Firm To Release Database, Web Server 0-Days

krebsonsecurity writes "January promises to be a busy month for Web server and database administrators alike: A security research firm in Russia says it plans to release information about a slew of previously undocumented vulnerabilities in several widely-used commercial software products, including MySQL, Tivoli, IBM DB2, Sun Directory, and a host of others, writes krebsonsecurity.com. From the blog: 'After working with the vendors long enough, we've come to conclusion that, to put it simply, it is a waste of time. Now, we do not contact with vendors and do not support so-called "responsible disclosure" policy,' Legerov said."

Comments

Responsible Disclosure

[Mud_Monster]

The alternative to responsible disclosure is irresponsible disclosure. Is that really better?

Re:Responsible Disclosure

[MachDelta]

The alternative to irresponsible disclosure is for the vulnerability to be used maliciously for an unknown period of time. Which of those is preferable?

Re:Responsible Disclosure

[gregarican]

Here's a quote from TFA...

Legerov said. For example, he said, “there will be published two years old Realplayer vulnerability soon, which we handled in a responsible way [and] contacted with a vendor.”

I think that apparently the vendors aren't doing a damn thing to patch a good amount of these reported vulnerabilities if they are being reported in a proactive manner. Seems as if once the exploits are running rampant in the wild then the vendors scramble to develop patches. Not the best business practices all the way around, but it's the way it is.

Re:Responsible Disclosure

[couchslug]

Yes, because it coerces vendors to fix vulns and therefore improves ecosystem health.

If the internet ecosystem were not under steady attack, it would be weak and much more vulnerable.

What does not kill it makes it stronger.

Re:Responsible Disclosure

[Anonymous Coward]

Responsible Disclosure is like "pro choice" or "pro life". It is a deliberately positive term for purely demagogic reasons. You can't be for irresponsible disclosure, just like you can't be against choice or against life.

The protocol for publishing information about exploitable software bugs is an intensely debated topic and the choices affect multi-billion dollar businesses where it hurts them most: The bottom line. Do not for a second believe that anyone in this game argues for the sake of rational discourse alone.

Re:Responsible Disclosure

[hawkeye_82]

This is like punishment.

The irresponsible party in this case, is the software vendor. If the vendor can't clean up their act, and at least work on fixing 0-day exploits, then public disclosure/humiliation is probably a good way to get at least some vendor to sit up, take note and do the right thing the next time around.

This sounds like a good case for establishing a procedure.

1. Contact vendor about exploit, with an expiry date.
2. Release information about exploit once date has expired, irrespective of whether bug is fixed, and the fix deployed.

Is there perhaps a clearing house for such things?

Re:Responsible Disclosure

[csartanis]

Yes, because "responsible" goes both ways. They're being responsible by notifying the vendor before going public. If the vendor is not fixing the issue, it's time to go public.

As far as I'm concerned a public release is still a responsible one. At least in that case everyone knows about it.

Irresponsible is selling unknown vulnerabilities to private parties that will use them for their own gain. The vendor's customer's get screwed and the vendor has no idea that it's even happening.

Re:Responsible Disclosure

[Anonymous Coward]

That is what is generally called "responsible disclosure". The point here however is that vendors allegedly twiddle thumbs as long as the exploit isn't released, so any time you give the vendor before you release the information is time wasted, unnecessarily leaving admins of vulnerable systems in the dark.

Re:Responsible Disclosure

[morgan_greywolf]

The term "responsible disclosure" is newspeak for "keep your mouth shut". The alternative to 'responsible disclosure' is that the vulnerabilties continue to exist for sometimes years, with wild exploits happening perhaps unknown for long periods of time.

I think it's okay to notify the company and give them time to fix the bug, but time on the order of years is completely unreasonable. On the Internet, a year is a very, very long time.

Re:Responsible Disclosure

[Lally Singh]

God forbid vendors actually start testing their software *before* it's in the field.

