start	end	text
10330	18390	Boo! Well, I'm Chuck Willis and as you can see on my presentation here, this talk is called
18390	22450	Trends in Licensing of Security Tools. Sorry, I'm going to try to keep speaking into the
22450	28110	mic. If you can't hear me or anything, just give me one of these or just say something. I
28110	31490	want to make sure that you guys can hear what I'm saying. And I also want to hear what
31490	36250	you're saying. This is meant to be an interactive presentation and in a way it's good we've
36250	40490	got a small crowd here that we can uh maybe people will feel more free to talk a little bit
40490	45070	about this because I I certainly don't intend to come up here and say that I have all the
45070	51030	answers. It's really just more of a kind of uh my slides are going to try to provoke some
51030	55930	thoughts from you all and give kind of what my thoughts on are as far as uh where
55930	61010	licensing is going and security tools and and uh what might be some problems with that. So
62010	66690	anyway, as I mentioned, I'm Chuck Willis. Um these slides are a little updated from what's
66690	70630	on your uh CD so you can go to my website and download them if you want. There's nothing
71170	77610	real substantial in the way of changes. And just uh in case you uh couldn't figure it out
77610	82690	from the title. So what we're going to be doing is uh I I want to discuss uh the trends as
82690	88170	far as the kind of the changes that I've seen in licensing of security tools and uh and
88170	92950	also talk about how that affects the security community. And uh I also want to discuss you
92950	97770	know how licensing could be improved if if necessary. I mean maybe maybe you all think
97770	102950	there's not a problem with what's going on. And uh and also as kind of a kind of a
102950	106410	secondary thing that you I expect that you know maybe some of you all will learn
106410	110150	something about uh security tool licenses in that there's a lot of tools that I'm going to
110150	116210	talk about that um you think are are free open source tools that that really aren't. And
116210	120270	again this this is meant to be interactive. So I'm I'm going to ask a lot of questions and I
120270	126930	hope that you all will will have some uh some thoughts and share share those with us. Uh
126930	131770	just a few disclaimers here. Um I I am going to talk about specific tools that have uh
131770	136230	restrictions in their licenses. And uh this is not meant to be like just ragging on these
136230	141450	people or you know trying to talk bad about people. But I just think it makes the talk
141450	145110	much more interesting if you've got concrete examples to talk about rather than a bunch of
145110	149890	abstract stuff. Um and and and I do think that the authors of those tools have done a
149890	153550	service to the community by releasing them under the license that they're under. I mean
153550	157930	they could a lot of the tools that I'm going to mention could easily be you know strictly
157930	162330	commercial tools that you have to spend thousands of dollars for. So certainly the
162330	165830	authors are going to be commended for what they've done. And also I wouldn't be talking
165830	169770	about the tool if I didn't think it was a useful tool that people uh people use. So I'm
169770	173850	not going to be talking about real obscure stuff I don't think. And uh finally the
173850	178070	licenses may have changed since I put these slides together. Uh licenses change all the
178070	183070	time. So this is uh the this is a disclaimer there that stuff might have changed since I
183070	188670	put this together. And the you need to go out and read the license if you're going to use
188670	194190	these tools. You know this don't just rely on what I'm going to tell you. Okay so a little
194190	200710	bit about me. Um I I work for a government contractor. Um I don't work for and yeah the
200710	204550	reason I say that is I don't work for a consulting firm or software firm which is who
204550	208810	releases most of the security tools as far as companies. And then a lot of security tools
208810	213930	are released just by individuals that do it in their spare time. So I think I'm a a bit
213930	218090	independent in that sense. Um I'm not a free software zealot. I'm not going to come up here
218090	222110	and say that everything should be GPL. Um cause I don't I don't think that's the case.
222110	226770	And I use commercial software along with open source software and all sorts of other
226770	233710	software. And and again I'm not a lawyer this is not legal advice. So but I I do think I'm a
233710	239450	pretty typical security tool user. I mean I I use a lot of tools in my work and also at home
239450	243970	when I'm messing around with stuff and uh and I and I kind of wanted to illustrate this to
243970	249330	show that uh you guys I think are typical security tool users as well but we're different
249330	254970	from normal software users. You know I I use both Linux and Windows. I occasionally use
254970	260150	other Unix variants but um you can't say that certainly about standard software. Most
260150	265170	people just run Windows. Um and and also I'm not a full time programmer. So I don't
265170	269410	necessarily have access to all the programming tools, Visual Studio and all that kind of
269410	274430	stuff. And uh and also I'm I can I can tinker around with stuff but I'm not necessarily
274430	279930	someone that wants to spend all day coding. But I but I compile tools. That's certainly
279930	284050	uh something that we can all do. Uh we can debug compilation issues if you've ever had to
284050	291430	import something from Linux to Windows under like the Cygwin um APIs or to BSD or
291430	295130	something like that. I'm I'm sure that's something that's pretty typical for people here.
