> 00:18:59,030
So if you don't have the source code it makes it very difficult to make any changes.

213
00:18:59,270 --> 00:19:04,470
And uh well it's so strictly it's not a license issue in the sense of it's not in the license.

214
00:19:04,470 --> 00:19:10,310
But usually these tools that don't come with source code also have a license that restrict redistribute or restrict modification.

215
00:19:10,310 --> 00:19:12,210
So it's pretty much the same issue again.

216
00:19:12,550 --> 00:19:17,590
And and without the source code it's it's very difficult to make modifications to the tool and improve the tool.

217
00:19:17,590 --> 00:19:18,790
Try to fix them ourselves.

218
00:19:18,850 --> 00:19:27,050
You know a lot of times if you're using a tool on a client site and and something's being buggy or you're seeing that the output is weird and you want to be able to try to fix it.

219
00:19:27,050 --> 00:19:30,290
You know you can't do that if you don't have the source code.

220
00:19:31,150 --> 00:19:34,690
And uh and also the source code is valuable just for learning purposes.

221
00:19:34,690 --> 00:19:46,510
That if you want to learn how this tool is working and how you know what kind of protocols it's using especially if it's some sort of a like a vulnerability scanner or a a pen testing tool you want to know well what you know how is it connecting to the remote system?

222
00:19:46,510 --> 00:19:48,690
What exactly responses are we getting back?

223
00:19:48,690 --> 00:19:51,630
Maybe try to weed out some false positives and that sort of thing.

224
00:19:51,630 --> 00:19:56,270
Well that's that's very difficult if you don't have the source code to know you know what the thing is uh is doing.

225
00:19:56,530 --> 00:20:00,570
And and obviously source code is also necessary if you want to port it to another platform.

226
00:20:00,570 --> 00:20:12,190
So if you've got a a Windows tool that's running a you know standard C++ compiled program then well you've gotta want to port that over to Linux and that's not really not possible without the source code.

227
00:20:12,430 --> 00:20:23,350
And uh even even in some supposedly portable languages like Java and dot net um there you'll a lot of times run into little issues between platforms that you need the source code in order to kind of convert things.

228
00:20:23,350 --> 00:20:35,470
Especially if the original programmer didn't consider porting that you know maybe they're using some Windows specific APIs that aren't available in the dot net framework for uh for Linux and uh OS 10 and that sort of thing.

229
00:20:36,510 --> 00:20:40,830
And again this is mostly Windows tools although occasionally you'll see it on other tools.

230
00:20:40,890 --> 00:20:44,790
Um I don't use Macs but probably Mac tools uh have some of that as well.

231
00:20:45,590 --> 00:20:52,330
And here's a bunch of examples um and some of them some of them I'm not sure if it was intentional that they didn't include the source code.

232
00:20:52,330 --> 00:21:00,310
Some of them you may be able to email the author and get it from them um but these are just the ones that I saw that weren't you know readily available on their website.

233
00:21:00,510 --> 00:21:05,910
And uh some of the new ones here you know Achilles well Achilles is an old tool but we haven't talked about it yet.

234
00:21:05,910 --> 00:21:09,510
Um Brutus, uh Sam Spade and uh Odysseus.

235
00:21:09,510 --> 00:21:13,610
Um Achilles and Odysseus are web uh proxies.

236
00:21:17,080 --> 00:21:24,380
And there's actually a couple tools uh fortunately only two so far that require uh credit in the consulting reports.

237
00:21:24,380 --> 00:21:32,740
So if you use THC AMAP or THC Hydra as part of a penetration test or other sort of commercial uh consulting you know assessment that you're doing.

238
00:21:32,920 --> 00:21:38,680
There's actually a a clause in the license that you have to give them credit in the consulting report.

239
00:21:39,260 --> 00:21:42,540
Um I don't know how many people actually do that or not.

240
00:21:42,540 --> 00:22:01,220
I don't know if uh I'm I'm I'm glad like I said that only a couple tools are doing this so far because if it becomes real common it could be real troublesome to try to remember well which tools did I use in this consulting and you know trying to get all the credits in there and making sure the customer doesn't get kind of confused as to why you've got all this stuff in your report.

241
00:22:02,640 --> 00:22:04,780
So is that new to anybody?