Re:Responsible Disclosure

[mcrbids]

I think that apparently the vendors aren't doing a damn thing to patch a good amount of these reported vulnerabilities if they are being reported in a proactive manner. Seems as if once the exploits are running rampant in the wild then the vendors scramble to develop patches. Not the best business practices all the way around, but it's the way it is.

It's most likely a case of resource management and insufficient resources available. Businesses exist to make money. Features make money, bugs cost money. So, given NNN amount of money, do you:

A) Fix the bugs that people are experiencing problems with RIGHT NOW with exploits in the wild, or

B) Fix the bugs that are "theoretical" and MAY be exploited at some point in the future if somebody else finds it?

Now, the clueful would note that the set of B includes the set of A, but for those who are living close to the edge, A is where the attention goes, and that's why you see announcements like this one.

Re:Responsible Disclosure

[TubeSteak]

The alternative to responsible disclosure is irresponsible disclosure. Is that really better?

The alternative to "responsible disclosure" is "full disclosure".
"Irresponsible" is only disclosing 0-day exploits to black hats.

The world isn't black and white.
Just because someone frames the issue as "X or Y" doesn't mean that "or" isn't an option.

Re:Responsible Disclosure

[Anonymous Coward]

They were most likely allocating those resources to what they perceived as bigger bugs. These security researchers want *their* bugs to have top priority, because it allows them to make a name for themselves. They're no Robin Hoods.

Re:Responsible Disclosure

[MrNaz]

Yea, if only software vendors could take a page out of Larry Singh's book and have an immaculate record of having never given code to anyone else that contained even the smallest bug.

Re:Responsible Disclosure

[Anonymous Coward]

Pro life are against choice, your analogy is flawed.

Re:Responsible Disclosure

[jedidiah]

...usually. Sometimes pro-life can mean they want you to "choose life".
Although that's not the way it usually goes since the noisiest part of
the "pro life" crowd are fundie nutbags want to meddle in everyone's
lives.

Re:Responsible Disclosure

[ckaminski]

Pro-life is typically used to mean "ANTI-abortion" and not "Pro-choice for you if you want it, more power to ya, but no fucking way you're aborting MY baby".

Re:Responsible Disclosure

[mcgrew]

What does not kill it makes it stronger.

Tell "what does not kill me makes me stronger" to a brain-damaged man in a wheelchair. If there were no attacks, vulns would be little problem. As it is, your AV takes up a good chunk of your computer's resources and the botnets still send tons of spam.

Re:Responsible Disclosure

[Anonymous Coward]

Let's not go there. The point is that calling it "responsible disclosure" makes arguing against it much harder than, for example, calling it "delayed disclosure" would.

Re:Responsible Disclosure

[Anonymous Coward]

The responsible disclosure. The one where only a couple people in the world (if any) know how to exploit it before the patch. Instead of the irresponsible one where every script kiddie knows how to exploit it before the patch. You'd think that would be common sense.

Re:Responsible Disclosure

[fearlezz]

The third option: "Dear developers of [insert product name], I've found an security issue in [insert product name]. Details are attached. I give you 14 days before releasing this information publicly."

Re:Responsible Disclosure

[The End Of Days]

And pro-choice could be reasonable renamed pro-baby death. Why quibble over the semantics like a bunch of droolers? It's not like anyone changes their mind anyway, it's all masturbation.

For the record, I am in favor of mandatory abortions.

Re:Responsible Disclosure

[Hurricane78]

tl;dr: Of course I prefer the company fixing the bug, but in case they fail at that, I at least want to know of it and be on the same level as the crackers.

You got something wrong: The position of the crackers is that it’s the companies who act irresponsibly, e.g. by doing nothing when they should close the bugs, or by suing those who found some hole. Which I agree with. I’d go so far as to offer a prize to anyone who can demonstrate an exploit for my software. With that prize always being worth enough to stop interest in pursuing other ways to take advantage of them. If someone is really good, he might even get a permanent post.