295270	299890	Um and I I like to build little tools and scripts to automate things. I hate doing busy
299890	304930	work you know. So I I like to be able to do that kind of stuff. And I also I modify tools
304930	308950	that if I download a tool from the internet or from something that someone has posted to a
308950	312830	mailing list um I'm gonna take it and start tweaking it if it's not doing exactly what I
312830	319450	want. And I also like to share my tools and modifications with other people. So if I if I do
319450	325590	something I think is cool I post it onto a mailing list. So anyway I I wanted to just mention
325590	329290	that because again I think this kind of fits everyone that's here but it's definitely
329290	336150	different than normal software users. So my motivation here was that uh I use a lot of
336150	340850	security tools as I mentioned and and I actually read the licenses which maybe uh not
340850	345050	everybody does. But uh I've actually been quite surprised by some of the stuff I've found. A
345050	350470	lot of tools that I thought were open source really aren't. And a lot of tools that uh just
350470	355470	have some very strange license restrictions that uh that kind of surprised me. And and over
355470	359810	the years I've noticed some trends that you know it seems like more tools are going to more
359810	365250	restrictive license. So I wanted to talk a little bit about that. So here's a quick
365250	371830	example here. And uh so uh SensePost's WIC2 tool. It's a it's a Windows version of uh
371830	375990	NIC2 kind of. It it's got some other features actually that it's built onto the NIC2. Uh it
375990	381350	does some recursion and it's also uh connects in with the Google uh APIs and all that. So
381350	387650	anyone here use that tool? Find it useful? Yes? No? Okay. Good. Um are any of the
387650	391490	contributors here? I I definitely know they're here at the conference. I I sat in on
391490	395950	SensePost's talk earlier. I don't see any of them in the room here. Well you're you're lucky
395950	400050	they're not in the room because uh if you look at the license for WIC2 you'll see that it
400050	404730	starts off with the the full GPL license and then it adds this extra restriction that
404730	410390	basically if uh you find the software useful you're supposed to buy them a drink. So I
410390	413830	expect you all to go out and find them after the session's over and make sure you live up
413830	421470	to that. Excuse me? WIC2 it's a web it's a web uh application scanner. It's a web
421490	427990	server scanner. So and just in case anyone was wondering I I don't think that's
427990	434110	enforceable but I'm not a lawyer so you'll have to talk to your legal about that. Well it
434110	439250	certainly is a violation of the GPL in the sense of well it's not a violation of the GPL
439250	443450	but it's not the GPL. You you can't say that something is GPL and then add extra
443450	447370	restrictions onto it. I don't think the real the two really match. But if you also if you
447370	452010	notice the wording there it says you know it's kind of vague in the wording too. So it's to
452010	455530	be honest it's probably a joke. So I don't think they actually expect anyone to do that.
455530	460630	But it's just one of those little nuggets that you'll see sometimes in reading licenses. So
461470	465130	the uh just a little bit about the scope that the main thing I'm interested in when I'm
465130	469030	talking about these licenses is being able to use the tool for what I want to do and
469590	473830	perhaps modify the tool and be able to you know send those modifications to other people.
473830	478330	So in particular I'm not trying to take someone else's tool and build my own tool that I
478330	482410	want to sell and make a million dollars for. That's much more difficult as far as
482410	488230	licensing. Obviously GPL restricts that in a lot of ways. The BSD license or other licenses
488230	493770	like that can allow that. But that's kind of a different issue for me. So that's what
493770	497630	we're going to talk about. So let's start off with the trends that I've noticed. And
497630	501270	there's quite a few of them here. But there's two kind of overwhelming ones that we start
501270	505510	off with. And the first one is that there's a lot of great open source tools out there
505510	510830	that that are under an OSI certified license. That would be usually the GPL or a BSD
510830	515710	license. And uh y'all can read the list. I'm sure you've heard heard and heard about and
515710	520130	used a lot of these tools. You know the Nmap and Ethereal and the Metasploit framework is
520130	524210	written in Perl. Almost all tools that are written in Perl are released under Perl's
524210	527990	license. The artistic license which is uh basically you know it's an open source
527990	534010	license. OSI certified. Um so I think these people deserve a lot of credit for what they've
534010	537430	done. And everyone who's written open source software contributed to open source software
537430	543070	that uh they've done a lot of great service for the community here. And uh I just wanted to
543070	546450	say this up front to make so that when I start talking about all the other tools later that
546450	551010	doesn't sound like you know everything's a problem. Uh there's certainly a lot of great uh
551010	557270	truly open source software out there. And but I do see that uh more security tools are
557270	561430	strictly commercial. And when I say strictly commercial I say that basically if you want to
561430	565530	use the tool you've got to pay money. Um they they may have some sort of free version that
565530	569330	allows you to download it and try it out for 30 days or on a certain number of IP addresses or
569330	575070	something. But for the most part it's a uh it's a commercial tool. And uh and
575070	579290	unfortunately those commercial tools restrict many of the things that security tool security
579290	584030	tool users want to do. And uh that's really one of the things we're going to talk about for
584030	588090	this session is a lot of those restrictions. And uh so I guess I'll just kind of throw the
588090	593430	question out there. Is is there a place for commercial security tools? Do you guys think
593430	600310	yes? No? Shake your head. A lot a lot of blank stares. Well I I I do. I don't like I said I'm
600310	604730	not an open uh free software uh zealot. I think that there's a place for commercial
604730	608750	security tools especially when there's not an open source equivalent. If if people are
608750	614590	willing to pay money for it then then that makes sense. But um my other question would be
614590	621950	should commercial security tools be licensed differently from other software? Yes or no?
