Slashdot Mirror

@stake, eeye, and iss have all agreed w/ microsoft not to release details of even potential exploits until the microsoft has had 30 days to "evaluate" them, leaving admins and the public unnecessarily exposed to vulnerabilities. This is completely unacceptable, and contrary to the scientific peer-review process of real science. If you know there's a problem, you speak out, suggest a fix, and hopefully the appropriate parties will be responsible enough to take action. Additionally, others have to be able to VERIFY and REPRODUCE findings, a critical part of *real* research. But microsoft's tactic is to force so-called security "research" companies (who are in it for money, not necessarily for altruistic research or making things more secure) into a lop-sided, biases "standards" NGO, the "Organization for Internet Safety" (OIS), which Microsoft is a member. (read this). What they are proposing is censorship, hiding information until they can find a fix, so that only the hackers will know what's broken. Talk about the fox guarding the hen-house!!!

Additionally, the director of research for @stake, Chris Wysopal, is effectively lobbying congress to give teeth to the OIS, and more power to microsoft and their buddies.

OIS = @stake, BindView, SCO, Foundstone, Guardent, ISS, Microsoft, NAI, Oracle, SGI, Symantec. sounds like the stone cutter's guild to me.

Eeye seems to be left out for obvious reasons, they oppose this secretive "research." Read eeye's Marc Maiffret's (chief hacking officer) thoughts on things to a congressional subcommittee here.

"windows corrupts, microsoft corrupts absolutely."

According to this Foundstone is in bed with microsoft for anti-disclosure plan. (reported on /. ) It is funny that they are accused of pirating windows - gives new meaning to microsoft's trustworthiness.

From their FAQ :

OIS is currently made up of companies or organizations. We originally excluded individual researchers on the basis of maintaining equity between the representation of research and vendor communities. Recently, however, we have been reconsidering that decision, though no new decision has been reached. Since the OIS launched, we have been overwhelmed by requests for membership and are deliberating on the best way to address the outpouring of interest. Participation in the mission of the OIS, developing and promulgating guidelines for handling vulnerability information, does not require membership, however. All interested parties will be strongly encouraged to participate in the review and comment process once the draft guidelines are released.

• @stake
• BindView
• Caldera International (The SCO Group)
• Foundstone
• Guardent
• ISS
• Microsoft
• NAI
• Oracle
• SGI
• Symantec

2.2 Phases

The basic steps of the Security Vulnerability Reporting and Response Process are:

# Discovery. The Finder discovers what they consider to be a security vulnerability (the Potential Flaw).

# Notification. The Finder notifies the Vendor and advises it of the Potential Flaw, and the Vendor confirms that it has received the notification.

# Investigation. The Vendor investigates the Finderâ(TM)s report in an attempt to verify and validate the Finderâ(TM)s claims, and works collaboratively with the Finder as it does so. # Resolution. If the Potential Flaw is confirmed, the Vendor identifies where the Flaw resides, then develops a remedy (in the form of a software change or a procedure) that eliminates or reduces the risk of the vulnerability.

# Release. In a coordinated fashion, the Vendor and the Finder publicly release information about the vulnerability, along with its resolution.

Now look at this under the context of the recent MS Passport Vulnerability to see how effective this process is.

As an aside, this draft is backed by MS and SCO, amongst other companies. It'll be interesting to read the amount of bashing this gets over the weekend.

"7.1 Advance Notification

This document does not address processes for notifying selected groups of users about vulnerabilities in advance of the general population. While such âoepre-release notificationsâ are sometimes done, and in very well-controlled cases can be carried out effectively, they are not a recommended practice in the general case. Because this document addresses only activities that are appropriate for typical cases, advance notification is beyond its scope."

"8.2 Use of Third Parties

In some cases, investigations may be made more effective by the use of people or organizations other than the Finder and Vendor. There is no requirement to use a third party, but in cases where one is used, it should be a person or organization that the Finder and Vendor have agreed to in advance of its involvement. Characteristics of a good third party include sound judgment, freedom from bias or conflicts of interest, demonstrated technical expertise in security technologies, and discretion regarding the handling of the information it is entrusted with to resolve the dispute. Third parties normally serve in a voluntary capacity, as a service performed in the public interest."

Members of the OIS... (From the OIS site http://www.oisafety.org/about.html#1) What companies are members of OIS?

The current members are: @stake, BindView, Caldera International (The SCO Group), Foundstone, Guardent, ISS, Microsoft, NAI, Oracle, SGI, and Symantec.

We're actively soliciting software vendors and security research companies to join. Send OIS your feedback on the draft until July 7th! (From the OIS site http://www.oisafety.org/resources.html) "Comments on the Security Vulnerability Reporting and Response Process should be sent via email to draft-feedback@oisafety.org. Comments should include your name, address, and email contact information. Organizations submitting public comments should include the name and title of the person submitting the comments. While OIS will respond to as many comments as possible, because of the anticipated volume of comments, we cannot guarantee an individual response to every comment."