242
00:22:04,780 --> 00:22:08,000
I mean is do any anybody use that tool that didn't know about that?

243
00:22:08,960 --> 00:22:10,840
No one wants to admit it anyway.

244
00:22:12,300 --> 00:22:24,560
Okay well another another issue I've run into is that sometimes tools have a lot of these restrictions in their license but then they kind of will tell you in mailing lists or or other places that well don't worry about it you know.

245
00:22:24,560 --> 00:22:26,540
We really didn't mean that I guess.

246
00:22:26,900 --> 00:22:29,440
Um and that's a little bit confusing.

247
00:22:29,440 --> 00:22:34,220
So sometimes uh in these couple examples the website is different from what comes with the tool.

248
00:22:34,220 --> 00:22:41,520
So you download the tool and inside the tarball or inside the zip file is a license that's different than what you see on the website when you download the tool.

249
00:22:42,080 --> 00:22:45,200
Um one example is you know THC Hydra and AMAP.

250
00:22:45,200 --> 00:22:52,700
The license is only slightly different but there's a little difference in the I think it's actually in the clause that I just showed you that the the credit is different.

251
00:22:52,700 --> 00:23:02,240
That I think one of the licenses it says you have to include the tool name, version, and authors and in the other one it says you only have to include the name and the version or something like that.

252
00:23:03,580 --> 00:23:10,060
And uh another more significant one is uh Foundstone recently released a tool called uh WS Digger.

253
00:23:10,060 --> 00:23:14,520
I believe it's a web services scanning tool um but don't quote me on that.

254
00:23:14,600 --> 00:23:19,780
Um the license on the website is the standard Foundstone license which we've been talking about which is very restrictive.

255
00:23:19,780 --> 00:23:21,420
You know personal and non-commercial use only.

256
00:23:21,420 --> 00:23:22,360
No reverse engineering.

257
00:23:22,360 --> 00:23:23,280
All that other stuff.

258
00:23:23,280 --> 00:23:32,420
But when you download the tool inside the tool distribution is the Apache 2.0 license which is an open source license which allows you to do all those things that we want to do.

259
00:23:32,440 --> 00:23:35,060
So which license are you supposed to follow?

260
00:23:35,300 --> 00:23:36,220
I don't know.

261
00:23:36,220 --> 00:23:43,720
But from what I've seen on the when they announce the tool that it's meant to be under the Apache license there's just uh some sort of miscommunication on their website.

262
00:23:45,140 --> 00:23:53,000
Um another example is that uh sometimes the author like I said on a mailing list or something will will contradict the tool's license.

263
00:23:53,000 --> 00:24:04,940
So when you have a a Foundstone's Hack Me Bank and their Hack Me Books tools um are great great tools to learn about uh web web applications and do some pen testing against them in a lab environment and all that.

264
00:24:05,180 --> 00:24:08,820
And but again the license says that they're personal and non-commercial use.

265
00:24:08,820 --> 00:24:16,680
So I emailed them because I wanted to set it up on our internal network at my company and uh they said oh yeah no problem to use it on an internal lab.

266
00:24:16,680 --> 00:24:25,020
You know that they they didn't want other people going out and you know teaching classes which is part of you know how they make money using these tools because they put a lot of work into them.

267
00:24:25,020 --> 00:24:28,320
But they don't mind you using them you know at work personally.

268
00:24:28,660 --> 00:24:37,460
And that that's something we'll uh another issue that I've seen is that you know a lot of times people say personal use or non-commercial use but they don't define that.

269
00:24:37,720 --> 00:24:40,420
And and different different companies have different definitions.

270
00:24:40,780 --> 00:24:48,580
Um I know it's not a security tool but uh Google Toolbar um it defines personal use as if you download it yourself it's okay.

271
00:24:48,580 --> 00:24:56,300
So I can use Google Toolbar at work as long as I install it myself but my system administrator can't install it on every single machine.

272
00:24:56,900 --> 00:25:04,680
Um I don't know it's just it's one of those things that it's different companies have different definitions so if you're not defining it then it's hard to hard to enforce it.

273
00:25:05,420 --> 00:25:11,300
And then another example is the the the ton of the uh the registered plugins for Nessus.

274
00:25:11,300 --> 00:25:12,300
Yes go ahead.

275
00:25:43,340 --> 00:25:44,300
Right.