The only reason I can imagine, why someone would do something else, is because he still is a “3 year old” who can not handle any critique and has to become aggressive or repressive against anything that suggests he is not god.
In other words: Typical upper-level PHB behavior.

And under those circumstances, the responsible thing to do, is to at least protect the clients, by telling them about the risks of doing business with that company and of using that software.

Re:Responsible Disclosure

[vadim_t]

Yes, but it's unrealistic to expect that if researchers didn't publish attacks, there wouldn't be any.

Somebody found the hole. It can't be that they're the only person on the planet who could possibly figure it out. Eventually somebody else will find it too, or maybe already has. If that person happens to have something malicious in mind, they won't publically disclose it. They'll exploit it for their own gain, or sell the information to people who will do that.

If nobody disclosed vulnerabilities for the public's benefit, they'd never get disclosed until somebody got hit with them. First somebody would perform a successful attack, and a postmortem examination would eventually result in figuring out what happened. But doing things this way means at least one victim is 100% guaranteed, and nobody can prepare for it in advance.

Re:Responsible Disclosure

[lordsid]

Basically what this is about is choice. The companies in question have been notified of the security flaws in their product. They have as of yet fixed said flaws. They have instead prioritized other projects above fixing the bugs. The choice was given to the companies in question. The choice is now being removed due to their inaction.

I will take irresponsible disclosure any day over people not fixing known bugs. This is forcing their hand and that is why they don't like it.

All in all, tough shit for the companies involved.

In an ideal world security flaws would be fixed when they are discovered. I think we can all agree this is not an ideal world.

Re:Responsible Disclosure

[flimflammer]

I think that apparently the vendors aren't doing a damn thing to patch a good amount of these reported vulnerabilities if they are being reported in a proactive manner. Seems as if once the exploits are running rampant in the wild then the vendors scramble to develop patches. Not the best business practices all the way around, but it's the way it is.

The problem I have with this is that they have grown annoyed with a few specific vendors not doing anything about the vulnerabilities, and have decided instead to widely expose many vulnerabilities from vendors they have not ever even talked to. If you're not even going to try to talk to any vendors at all, even vendors whom with you've never spoken to at any point in the past, I would consider that quite irresponsible.

Re:Responsible Disclosure

[mcgrew]

It's most likely a case of resource management and insufficient resources available. Businesses exist to make money.

And as long as we keep putting up with shoddy software, they'll continue to sell it to us. Bugs cost money, as you said, so I would think they might put a few more resources to getting rid of the bugs before they shovel it out the door.

Re:Responsible Disclosure

[Dan Ost]

Features != Bugs

Just because marketing puts a higher priority on new features than it does fixing bugs doesn't mean that that is a better allocation of developer resources.

Of course, even if the bug is in the wild, if they're sure it's not exploitable, they can ignore it to continue working on new features. All they're really risking in that case is their reputation.

Re:Responsible Disclosure

[Anonymous Coward]

I am in favor of mandatory masturbation (to prevent the need for abortions.)

Re:Responsible Disclosure

[Bosonic]

But also tends to include the "Pro-choice, but please choose life!" crowd.

Re:Responsible Disclosure

[mcgrew]

I'm in the camp that says if you find a vuln, give them X days to fix it, then disclose it to the public.

Re:Responsible Disclosure

[rcharbon]

Whoa! You forgot C) Add more features to make product appear better in checklist comparisons. That trumps fixing little ol' bugs!

Re:Responsible Disclosure

[Stormcrow309]

I thought it was 'what doesn't kill me cripples me for life'...

Re:Responsible Disclosure

[arose]

The one where an unknown number of in the world know how to exploit it before the patch.

FTFY.

Re:Responsible Disclosure

[Tom]

Businesses exist to make money. Features make money, bugs cost money.

Which wouldn't be a problem, because avoiding and fixing bugs would then avoid loss of money.

The problem is that features make the vendor money, while bugs cost the customer money.

Outside the software world, warranty and liability regulations solved that problem.

