Grant Willcox, a student studying ethical hacking at the University of Northumbria in the UK, is claiming that the Wassenaar Arrangement, an arms control treaty that was expanded last year to prohibit the export of various kinds of software exploit, is forcing him to censor his dissertation.

Willcox's research investigates ways in which Microsoft's EMET software can be bypassed. EMET is a security tool that includes a variety of mitigation techniques designed to make exploiting common memory corruption flaws harder. In the continuing game of software exploit cat and mouse, EMET raises the bar, making software bugs harder to take advantage of, but does not outright eliminate the problems. Willcox's paper explored the limitations of the EMET mitigations and looked at ways that malware could bypass them to enable successful exploitation. He also applied these bypass techniques to a number of real exploits.

Typically this kind of dissertation would be published in full. Security researchers routinely explore techniques for bypassing system protections, with this research being one of the things that guides the development of future mitigations. Similarly, publishing the working exploit code (with a safe payload, to prove the concept) is standard within the research community.

However, Willcox's paper doesn't do this. Writing on his blog, he explains that some pages have been removed due to a combination of the Wassenaar Arrangement's restrictions, and the university's ethics board forbidding the release of exploits. He says that he will release the exploits only to consultancies within the UK, thereby avoiding any exports.

Whether Wassenaar is entirely to blame for the redactions to the paper is less clear. The agreement has a clear exemption for technology that is "in the public domain." Publish the source code to an exploit for all to use and the Wassenaar arms controls should no longer apply. This should provide a straightforward way for Willcox to freely publish his EMET bypasses without concern about exporting munitions: just put the complete source code onto github with a suitably permissive license.

However, with a university policy prohibiting the release of exploits, this "escape hatch" isn't available, making the reluctance to publish in full understandable.

The situation underscores the concerns that many in the security community had over Wassenaar's extension to include exploits, security research, and security tools. Researchers argue that the kind of work that Willcox did is instrumental to ensuring that the good guys can keep one step ahead of the hackers and malware authors. The expanded agreement threatens to have a chilling effect on important security work, with researchers afraid or unwilling to figure out the weak points of the software we use and publish their findings.