276
00:25:44,540 --> 00:25:47,380
Right yeah that's a that's a good point for if you guys didn't hear.

277
00:25:47,380 --> 00:25:54,560
He basically said that if like the Foundstone tools that they were written by people at Foundstone but Foundstone owns the copyright.

278
00:25:54,560 --> 00:25:57,860
They're the copyright holder for those tools so they decide the license.

279
00:25:58,060 --> 00:26:04,540
And the authors of those tools don't necessarily have the authority from their employer to waive that license or change the license.

280
00:26:04,540 --> 00:26:06,480
So you need to be aware of that.

281
00:26:06,540 --> 00:26:10,840
Um as far as who who actually owns the tool and are you actually getting permission from the right people.

282
00:26:11,880 --> 00:26:22,780
Um the registered plugins for Nessus is another tool that's uh a little strange because the license is very restrictive it doesn't allow you to change the plugins or um reverse engineer the plugins.

283
00:26:22,780 --> 00:26:27,340
Which is a bit a bit strange because uh there's some problems with their plugins.

284
00:26:27,340 --> 00:26:32,040
You know they they always have problems with false positives or typos and descriptions and that.

285
00:26:32,040 --> 00:26:35,060
And nothing bad it's just they've got six thousand of the things.

286
00:26:35,080 --> 00:26:37,860
So there's inevitably there's going to be problems that show up.

287
00:26:37,860 --> 00:26:44,380
And they've also they frequently have problems with versions of of uh of services that they're scanning.

288
00:26:44,380 --> 00:26:49,920
That you know that when a new version comes out they're going to give you back uh something strange that it's not expecting.

289
00:26:50,040 --> 00:26:55,020
So anyway the the license prevents you from making those changes yourself or distributing them.

290
00:26:55,240 --> 00:27:09,020
Uh but on the mailing lists the the owner of Tenables which I think is authorized to make this statement said oh yeah no problem you know you can you can make changes to the plugins and you can post it back to the the Nessus mailing list so that other people can see them.

291
00:27:09,480 --> 00:27:12,900
So that's another one of those things where it's like well who do you really follow?

292
00:27:12,900 --> 00:27:23,020
I mean I would guess that you know if if they've said that publicly and and I know people have done that and no one's gotten sued so it's probably okay but it's just a little confusing for the users that they really should straighten that out.

293
00:27:24,240 --> 00:27:43,300
And the other really big issue that I've seen is a lot of tools just don't have a license that they are you know you just can't find it and and maybe the the it's uh I don't know there there may be you know some of these there that I'm going to mention maybe the tools and maybe the license is in the tool distribution it's just hard to find.

294
00:27:43,300 --> 00:28:07,040
I have seen ones where the binary that gets compiled or is distributed doesn't have any license at all associated with it but if you look at like the comments in the uh source code files it'll say you know this tool is under the GPL or this tool is under whatever license um which is really not sufficient you're supposed to include the the full GPL in there rather than just saying uh it's supposed to be G excuse me it's supposed to be under the GPL.

295
00:28:07,740 --> 00:28:21,940
Uh and and sometimes the tool's just not present at all you know you just can't find it and uh and this is also a big problem if you can't figure out who the author was if you know the maybe you've got an email address that doesn't work anymore or something like that so then it's kind of like who knows.

296
00:28:22,480 --> 00:28:41,060
And then the other thing is that a lot of times there if there is a license it might be there but it's pretty incomplete that it just basically says something real simple like oh use it for whatever you want or something like that well that isn't really a full license in the sense of it doesn't talk about all the different things that we want to be able to do with tools and give us permission for it.

297
00:28:41,300 --> 00:28:49,220
Again I'm not a lawyer but my understanding of copyright law is that pretty much if the license doesn't say you can do it then you're not supposed to do it.

298
00:28:51,580 --> 00:29:09,920
And and a lot of times this is uh this is a problem with small exploits and scripts and stuff that are posted to uh I call them online forums here just to include everything but mailing lists news groups you know if you look at uh full disclosure or bug track mailing lists hardly any of the exploits that are posted there have any sort of license associated with them.

299
00:29:10,240 --> 00:29:25,680
And uh again it'd be it'd be nice if uh if we could say well if you post something in a in a forum like that and don't include a license it's uh it was meant to be you know in the public domain or something like that but I don't think that's the way the law works but again I'm not a lawyer.