622150	626750	Again more blank stares. And I I think definitely yes. I think commercial commercial
626750	633430	security tool users are much different than other tool users or other software users. So I
633430	637710	think that the license can allow the kind of things that we want to do. And some tools do
637710	644050	have pretty um pretty uh how do you say less restrictive licenses. Um IDA pro for example
644050	648210	allows you to reverse engineer it. Which is kind of funny because it's a reverse
648210	652950	engineering tool. But I guess they kind of saw that that was kind of a of something that a
652950	657810	lot of commercial software doesn't allow you to do. And uh and also if you look at uh some
657810	663130	of the vulnerability uh penetration testing tools like uh core impact or canvas. That
663130	667270	those are commercial software that you have to pay for but they come with all the source
667270	671910	code. So you can go ahead and modify the tool if you want to. Which is a which is a nice thing
671910	678250	and it's certainly something that security tool users want to do. And uh the other kind of
678250	682230	overarching uh theme that I've seen is that a lot of tools are released with what I call a
682230	688530	custom license. Which is basically somewhere between commercial and open source. So there's
688530	693130	a it permits some uses without cost. Usually it means that if it's uh you know for personal
693130	699750	use or for non-commercial use it'll say you can use it. Um but it it usually requires either
699750	702910	payment or something like that for something else. And it restricts some of the other
702910	708350	things that we want to do uh that we'll get into later. And that's really what I'll talk
708350	711930	about for the rest of this session is is those restrictions and uh and tools that have
711930	717510	them. And and just as kind of an aside many of these tools that are kind of somewhere
717510	722470	between open source and commercial are released by companies and not individuals. And
722470	727050	that's because um the companies have have put money into developing this tool and they
727050	731630	want to use it either they're gonna sell it to people or they want people to know that it
731630	735330	came from them. That they don't want other people releasing uh modified versions of the
735330	748820	tool and that sort of thing. Yes? A bait and lure? Um how how do you mean that? Oh
748820	754200	certainly uh some some tools are like that uh uh like uh they'll have a uh a more
754200	758320	restricted version that uh maybe only works for up to a certain number of IP addresses or
758320	761940	whatever. And even even if you look at something like Nessus which I'll get into more a
761940	766860	little later um Nessus is a great vulnerability scanner but it doesn't necessarily scale
766860	771240	real well. And one of the things that Tenable the company that uh that is pretty much in
771240	776100	charge of Nessus now that they uh they have some like web interfaces and other consoles
776100	781140	that they'll sell you that uh allow you to manage uh Nessus scanners. So yeah certainly
781140	784580	it is part of it that it's it's really marketing is what it comes down to to a large extent
784580	788520	that a lot of these companies the consulting type companies you know they release free
788520	792740	tools because they want to draw people to their website and uh and be able to then sell
792740	799760	them consulting services and software and all that sort of stuff. Okay so now let's get a
799760	804380	little bit more into the specifics uh and and the first one is just basically that that
804380	809260	you sometimes you have to pay to use these tools. And uh and usually these are tools
809260	813920	like I said that can be used for free in some situations and then uh in other situations
813920	819220	you've got to pay. And uh sometimes they the license will say that the tool is for like
819220	823560	personal use or non commercial use but there's it doesn't say anything about if you want to
823560	827700	use it commercially how to buy it or how much it costs and there's no information on their
827700	833180	website or anything. And that is very confusing for users that it kind of to me it's like
833180	836320	if you're gonna charge if you want to charge money or you don't want people to use your
836320	840700	software for commercial use you should make it easy for them to stay within the law. You
840700	844720	should make it easy for them to buy the software if they want to buy it. And uh so that's
844720	849900	kind of confusing. And also uh here's some examples of that and uh you can read through
849900	856360	those. Um THC's are you there and is a is a tool that requires uh permission. It doesn't
856360	859840	you you don't have to pay for it but it does require permission. And I lump payment and
859840	864720	permission together because I kind of think that if you require permission for people to
864720	868600	use it for commercial use then you're kind of leading up to maybe you're gonna start
868600	874360	charging for it later. And uh and it really comes down to the same the same issues. Um
874360	878560	Foundstone's free tools are that way that they their license says it's for personal and
878560	882860	non-commercial use. Um but it doesn't say anything about how to purchase it for commercial
882860	890140	use. Um the registered plugins for Nessus and also the VRT certified rules for Snort are uh
890620	894880	are that way as well that you you need to register in order to be able to download these.
894920	899780	Uh both of them use very similar business models in that they uh um the rules will be about
899780	905980	5 days out of date um if you're gonna use the uh free of cost version. Um and then if you
905980	910760	wanna pay you know I think it's for Nessus it's like uh $1200 a year. I don't know for
910760	914900	Snort how much it costs to buy the uh immediate download so that you know as soon as a new
914900	922820	rule comes out you can get it. Um and then another tool is HTTP print which uh is just a
922820	931340	little neat little web uh server fingerprinting tool. So anyway any questions there? Any other
931340	936600	thoughts as far as other tools that are kinda in this vein or um people think this is a big
936600	971280	problem or not? I don't know. Yeah go ahead. Yeah the just for people who didn't hear that
971280	976940	basically the idea I think what you're saying is that uh basically violating the license of
976940	980560	these tools that if it says it's only for non commercial use and you use it commercially
980560	985040	that's the same as you know downloading you know Windows from the internet you know on
985040	997450	BitTorrent or whatever. It's it's it's piracy and the BSA can come after you for it. Right
997870	1001650	exactly and that and that kinda illustrates why I put this whole thing together is that you
1001650	1005330	know in my job I was downloading a lot of tools and I wanted to make sure that we were
1005330	1010110	following the license. I didn't want to get my employer or our our customers in trouble so um
1010110	1013830	yeah it's definitely one of those things that you need to be paying attention to the
1013830	1021010	licenses of the tools that you're using. Okay uh another another feature that I've seen in a
1021010	1026130	lot of licenses is that more more of them are restricting redistribution and uh basically
1026130	1029270	that means that you can only get the tool from the author. That you know you can only
1029270	1033190	download the tool from their website. Which is fine I guess until the the author
1033190	1036810	disappears. You know if it's a company and it you know goes bankrupt or if the author
1036810	1040570	unfortunately dies or decides he doesn't want to deal with it anymore it it makes it
1040570	1045670	difficult that you know maybe a friend of yours has a copy of the tool but then you you the
1045670	1049790	license says you can't redistribute it so it's one of those things that's uh it's it's kind
1049790	1053990	of a gray area. It'd be it'd be nice if people would put in their license that you know if
1053990	1058270	you're gonna restrict redistribution you know allow it if the case is that uh people can't
1058270	1062350	find it from you anymore. And just some examples of those as far as tools that you might
1062350	1067510	have used. Uh the Sysinternals tools are uh a lot of like little windows tools that uh will
1067510	1071350	show you processes that are running in that. People use them in incident response. Um Net
1071350	1077810	Stumbler actually restricts redistribution. Um and then again the Foundstone tools uh and
1077810	1085970	Nessus and Snart plugins. So that's the next uh next thing that I've seen a lot of is uh tools
1085970	1091790	that restrict or prohibit uh modification and reverse engineering. And uh that's really
1091790	1097210	it's it's a problem because this is it it prevents us from being able to fix the tool.