Re:Responsible Disclosure

[EvanED]

Responsible Disclosure is like "pro choice" or "pro life". It is a deliberately positive term for purely demagogic reasons. You can't be for irresponsible disclosure, just like you can't be against choice or against life.

I sometimes wonder if anything would have been different if, before the Iraq invasion, the sides were commonly known as the "pro-peace" and "anti-peace" positions.

Re:Responsible Disclosure

[bws111]

This doesn't sound like either responsible or irresponsible disclosure. It sounds like plain old extortion. Notice he does not say he provided the vendor with the vulnerability info, just that he contacted the vendor. Calling a vendor and saying 'you have a vulnerability, pay me x and I will tell you what it is, don't pay and I'll tell everyone else' is not 'being responsible', it is extortion. Given that he must now resort to a blanket 'from now on I'll just release it' threat he must be getting pretty desperate. Frankly, I have no trouble believing that IBM/Tivoli and Sun/Mysql would not bat an eye at an extortion attempt, but I find it hard to believe they would not fix an actual vulnerability if it was reported as such.

Re:Responsible Disclosure

[Anonymous Coward]

The one where an unknown number of people in the world know how to exploit it before the patch.

FTFY.

FTFY.

Re:Responsible Disclosure

[betterunixthanunix]

Perhaps this is yet another reason to use only free (libre) software: you do not have to rely on a greedy businessman to decide that a bug is worth fixing. Of course, this means that "responsible disclosure" flies out the window, since you cannot go around keeping bugs secret if you want random people to fix them, but give the content of TFA...

Re:Responsible Disclosure

[davester666]

A) Fix the bugs that people are experiencing problems with RIGHT NOW with exploits in the wild, or

B) Fix the bugs that are "theoretical" and MAY be exploited at some point in the future if somebody else finds it?

But how do you know if it's being exploited in the wild or not? Vendors are unlikely to know, security researchers and the anti-virus companies might. The best exploits are written so the end-user doesn't notice anything bad has happened.

And even if it's not, is it wise to wait until AFTER, say, some business notices that their computer/web site gets hacked because of the exploit, stealing a million credit card numbers before the vendor bothers to fix the bug?

Maybe this kind of thing will result in more problems for purchasers in the near term, which may result in more pressure for vendors to produce higher quality software in the longer term? HAHAHA, I made myself laugh at that...

Re:Responsible Disclosure

[Anonymous Coward]

Bullshit! I say. Cut the crap You are either Pro-Life or Pro-Death.

Just like binary there are only two digits. You are either, black or white, 1 or a 0, yes or no, true or false etcetera. Pro-choice people do not like the term pro-death so they want to be called pro-choice to make it more palatable to their conscience. If you choose not to abort a fetus you are pro-Life! if you choose to abort a fetus you are pro-death! end of story.

Re:Responsible Disclosure

[HarrisonFisk]

Except he did not contact the vendors. He said in the past he has contacted some and they didn't fix it, so now he has given up on all vendors and does not disclose the information at all for any vendors.

I work for one of the affected projects and can tell you that we did not get contacted by them via any of our normal, well publicized methods (email, phone calls, etc...).

I agree that if a vendor does not reply then it is totally okay to disclose it to force their hand. However, disclosing it immediately to the public and giving the vendor no chance to fix it (even a few days) is wrong imo.

Re:Responsible Disclosure

[Low Ranked Craig]

It is statistically highly improbable (impossible) to release any relatively complex application without bugs. Testing in a controlled environment, even highly rigorous testing, is still testing in a controlled env. Once you release the software the use cases and use environments multiply like rabbits with Viagra.

Or is my sarcasm meter buggy?

Re:Responsible Disclosure

[dgatwood]

Exactly. The GP is seeing the world in black-and-white, where reality has many gradations in between.

Naive responsible disclosure: give it to the vendors. They do nothing. The bad guys figure it out. Everyone loses.
Irresponsible disclosure: hand out a zero-day to the bad guys. Everyone loses.
Effective responsible disclosure: disclose it to the vendors along with the promise to disclose it publicly on a scheduled date.