300
00:29:26,180 --> 00:29:33,140
Um here's just some examples here um a bind view's a noom tool I wasn't able to find a license for it.

301
00:29:33,720 --> 00:29:37,760
Um hobbit's original netcat uh there was no license associated with that.

302
00:29:37,760 --> 00:29:50,440
Uh john the ripper um I I think what happened was solar designer the guy who wrote the tool um incorporated some other code that he wasn't sure about the license into the tool so that's why there's no license cause he he doesn't even know what the license is.

303
00:29:50,880 --> 00:30:03,080
But um he has said that the next version 1.7 is going to be released under the GPL um but I have no idea when that's going to happen I mean 1.6 has been out forever so I don't I don't know when that's going to happen.

304
00:30:03,240 --> 00:30:09,820
Um and some other tools that I saw on sequel security dot com has a lot of sequel tools that uh I didn't see any license for.

305
00:30:10,540 --> 00:30:12,960
And some other ones that we've already talked about.

306
00:30:15,620 --> 00:30:18,460
So okay where where are we at in time?

307
00:30:18,460 --> 00:30:20,180
Okay we're we're in good shape.

308
00:30:20,280 --> 00:30:22,960
So do you guys agree that this exists?

309
00:30:22,960 --> 00:30:28,280
You know I've talked a lot about you know I think more tools are going to this kind of um more restrictive licenses.

310
00:30:28,280 --> 00:30:29,360
Do you guys agree?

311
00:30:29,440 --> 00:30:30,320
Disagree?

312
00:30:30,480 --> 00:30:32,760
Um what's what's your thoughts?

313
00:30:37,540 --> 00:30:38,740
Yeah go ahead.

314
00:30:49,870 --> 00:31:06,370
Right the the comment was that a lot of tools seem to be uh that they're it's almost like the bait bait and uh bait and hook method that someone else mentioned that they they have like free tools to kind of hook you in and then they uh try to get you to to pay for uh other tools or a more expanded version or something like that.

315
00:31:06,370 --> 00:31:13,890
And definitely that's that's been the case in software for a long time but in security tools it's I think it's more of a recent trend you know.

316
00:31:14,630 --> 00:31:15,730
Yes go ahead.

317
00:31:52,340 --> 00:31:52,880
Yeah.

318
00:32:04,820 --> 00:32:07,220
Yes I I think that's definitely true.

319
00:32:07,220 --> 00:32:17,240
Um just to repeat for people who may not have heard is that the authors of the tools a lot of times will will will either clarify the license if it's not there or they'll give you the source code.

320
00:32:17,280 --> 00:32:22,300
They're you know usually if you can get a hold of them they're they're pretty nice about it and they like to hear that people are using the tools.

321
00:32:22,300 --> 00:32:31,600
And definitely that's that's one of my recommendations uh that we'll get to later on is you know yeah work work with those people to see what the uh what the license is if it's not uh if it's not clear.

322
00:32:31,980 --> 00:32:34,220
But uh yeah I I agree.

323
00:32:35,080 --> 00:32:36,140
Yeah go ahead.

324
00:32:44,110 --> 00:32:45,870
I I am not a lawyer.

325
00:32:45,870 --> 00:32:46,790
I don't know.

326
00:32:47,310 --> 00:32:59,670
I I would say no just off hand that you know again if someone posts something to full disclosure or bug track with no license attached I'm assuming he means people can use it for something at least.

327
00:32:59,850 --> 00:33:01,670
But I don't know.

328
00:33:05,960 --> 00:33:07,180
I don't know.

329
00:33:07,280 --> 00:33:09,760
And that well that's actually something we'll get into in a little bit.

330
00:33:09,760 --> 00:33:11,260
But what what's your thoughts?

331
00:33:51,180 --> 00:33:52,980
Yeah that's that's a good point.

332
00:33:52,980 --> 00:34:08,040
Just real quick summary was that you know that there there may be an implied license there that if someone has released a tool where anyone in the world can get to it either on a mailing list or a website that you could make the argument that they intended for people to be able to use it for for things.

333
00:34:08,080 --> 00:34:12,420
Again talk to your lawyer and it made it probably depends a lot on what country you're in.