1097210	1102230	That you know even especially if the tools like uh Nessus the Nessus plugins restrict uh
1102230	1107570	modification. But it's it's just a script. You know you've got the source code right there.
1107570	1111270	You could easily go in there and fix things if you wanted to but the license doesn't allow
1111270	1116850	you to. And uh and that's some other examples of that. Uh Kane Enable and also the
1116850	1122230	Foundstone tools again and and Net Stumbler. Um this is like you can see mostly an issue
1122230	1126150	with uh with Windows tools that you know if you don't have the source code it makes it
1126150	1132190	difficult. But some of them like I said Nessus uh it is still an issue. And that's kind of
1132190	1136430	the next issue is that a lot of tools don't come with the source code. So if you don't have
1136430	1140950	the source code it makes it very difficult to make any changes. And uh well it's so
1140950	1145130	strictly it's not a license issue in the sense of it's not in the license. But usually
1145130	1148890	these tools that don't come with source code also have a license that restrict redistribute
1148890	1153510	or restrict modification. So it's pretty much the same issue again. And and without the
1153510	1157290	source code it's it's very difficult to make modifications to the tool and improve the
1157290	1161810	tool. Try to fix them ourselves. You know a lot of times if you're using a tool on a client
1161810	1165830	site and and something's being buggy or you're seeing that the output is weird and you want
1165830	1170290	to be able to try to fix it. You know you can't do that if you don't have the source code.
1171150	1175110	And uh and also the source code is valuable just for learning purposes. That if you want
1175110	1178690	to learn how this tool is working and how you know what kind of protocols it's using
1178690	1183310	especially if it's some sort of a like a vulnerability scanner or a a pen testing tool you
1183310	1187010	want to know well what you know how is it connecting to the remote system? What exactly
1187010	1190990	responses are we getting back? Maybe try to weed out some false positives and that sort
1190990	1194450	of thing. Well that's that's very difficult if you don't have the source code to know you
1194450	1198930	know what the thing is uh is doing. And and obviously source code is also necessary if you
1198930	1204090	want to port it to another platform. So if you've got a a Windows tool that's running a you
1204090	1209650	know standard C++ compiled program then well you've gotta want to port that over to Linux
1209650	1214250	and that's not really not possible without the source code. And uh even even in some
1214250	1218990	supposedly portable languages like Java and dot net um there you'll a lot of times run
1218990	1222690	into little issues between platforms that you need the source code in order to kind of
1222690	1227190	convert things. Especially if the original programmer didn't consider porting that you
1227190	1231270	know maybe they're using some Windows specific APIs that aren't available in the dot net
1231270	1237930	framework for uh for Linux and uh OS 10 and that sort of thing. And again this is mostly
1237930	1242330	Windows tools although occasionally you'll see it on other tools. Um I don't use Macs but
1242330	1247870	probably Mac tools uh have some of that as well. And here's a bunch of examples um and
1247870	1251650	some of them some of them I'm not sure if it was intentional that they didn't include the
1251650	1255890	source code. Some of them you may be able to email the author and get it from them um but
1255890	1260310	these are just the ones that I saw that weren't you know readily available on their website.
1260510	1264710	And uh some of the new ones here you know Achilles well Achilles is an old tool but we
1264710	1270490	haven't talked about it yet. Um Brutus, uh Sam Spade and uh Odysseus. Um Achilles and
1270490	1281180	Odysseus are web uh proxies. And there's actually a couple tools uh fortunately only two so
1281180	1286920	far that require uh credit in the consulting reports. So if you use THC AMAP or THC
1286920	1291600	Hydra as part of a penetration test or other sort of commercial uh consulting you know
1291600	1295600	assessment that you're doing. There's actually a a clause in the license that you have to
1295600	1301260	give them credit in the consulting report. Um I don't know how many people actually do
1301260	1307040	that or not. I don't know if uh I'm I'm I'm glad like I said that only a couple tools are
1307040	1311080	doing this so far because if it becomes real common it could be real troublesome to try to
1311080	1315440	remember well which tools did I use in this consulting and you know trying to get all the
1315440	1319540	credits in there and making sure the customer doesn't get kind of confused as to why you've
1319540	1326020	got all this stuff in your report. So is that new to anybody? I mean is do any anybody use
1326020	1334080	that tool that didn't know about that? No one wants to admit it anyway. Okay well another
1334080	1338520	another issue I've run into is that sometimes tools have a lot of these restrictions in
1338520	1343100	their license but then they kind of will tell you in mailing lists or or other places that
1343100	1348440	well don't worry about it you know. We really didn't mean that I guess. Um and that's a
1348440	1353020	little bit confusing. So sometimes uh in these couple examples the website is different
1353020	1357000	from what comes with the tool. So you download the tool and inside the tarball or inside
1357000	1360640	the zip file is a license that's different than what you see on the website when you
1360640	1366520	download the tool. Um one example is you know THC Hydra and AMAP. The license is only
1366520	1370000	slightly different but there's a little difference in the I think it's actually in the
1370000	1374360	clause that I just showed you that the the credit is different. That I think one of the
1374360	1378900	licenses it says you have to include the tool name, version, and authors and in the other
1378900	1384020	one it says you only have to include the name and the version or something like that. And
1384020	1389560	uh another more significant one is uh Foundstone recently released a tool called uh WS
1389560	1394960	Digger. I believe it's a web services scanning tool um but don't quote me on that. Um the
1394960	1398400	license on the website is the standard Foundstone license which we've been talking
1398400	1401500	about which is very restrictive. You know personal and non-commercial use only. No
1401500	1405940	reverse engineering. All that other stuff. But when you download the tool inside the tool
1405940	1410420	distribution is the Apache 2.0 license which is an open source license which allows you to
1410420	1415580	do all those things that we want to do. So which license are you supposed to follow? I
1415580	1419480	don't know. But from what I've seen on the when they announce the tool that it's meant to
1419480	1422920	be under the Apache license there's just uh some sort of miscommunication on their
1422920	1430540	website. Um another example is that uh sometimes the author like I said on a mailing list or
1430540	1435800	something will will contradict the tool's license. So when you have a a Foundstone's
1435800	1441100	Hack Me Bank and their Hack Me Books tools um are great great tools to learn about uh web
1441100	1444940	web applications and do some pen testing against them in a lab environment and all that.
1445180	1449640	And but again the license says that they're personal and non-commercial use. So I emailed
1449640	1454140	them because I wanted to set it up on our internal network at my company and uh they said
1454140	1458280	oh yeah no problem to use it on an internal lab. You know that they they didn't want other
1458280	1462160	people going out and you know teaching classes which is part of you know how they make
1462160	1465720	money using these tools because they put a lot of work into them. But they don't mind you
1465720	1471520	using them you know at work personally. And that that's something we'll uh another issue
1471520	1475640	that I've seen is that you know a lot of times people say personal use or non-commercial
1475640	1479380	use but they don't define that. And and different different companies have different
1479380	1484860	definitions. Um I know it's not a security tool but uh Google Toolbar um it defines
1484860	1491040	personal use as if you download it yourself it's okay. So I can use Google Toolbar at work
1491040	1495200	as long as I install it myself but my system administrator can't install it on every
1495200	1500440	single machine. Um I don't know it's just it's one of those things that it's different
1500440	1503580	companies have different definitions so if you're not defining it then it's hard to hard
1503580	1510220	to enforce it. And then another example is the the the ton of the uh the registered
1510220	1546680	plugins for Nessus. Yes go ahead. Right. Right yeah that's a that's a good point for if you
1546680	1550940	guys didn't hear. He basically said that if like the Foundstone tools that they were
1550940	1555020	written by people at Foundstone but Foundstone owns the copyright. They're the copyright
1555020	1559700	holder for those tools so they decide the license. And the authors of those tools don't
1559700	1563880	necessarily have the authority from their employer to waive that license or change the
1563880	1568700	license. So you need to be aware of that. Um as far as who who actually owns the tool and
1568700	1573720	are you actually getting permission from the right people. Um the registered plugins for
1573720	1577760	Nessus is another tool that's uh a little strange because the license is very restrictive
1577760	1583280	it doesn't allow you to change the plugins or um reverse engineer the plugins. Which is
1584240	1587580	a bit a bit strange because uh there's some problems with their plugins. You know they
1587580	1592120	they always have problems with false positives or typos and descriptions and that. And
1592120	1595920	nothing bad it's just they've got six thousand of the things. So there's inevitably
1595920	1600020	there's going to be problems that show up. And they've also they frequently have problems
1600020	1605620	with versions of of uh of services that they're scanning. That you know that when a new
1605620	1609220	version comes out they're going to give you back uh something strange that it's not
1609220	1613720	expecting. So anyway the the license prevents you from making those changes yourself or
1613720	1619220	distributing them. Uh but on the mailing lists the the owner of Tenables which I think is
1619220	1623500	authorized to make this statement said oh yeah no problem you know you can you can make
1623500	1627820	changes to the plugins and you can post it back to the the Nessus mailing list so that
1627820	1632000	other people can see them. So that's another one of those things where it's like well who
1632000	1635360	do you really follow? I mean I would guess that you know if if they've said that
1635360	1639260	publicly and and I know people have done that and no one's gotten sued so it's probably
1639260	1642180	okay but it's just a little confusing for the users that they really should straighten
1642180	1649360	that out. And the other really big issue that I've seen is a lot of tools just don't have a
1649360	1656480	license that they are you know you just can't find it and and maybe the the it's uh I don't
1656480	1659900	know there there may be you know some of these there that I'm going to mention maybe the
1659900	1663680	tools and maybe the license is in the tool distribution it's just hard to find. I have
1663680	1668700	seen ones where the binary that gets compiled or is distributed doesn't have any license
1668700	1672900	at all associated with it but if you look at like the comments in the uh source code
1672900	1677060	files it'll say you know this tool is under the GPL or this tool is under whatever license
1677720	1682100	um which is really not sufficient you're supposed to include the the full GPL in there
1682100	1686340	rather than just saying uh it's supposed to be G excuse me it's supposed to be under the
1686340	1691320	GPL. Uh and and sometimes the tool's just not present at all you know you just can't find
1691320	1696900	it and uh and this is also a big problem if you can't figure out who the author was if you
1696900	1699740	know the maybe you've got an email address that doesn't work anymore or something like
1699740	1704700	that so then it's kind of like who knows. And then the other thing is that a lot of times
1704700	1708660	there if there is a license it might be there but it's pretty incomplete that it just
1708660	1712340	basically says something real simple like oh use it for whatever you want or something
1712340	1716900	like that well that isn't really a full license in the sense of it doesn't talk about all
1716900	1720480	the different things that we want to be able to do with tools and give us permission for
1720480	1725960	it. Again I'm not a lawyer but my understanding of copyright law is that pretty much if the
1725960	1732560	license doesn't say you can do it then you're not supposed to do it. And and a lot of
1732560	1737040	times this is uh this is a problem with small exploits and scripts and stuff that are
1737040	1741180	posted to uh I call them online forums here just to include everything but mailing lists
1741180	1746420	news groups you know if you look at uh full disclosure or bug track mailing lists hardly
1746420	1749920	any of the exploits that are posted there have any sort of license associated with them.