334
00:34:23,810 --> 00:34:36,610
Again I'm not a lawyer but my my understanding is that a license is similar to a contract and just because you and I sign a contract doesn't necessarily mean that everything is enforceable.

335
00:34:37,610 --> 00:34:44,610
And I don't know all the exact caveats but I know for instance I can't sign a contract saying that I'll be your slave for the rest of my life.

336
00:34:44,610 --> 00:34:47,030
That that is not a legally enforceable contract.

337
00:34:47,310 --> 00:34:49,810
So anyway.

338
00:34:50,250 --> 00:34:52,710
Um let me move on to another question.

339
00:34:52,710 --> 00:34:57,750
So and I think we kind of covered this but I'll ask it more specifically is is there a problem with this?

340
00:34:57,750 --> 00:35:04,750
And we have certainly identified a problem of you know if stuff doesn't have a license and it's kind of in in limbo that it'd be good to have some clarification there .

341
00:35:04,750 --> 00:35:19,130
But um with reference to the other trends that we've seen as far as more more tools requiring uh payments and uh permission for uses and all that is it does that is that a problem for the security security community?

342
00:35:20,110 --> 00:35:20,850
Yes?

343
00:35:20,850 --> 00:35:21,710
No?

344
00:35:24,500 --> 00:35:26,140
Yeah go ahead.

345
00:36:01,580 --> 00:36:23,020
Yeah that's that's a good point and uh but quickly a summary of it was that uh yeah that some some tools out there even security tools that are restricting reverse engineering and cryptanalysis of them that really causes a problem for us that want to be able to evaluate these tools and decide are they good or bad uh to deploy into our companies or to recommend to our customers and and that sort of thing.

346
00:36:23,020 --> 00:36:24,920
So that that certainly is a problem.

347
00:36:26,880 --> 00:36:32,960
Okay uh next question was uh well what what can we do to improve security tool licensing?

348
00:36:33,620 --> 00:36:38,740
I've got my own thoughts that uh that I'll talk about in a little bit but I just want to hear what you guys have to say.

349
00:36:39,240 --> 00:36:40,600
Anyone got any suggestions?

350
00:36:40,600 --> 00:36:41,400
Yeah go ahead.

351
00:36:44,040 --> 00:36:45,540
Make a new license.

352
00:36:47,380 --> 00:36:59,320
Yeah well and and that was that's that's definitely one of my points uh that I'll talk about later is that yeah if you it would be great if people want an open source product make it an OSI approved license.

353
00:36:59,320 --> 00:37:04,620
Don't make up your own license because it'll run into a lot of these problems and it makes it confusing for the users.

354
00:37:04,640 --> 00:37:20,740
That yeah it's it's hard especially because of the nature of security tool work that we end up using a lot of little tools to do our work and it's very it's it's a pain to be able to try to keep track of the licenses of all these tools and make sure that we're not you know doing something that we're not supposed to be doing.

355
00:37:22,080 --> 00:37:24,240
Any other suggestions before uh mine?

356
00:37:24,240 --> 00:37:25,020
Yeah go ahead.

357
00:37:53,460 --> 00:37:55,940
Yes that's that's definitely a good point.

358
00:37:55,960 --> 00:38:09,420
Uh the the point was that if you're buying a security product or even if you're using it for free it it but mostly if you're buying it is you know talk to the authors or whoever tried to sell this to you and and tell them you don't like the license.

359
00:38:09,420 --> 00:38:10,820
Tell them that you want a different license.

360
00:38:10,880 --> 00:38:25,700
Especially for as much money as we pay for a lot of security products that uh it's amazing that the the kind of restrictions that they want to put on what we can do and the fact that people just accept them you know and just kind of treat it like any other piece of software that they're gonna well we just gotta live with it.

361
00:38:25,700 --> 00:38:42,180
Well no you don't have to live with it especially a lot of these smaller companies that are selling these things that you know they they want your business and they're willing to make concessions and especially if they um can understand that what they're trying to restrict is really not um it's it's it's restricting what we want to do with the tools.

362
00:38:42,400 --> 00:38:46,860
And and it really comes down to I think don't treat your users like criminals you know.

363
00:38:46,860 --> 00:38:55,180
If you're you're not giving them source code and you're preventing them from reverse engineering the tool well you're you're kind of assuming that oh they want to do something bad to us.

364
00:38:55,180 --> 00:39:01,700
Well no we just want to be able to use the tool is what it comes down to and being able to use it in the most efficient way that we know how.

365
00:39:02,980 --> 00:39:04,980
Okay I got ten minutes left.

366
00:39:05,520 --> 00:39:08,180
Okay any any other suggestions?

367
00:39:10,220 --> 00:39:18,160
Okay I'll I'll run through what I have on here and it's it's really just kind of my own you know thoughts feel free to disagree or or uh what not.

368
00:39:18,760 --> 00:39:21,960
Um few few issues for uh tool users.

369
00:39:22,640 --> 00:39:28,280
Well obviously read and follow the licenses you know you you can't just ignore ignore the issue.

370
00:39:28,460 --> 00:39:36,140
And if you don't like the if you don't like the license don't use the tool or at least go back to the author and say hey can we get this changed.

371
00:39:36,300 --> 00:39:39,700
But don't just ignore it and kind of go on and do whatever you want.

372
00:39:39,700 --> 00:39:51,340
And I'd also say uh I call it legal trickery but just be don't use the uh don't follow the letter of the license while violating the spirit of the license.

373
00:39:51,340 --> 00:39:57,840
And and a lot of that comes down to to uh you know how you define you know commercial use and that kind of thing.

374
00:39:57,940 --> 00:40:01,780
You know if if you don't don't get into that it would be my recommendation.

375
00:40:03,200 --> 00:40:17,460
And uh again work with the writer the tool writers to clarify if there's a problem and and the key there is politely because tool tool writers uh have a lot of times you know especially if they're writing it on their own you know they're they're not getting paid to do it.

376
00:40:17,460 --> 00:40:26,500
They have a lot of people emailing them with bugs and stuff like that and you know you don't want to make demands of them but just talk to them and usually they'll be pretty uh accommodating.

377
00:40:27,300 --> 00:40:33,860
And and also encourage them to remove the license restrictions which is uh good for everybody.

378
00:40:33,860 --> 00:40:47,080
And and also if you if you make changes to a tool um whether it be an open source tool or any other tool you know share the changes you know allow all of us to work together on these things so that everyone's not out you know reproducing the same you know events.

379
00:40:48,780 --> 00:40:55,680
Okay well tool writers well you just obviously you need to follow the license for any software that you're incorporating into your tool.

380
00:40:55,720 --> 00:41:02,720
Um in particular you know if you've got like GPL software or something you can't just cut cut and paste that into a commercial product.

381
00:41:02,920 --> 00:41:06,240
Um choose choose a license and include it with every tool.

382
00:41:06,520 --> 00:41:08,500
That's uh kind of self explanatory.

383
00:41:08,500 --> 00:41:13,060
And and remember you know if the copyright holder can add another license at any time.

384
00:41:13,060 --> 00:41:18,680
So just because I released a tool under the GPL today doesn't mean that every version of that tool is always going to be GPL.

385
00:41:18,680 --> 00:41:22,600
I can release the next version of it under a completely different license.

386
00:41:23,060 --> 00:41:25,980
That's that's not a problem because I own I own the work.

387
00:41:26,540 --> 00:41:34,040
And if your employer holds the copyright then encourage them to use a less restrictive license or just a standard open source license.

388
00:41:34,040 --> 00:41:49,540
That that can go a long way to just you know telling your boss you know hey this is what we want to what users are going to want to be able to do with this tool and we think it'll be helpful in the long run because especially if the company is trying to release the tool as you know marketing and and being able to draw people to their site.

389
00:41:49,700 --> 00:41:52,760
Well more people that use the tool the better it is for them.

390
00:41:55,020 --> 00:42:02,580
Um just a quick a quick note of don't make a don't make a some complicated restrictive license for a pretty simple tool.

391
00:42:02,580 --> 00:42:08,680
You know if it's if it's a simple tool just release it under you know a BSD license or or GPL or something real simple.

392
00:42:08,880 --> 00:42:14,120
And and also say say what you mean and mean what you say when you're uh licensing the tool.

393
00:42:14,400 --> 00:42:19,560
Don't don't do this kind of well the license says you can't do it but then I'm going to email people and say that they can.