1750240	1755940	And uh again it'd be it'd be nice if uh if we could say well if you post something in a in a
1755940	1759920	forum like that and don't include a license it's uh it was meant to be you know in the
1759920	1763780	public domain or something like that but I don't think that's the way the law works but
1763780	1771080	again I'm not a lawyer. Um here's just some examples here um a bind view's a noom tool I
1771080	1776660	wasn't able to find a license for it. Um hobbit's original netcat uh there was no license
1776660	1782540	associated with that. Uh john the ripper um I I think what happened was solar designer the
1782540	1785980	guy who wrote the tool um incorporated some other code that he wasn't sure about the
1785980	1789640	license into the tool so that's why there's no license cause he he doesn't even know what
1789640	1794460	the license is. But um he has said that the next version 1.7 is going to be released
1794460	1799560	under the GPL um but I have no idea when that's going to happen I mean 1.6 has been out
1799560	1804440	forever so I don't I don't know when that's going to happen. Um and some other tools
1804440	1808680	that I saw on sequel security dot com has a lot of sequel tools that uh I didn't see any
1808680	1817440	license for. And some other ones that we've already talked about. So okay where where are
1817440	1823020	we at in time? Okay we're we're in good shape. So do you guys agree that this exists? You
1823020	1827180	know I've talked a lot about you know I think more tools are going to this kind of um more
1827180	1837980	restrictive licenses. Do you guys agree? Disagree? Um what's what's your thoughts? Yeah
1837980	1854070	go ahead. Right the the comment was that a lot of tools seem to be uh that they're it's
1854070	1857730	almost like the bait bait and uh bait and hook method that someone else mentioned that
1857730	1862470	they they have like free tools to kind of hook you in and then they uh try to get you to to
1862470	1866670	pay for uh other tools or a more expanded version or something like that. And definitely
1866670	1871550	that's that's been the case in software for a long time but in security tools it's I think
1871550	1926460	it's more of a recent trend you know. Yes go ahead. Yeah. Yes I I think that's definitely
1926460	1931500	true. Um just to repeat for people who may not have heard is that the authors of the tools a
1931500	1936220	lot of times will will will either clarify the license if it's not there or they'll give you
1936220	1939840	the source code. They're you know usually if you can get a hold of them they're they're
1939840	1942780	pretty nice about it and they like to hear that people are using the tools. And definitely
1942780	1946240	that's that's one of my recommendations uh that we'll get to later on is you know yeah
1946240	1950680	work work with those people to see what the uh what the license is if it's not uh if it's
1950680	1968470	not clear. But uh yeah I I agree. Yeah go ahead. I I am not a lawyer. I don't know. I I would
1968470	1974330	say no just off hand that you know again if someone posts something to full disclosure or
1974330	1978990	bug track with no license attached I'm assuming he means people can use it for something at
1978990	1988720	least. But I don't know. I don't know. And that well that's actually something we'll get
1988720	2033120	into in a little bit. But what what's your thoughts? Yeah that's that's a good point. Just
2033120	2038000	real quick summary was that you know that there there may be an implied license there that if
2038000	2041820	someone has released a tool where anyone in the world can get to it either on a mailing list or
2041900	2046220	a website that you could make the argument that they intended for people to be able to use it
2046730	2051180	for for things. Again talk to your lawyer and it made it probably depends a lot on what
2051180	2070150	country you're in. Again I'm not a lawyer but my my understanding is that a license is
2070150	2074990	similar to a contract and just because you and I sign a contract doesn't necessarily mean
2074990	2080370	that everything is enforceable. And I don't know all the exact caveats but I know
2080370	2084610	for instance I can't sign a contract saying that I'll be your slave for the rest of my life.
2084610	2092230	That that is not a legally enforceable contract. So anyway. Um let me move on to another
2092230	2097210	question. So and I think we kind of covered this but I'll ask it more specifically is is there a
2097210	2100950	problem with this? And we have certainly identified a problem of you know if stuff doesn't
2101070	2104570	have a license and it's kind of in in limbo that it'd be good to have some clarification
2104570	2109210	there. But um with reference to the other trends that we've seen as far as more more tools
2109210	2115850	requiring uh payments and uh permission for uses and all that is it does that is that a
2115850	2162940	problem for the security security community? Yes? No? Yeah go ahead. Yeah that's that's a
2162940	2168840	good point and uh but quickly a summary of it was that uh yeah that some some tools out
2168840	2172800	there even security tools that are restricting reverse engineering and cryptanalysis of
2172800	2176800	them that really causes a problem for us that want to be able to evaluate these tools and
2176800	2181420	decide are they good or bad uh to deploy into our companies or to recommend to our
2181420	2187740	customers and and that sort of thing. So that that certainly is a problem. Okay uh next
2187740	2194100	question was uh well what what can we do to improve security tool licensing? I've got my
2194100	2197620	own thoughts that uh that I'll talk about in a little bit but I just want to hear what you
2197620	2208080	guys have to say. Anyone got any suggestions? Yeah go ahead. Make a new license. Yeah well
2208080	2212160	and and that was that's that's definitely one of my points uh that I'll talk about later is
2212160	2218280	that yeah if you it would be great if people want an open source product make it an OSI
2218280	2222180	approved license. Don't make up your own license because it'll run into a lot of these
2222180	2226440	problems and it makes it confusing for the users. That yeah it's it's hard especially
2226440	2231420	because of the nature of security tool work that we end up using a lot of little tools to do
2231420	2236820	our work and it's very it's it's a pain to be able to try to keep track of the licenses of
2236820	2239720	all these tools and make sure that we're not you know doing something that we're not
2239720	2274260	supposed to be doing. Any other suggestions before uh mine? Yeah go ahead. Yes that's
2274260	2279640	that's definitely a good point. Uh the the point was that if you're buying a security
2279640	2284980	product or even if you're using it for free it it but mostly if you're buying it is you
2284980	2288320	know talk to the authors or whoever tried to sell this to you and and tell them you
2288320	2291580	don't like the license. Tell them that you want a different license. Especially for as
2291580	2296440	much money as we pay for a lot of security products that uh it's amazing that the the
2296440	2299920	kind of restrictions that they want to put on what we can do and the fact that people
2299920	2303800	just accept them you know and just kind of treat it like any other piece of software that
2303800	2306920	they're gonna well we just gotta live with it. Well no you don't have to live with it
2306920	2310400	especially a lot of these smaller companies that are selling these things that you know
2310400	2314280	they they want your business and they're willing to make concessions and especially if
2314280	2320060	they um can understand that what they're trying to restrict is really not um it's it's
2320060	2324000	it's restricting what we want to do with the tools. And and it really comes down to I
2324000	2328240	think don't treat your users like criminals you know. If you're you're not giving them
2328240	2332560	source code and you're preventing them from reverse engineering the tool well you're
2332560	2336100	you're kind of assuming that oh they want to do something bad to us. Well no we just
2336100	2339880	want to be able to use the tool is what it comes down to and being able to use it in the
2339880	2347060	most efficient way that we know how. Okay I got ten minutes left. Okay any any other
2347060	2353760	suggestions? Okay I'll I'll run through what I have on here and it's it's really just kind
2353760	2360640	of my own you know thoughts feel free to disagree or or uh what not. Um few few issues for
2360640	2366080	uh tool users. Well obviously read and follow the licenses you know you you can't
2366080	2371680	just ignore ignore the issue. And if you don't like the if you don't like the license don't
2371680	2376840	use the tool or at least go back to the author and say hey can we get this changed. But don't
2376840	2383340	just ignore it and kind of go on and do whatever you want. And I'd also say uh I call it
2383340	2389800	legal trickery but just be don't use the uh don't follow the letter of the license while
2389800	2394240	violating the spirit of the license. And and a lot of that comes down to to uh you know how
2394240	2400000	you define you know commercial use and that kind of thing. You know if if you don't don't
2400000	2406400	get into that it would be my recommendation. And uh again work with the writer the tool
2406400	2411760	writers to clarify if there's a problem and and the key there is politely because tool tool
2411760	2415600	writers uh have a lot of times you know especially if they're writing it on their own you
2415600	2419620	know they're they're not getting paid to do it. They have a lot of people emailing them with
2419620	2423940	bugs and stuff like that and you know you don't want to make demands of them but just talk to
2423940	2429520	them and usually they'll be pretty uh accommodating. And and also encourage them to remove
2429520	2435320	the license restrictions which is uh good for everybody. And and also if you if you make
2435320	2439980	changes to a tool um whether it be an open source tool or any other tool you know share the
2439980	2444040	changes you know allow all of us to work together on these things so that everyone's not
2444040	2451140	out you know reproducing the same you know events. Okay well tool writers well you just
2451140	2454920	obviously you need to follow the license for any software that you're incorporating into your
2454920	2459520	tool. Um in particular you know if you've got like GPL software or something you can't
2459520	2465060	just cut cut and paste that into a commercial product. Um choose choose a license and
2465060	2469820	include it with every tool. That's uh kind of self explanatory. And and remember you know if
2470240	2474540	the copyright holder can add another license at any time. So just because I released a tool
2474540	2478680	under the GPL today doesn't mean that every version of that tool is always going to be GPL.
2478680	2483920	I can release the next version of it under a completely different license. That's that's not
2484040	2489360	a problem because I own I own the work. And if your employer holds the copyright then
2489360	2494040	encourage them to use a less restrictive license or just a standard open source license.
2494040	2498760	That that can go a long way to just you know telling your boss you know hey this is what we
2498760	2502260	want to what users are going to want to be able to do with this tool and we think it'll be
2502260	2506300	helpful in the long run because especially if the company is trying to release the tool as
2506300	2510920	you know marketing and and being able to draw people to their site. Well more people that
2510920	2519140	use the tool the better it is for them. Um just a quick a quick note of don't make a don't
2519140	2523360	make a some complicated restrictive license for a pretty simple tool. You know if it's if
2523360	2528160	it's a simple tool just release it under you know a BSD license or or GPL or something real
2528160	2533680	simple. And and also say say what you mean and mean what you say when you're uh licensing
2533680	2537620	the tool. Don't don't do this kind of well the license says you can't do it but then I'm
2537620	2543000	going to email people and say that they can. And and again if you if you want it to be open
2543000	2549180	source just use an OSI standard license. Don't make up your own. And it if you're going to
2549180	2553220	require payments well obviously you need to make the cost reasonable or people aren't going
2553220	2556660	to buy it. Make it make it easy for the people to buy the tool. That they can find it on your
2556660	2560180	website. That you've got a link that you people can go to a secure form put in their credit
2560180	2563840	card information and download the tool. You know you're you're going to get more people
2563840	2567780	buying it that way than if they've got to email you and and try to figure out what's going on.