394
00:42:20,880 --> 00:42:25,080
And and again if you if you want it to be open source just use an OSI standard license.

395
00:42:25,080 --> 00:42:26,280
Don't make up your own.

396
00:42:28,140 --> 00:42:33,800
And it if you're going to require payments well obviously you need to make the cost reasonable or people aren't going to buy it.

397
00:42:33,800 --> 00:42:35,760
Make it make it easy for the people to buy the tool.

398
00:42:35,760 --> 00:42:37,160
That they can find it on your website.

399
00:42:37,160 --> 00:42:41,980
That you've got a link that you people can go to a secure form put in their credit card information and download the tool.

400
00:42:42,100 --> 00:42:47,780
You know you're you're going to get more people buying it that way than if they've got to email you and and try to figure out what's going on.

401
00:42:48,460 --> 00:42:49,860
And that's pretty much what's there.

402
00:42:49,860 --> 00:42:53,480
And and obviously you know make sure you tell people you know what what upgrades are going to be included.

403
00:42:53,480 --> 00:42:55,020
What support and all that.

404
00:42:55,100 --> 00:42:59,960
And and that's just kind of also a disclaimer that you know that's what users are going to expect.

405
00:42:59,960 --> 00:43:03,040
If they're paying for a tool they're going to expect some upgrades and support.

406
00:43:03,280 --> 00:43:15,520
And also consider bundling perhaps the tool with other tools or other authors because um sometimes people will release a you know little small tool that's kind of useful and they'll say oh it's you know five dollars or something.

407
00:43:15,520 --> 00:43:26,680
Well five dollars is nothing as far as payment but it's a huge pain in the butt for people that work at a large company or work in the government because there's a lot of paperwork that goes into buying tools or buying anything.

408
00:43:26,940 --> 00:43:33,300
So if if you're going to make it one of those kind of real cheap tools then maybe bundle it with some other stuff so that people can buy it more easily.

409
00:43:33,700 --> 00:43:39,700
And then if you're going to require payment you know make sure you define what you mean by you know non-commercial use or whatever.

410
00:43:40,040 --> 00:43:49,400
And there's all sorts of things to consider you know there's development and testing and internal use and consulting use and educational institutions, government entities, all this stuff.

411
00:43:49,400 --> 00:43:53,180
So you need to make sure you clarify what you mean by all those terms.

412
00:43:54,940 --> 00:44:00,280
And and again I recommend you know don't don't disallow you know redistribution entirely.

413
00:44:00,440 --> 00:44:05,760
Um it's nice to you know allow users to email it to their friends or other people they think might be users.

414
00:44:05,940 --> 00:44:12,720
And uh you know if in the case that the website is is gone forever then you know let people redistribute it more widely.

415
00:44:14,440 --> 00:44:19,340
And and again a lot make the source code available regardless of whether it's a commercial product or not.

416
00:44:19,340 --> 00:44:25,440
You know give give people the users the source code and allow them to make modifications for internal use at least.

417
00:44:25,620 --> 00:44:28,280
And uh just so they can you know fix things.

418
00:44:28,400 --> 00:44:32,280
Um allow users to distribute the modifications to one another.

419
00:44:32,280 --> 00:44:40,360
That you know if you've got if it's a commercial tool maybe you should set up an internal type mailing list just for tool users and that they can uh email stuff to each other.

420
00:44:41,500 --> 00:44:45,100
And and if you're gonna distribute the source code obviously make sure it's complete.

421
00:44:45,100 --> 00:44:48,280
You've got all the build files and libraries and stuff like that.

422
00:44:48,280 --> 00:44:53,320
And just give a quick how to of you know hey this is a Visual Studio project this is how to compile it.

423
00:44:54,940 --> 00:44:58,140
And again make the tool the license clear.

424
00:44:58,140 --> 00:44:59,300
Post it on the website.

425
00:44:59,300 --> 00:45:04,860
It a lot of tools that I noticed that you you couldn't find figure out what the license was until after you've already downloaded the thing.

426
00:45:04,860 --> 00:45:10,740
Well if it's a if it's a several megabyte file then it's kind of a waste of time to have to download it just to figure out what the license is.

427
00:45:11,200 --> 00:45:22,800
And you know if you're if you're gonna release a news item or post something on a mailing list about the new tool that's available just include a quick summary of you know it's a GPL or it's uh you know free for non-commercial use or whatever.