2568460	2571500	And that's pretty much what's there. And and obviously you know make sure you tell people
2571500	2576260	you know what what upgrades are going to be included. What support and all that. And and
2576260	2580040	that's just kind of also a disclaimer that you know that's what users are going to expect. If
2580040	2583980	they're paying for a tool they're going to expect some upgrades and support. And also
2583980	2589920	consider bundling perhaps the tool with other tools or other authors because um sometimes
2589920	2594160	people will release a you know little small tool that's kind of useful and they'll say oh it's
2594160	2599100	you know five dollars or something. Well five dollars is nothing as far as payment but it's a
2599100	2602960	huge pain in the butt for people that work at a large company or work in the government
2602960	2608100	because there's a lot of paperwork that goes into buying tools or buying anything. So if if
2608100	2611680	you're going to make it one of those kind of real cheap tools then maybe bundle it with some
2611680	2615240	other stuff so that people can buy it more easily. And then if you're going to require
2615240	2618620	payment you know make sure you define what you mean by you know non-commercial use or
2618620	2622820	whatever. And there's all sorts of things to consider you know there's development and
2622820	2627340	testing and internal use and consulting use and educational institutions, government
2627340	2632380	entities, all this stuff. So you need to make sure you clarify what you mean by all those
2632380	2639240	terms. And and again I recommend you know don't don't disallow you know redistribution
2639240	2644360	entirely. Um it's nice to you know allow users to email it to their friends or other people
2644360	2650080	they think might be users. And uh you know if in the case that the website is is gone
2650080	2656200	forever then you know let people redistribute it more widely. And and again a lot make the
2656200	2660060	source code available regardless of whether it's a commercial product or not. You know give
2660060	2664920	give people the users the source code and allow them to make modifications for internal use
2664920	2670920	at least. And uh just so they can you know fix things. Um allow users to distribute the
2670920	2674600	modifications to one another. That you know if you've got if it's a commercial tool maybe
2674600	2678980	you should set up an internal type mailing list just for tool users and that they can uh
2678980	2684020	email stuff to each other. And and if you're gonna distribute the source code obviously
2684020	2688280	make sure it's complete. You've got all the build files and libraries and stuff like that.
2688280	2692360	And just give a quick how to of you know hey this is a Visual Studio project this is how to
2692360	2699980	compile it. And again make the tool the license clear. Post it on the website. It a lot of
2699980	2703300	tools that I noticed that you you couldn't find figure out what the license was until
2703300	2707320	after you've already downloaded the thing. Well if it's a if it's a several megabyte file
2707320	2710340	then it's kind of a waste of time to have to download it just to figure out what the license
2710340	2715260	is. And you know if you're if you're gonna release a news item or post something on a
2715260	2718900	mailing list about the new tool that's available just include a quick summary of you know
2718980	2724100	it's a GPL or it's uh you know free for non-commercial use or whatever. You know include
2724100	2728180	the the copying or license file or something like that in the distribution. Um and then
2728180	2732160	the online help again put a little summary there. And if you're gonna go to a conference
2732160	2737640	like Def Con or Black Hat or whatever you know tell people when you're presenting and um
2737640	2740740	that's important so that people don't get all excited about something and then figure out
2740740	2745320	that it's well it's under some strange license. And and just for the record Black Hat and
2745320	2748460	Def Con are actually really good about that that I don't think you're allowed to present
2748460	2752880	tools at at these conferences without a it being free for at least the conference
2752880	2759700	attendees. But not all um conferences are like that. And that's just kind of just here I'll go
2759700	2763780	through this real quick is you know make sure that if you're running a conference you make
2763780	2767940	sure that people know what the licenses are at least and and consider making it like like
2767940	2772400	Def Con and Black Hat that if you're gonna present a tool it has to be free for at least
2772400	2779260	the attendees. And then uh the the big one that I think uh we were talking about earlier is
2779260	2784220	that if the people that run online forums that's mailing lists or news groups or whatever you
2784220	2789860	know again I'm not a lawyer but I would think that you could you know come up with like a
2789860	2793620	default license that you know if if stuff is posted to this mailing list without any other
2793620	2797900	license attached it's gonna fall under this license. And I'd recommend making that you know
2797900	2802460	the BSD license or an MIT license. So something that basically says you can use it for
2802460	2807300	whatever you want don't sue me if it breaks something. And uh and if if people are gonna
2807300	2812820	patch or post patches to existing tools then it probably makes sense to dual license those
2812820	2817920	under the forums license and also the existing tools license because if that way if the
2817920	2821980	person who wrote the original tool uh wants to incorporate that into their tool then they
2821980	2827160	can do that with no problem. And and also you want to decide you know are you gonna let
2827160	2831960	people post things under some different license um in particular if people are making up
2831960	2835740	their own license that doesn't allow redistribution then mailing lists archives and stuff
2835740	2840560	get screwed up. And then just you know make it clear to members when they join the mailing
2840560	2846260	list or uh on the website or for the web forum or whatever or in an FAQ that that uh that's
2846260	2886610	what the license is. So that's all I have yes go ahead. Okay yeah I I understand what you're
2886610	2891750	saying there I guess uh the the his second point was that some tools especially very
2891750	2896690	expensive tools they don't want to post the price on their website because you can't just
2896690	2900510	download it you know you need to talk to them you need to negotiate a contract there's usually
2900510	2904910	support that involves but you know that's for tools that are in the thousands of dollars. I'm
2904910	2911090	thinking about tools that are you know in the you know tens or hundreds of dollars. Well
2911090	2916170	again it's like you know you you you gotta define what you mean by that and all that but
2916170	2919430	yeah you know there's a lot of you know especially a lot of the security tools that we use you
2919430	2923610	know little command line things that that shouldn't cost a lot of money. Um and what was
2923610	2933440	your first point you said something about cross posting? Um yeah how how do you determine
2933440	2939900	who the original author is? Uh yeah that that's definitely a problem that if if stuff has
2939900	2943500	been posted especially if it's gone through like an anonymous remailer or something like
2943500	2947340	that or an email account that doesn't work anymore yeah sometimes you you can't even figure
2947340	2952440	out who the original author was so I don't know how to fix that but I'm hoping that you know
2952440	2957580	maybe we can get some forward some forward uh thinking into this that in the future this
2957580	2961600	won't be a problem if there is some sort of default license that things will fall under. But
2961600	2966880	again I'm I'm assuming that can be done I'm again I'm not a lawyer so I don't know. Any other
2966880	2971760	comments or questions? We got a couple. We're done. Okay. Okay well thanks. If anyone else
2971760	2973100	has any comments see me?