428
00:45:22,900 --> 00:45:27,140
You know include the the copying or license file or something like that in the distribution.

429
00:45:27,540 --> 00:45:30,700
Um and then the online help again put a little summary there.

430
00:45:30,700 --> 00:45:42,800
And if you're gonna go to a conference like Def Con or Black Hat or whatever you know tell people when you're presenting and um that's important so that people don't get all excited about something and then figure out that it's well it's under some strange license.

431
00:45:42,980 --> 00:45:53,660
And and just for the record Black Hat and Def Con are actually really good about that that I don't think you're allowed to present tools at at these conferences without a it being free for at least the conference attendees.

432
00:45:53,820 --> 00:45:56,980
But not all um conferences are like that.

433
00:45:57,660 --> 00:46:13,260
And that's just kind of just here I'll go through this real quick is you know make sure that if you're running a conference you make sure that people know what the licenses are at least and and consider making it like like Def Con and Black Hat that if you're gonna present a tool it has to be free for at least the attendees.

434
00:46:14,680 --> 00:46:35,980
And then uh the the big one that I think uh we were talking about earlier is that if the people that run online forums that's mailing lists or news groups or whatever you know again I'm not a lawyer but I would think that you could you know come up with like a default license that you know if if stuff is posted to this mailing list without any other license attached it's gonna fall under this license.

435
00:46:36,240 --> 00:46:39,660
And I'd recommend making that you know the BSD license or an MIT license.

436
00:46:39,660 --> 00:46:44,360
So something that basically says you can use it for whatever you want don't sue me if it breaks something.

437
00:46:45,340 --> 00:47:03,340
And uh and if if people are gonna patch or post patches to existing tools then it probably makes sense to dual license those under the forums license and also the existing tools license because if that way if the person who wrote the original tool uh wants to incorporate that into their tool then they can do that with no problem.

438
00:47:04,800 --> 00:47:16,940
And and also you want to decide you know are you gonna let people post things under some different license um in particular if people are making up their own license that doesn't allow redistribution then mailing lists archives and stuff get screwed up.

439
00:47:17,220 --> 00:47:27,580
And then just you know make it clear to members when they join the mailing list or uh on the website or for the web forum or whatever or in an FAQ that that uh that's what the license is.

440
00:47:28,740 --> 00:47:31,920
So that's all I have yes go ahead.

441
00:48:04,890 --> 00:48:24,770
Okay yeah I I understand what you're saying there I guess uh the the his second point was that some tools especially very expensive tools they don't want to post the price on their website because you can't just download it you know you need to talk to them you need to negotiate a contract there's usually support that involves but you know that's for tools that are in the thousands of dollars.

442
00:48:24,810 --> 00:48:28,850
I'm thinking about tools that are you know in the you know tens or hundreds of dollars.

443
00:48:30,730 --> 00:48:42,390
Well again it's like you know you you you gotta define what you mean by that and all that but yeah you know there's a lot of you know especially a lot of the security tools that we use you know little command line things that that shouldn't cost a lot of money.

444
00:48:42,750 --> 00:48:46,090
Um and what was your first point you said something about cross posting?

445
00:48:51,420 --> 00:48:55,040
Um yeah how how do you determine who the original author is?

446
00:48:55,440 --> 00:49:21,040
Uh yeah that that's definitely a problem that if if stuff has been posted especially if it's gone through like an anonymous remailer or something like that or an email account that doesn't work anymore yeah sometimes you you can't even figure out who the original author was so I don't know how to fix that but I'm hoping that you know maybe we can get some forward some forward uh thinking into this that in the future this won't be a problem if there is some sort of default license that things will fall under.

447
00:49:21,220 --> 00:49:25,620
But again I'm I'm assuming that can be done I'm again I'm not a lawyer so I don't know.

448
00:49:26,320 --> 00:49:27,860
Any other comments or questions?

449
00:49:27,860 --> 00:49:29,020
We got a couple.

450
00:49:29,180 --> 00:49:29,860
We're done.

451
00:49:29,860 --> 00:49:30,360
Okay.

452
00:49:30,400 --> 00:49:31,360
Okay well thanks.

453
00:49:31,360 --> 00:49:33,100
If anyone else has any comments see me?