It should be noted that the third way is how CERT does things, and is the only way that the end users stand a chance of not getting screwed. It is important to make it clear that the vulnerability will be released to the public on that date no matter what. It is also important to make this date no more than two months in the future. Make the time frame too short and you're accused of creating a zero-day exploit. Make it too long and they won't bother looking at it until a week before, then they'll tell you that they can't fix it in time, and they'll accuse you of creating a zero-day exploit. There's a middle range in which it's close enough to scare the pants off of the manager types but far enough out that the fix can actually happen.

Most importantly, though, if the vendor doesn't fix it, you must disclose it anyway. Otherwise you lose all credibility, and vendors will simply put off fixing the problem because they'll assume that you will keep backing down.

Re:Responsible Disclosure

[HarrisonFisk]

The problem is that they are not contacting vendors anymore at all since some of the previous times the vendor was slow or didn't react.

I work for one of the affected projects and can tell you that we did not get contacted by them via any of our normal, well publicized methods (email, phone calls, etc...).

I agree that if a vendor does not reply then it is totally okay to disclose it to force their hand. However, disclosing it immediately to the public and giving the vendor no chance to fix it (even a few days) is wrong imo.

Re:Responsible Disclosure

[innocent_white_lamb]

Which is followed by a letter from the firm's legal department ordering you to keep quiet or be sued for far more than you can afford to pay a lawyer to defend you.

Re:Responsible Disclosure

[networkBoy]

That's really not fair either.
Many bugs that are security related are a result of interactions that people simply didn't think of as possible. While bug free code is desirable, and possible, would you be willing to pay 10 times more for a "provable" product? 100 times more?

Look at the space shuttle code. Provable software with an average of something like 2 man years per line of code on average? Is that realistic for consumer or even pro commercial software?

On the flip side I abhor this type of disclosure as well. I think 0 days should be forwarded to the vendor and given at least 90 days before release. Hell set a timer on it, even say the following timeline would be ok(ish):
discover exploit: notify vendor
notification + 1 week: notify world of nonspecific vuln in product
notification + 1 month: notify world of type of vulnerability
notification + 2 months: notify world of specific vuln
notification + 3 months: notify world with exploit code.
-nB

Re:Responsible Disclosure

[HarrisonFisk]

Obviously you only write code with 0 bugs in it. Every software release from everywhere has bugs in it, it's life. This actually turned out to be a component that we use and not our code directly.

I didn't get fired or in trouble for this. However, it does impact users of our software that rely on our software and want a patch to this bug before every single script kiddie out there is now using this exploit in their l33t hax0r toolbox. I'm sure we'll have a fix out for it shortly, but it still doesn't help our users to be punished for something a vendor they aren't even using did at some point to make these people annoyed.

Re:Responsible Disclosure

[spun]

Exactly. We need to get laws passed that will make software vendors as liable for damages caused by shoddy merchandise as any other vendor is. They don't care because they don't have to.

Re:Responsible Disclosure

[Myopic]

Yes, we all wish that the computer world was free from attacks. That would be a great world. But since we live in this world, the environmental metaphor is apt.

Re:Responsible Disclosure

[dna_(c)(tm)(r)]

Which is followed by a letter from the firm's legal department ordering you to keep quiet or be sued for far more than you can afford to pay a lawyer to defend you.

Then Mr. Legorov responds with something that says, basically, "sod off" in russian and gets on with his life.

Re:Responsible Disclosure

[gerddie]

Unless your project is a free software tool that is not backed (and sold) by a company, the company selling your project could have bought this CANVAS tool the are talking about, I read it's about $10k - so it's still a lot cheaper then paying someone to find the bugs. Why do you expect that the security researchers give you an advantage for free when they can sell it? Just look at it from the other side, they could sell the information on the black market instead of disclosing it.

Re:Responsible Disclosure

[Anonymous Coward]

comments from TFA:

CG: for less than 10k all those companies can just buy CANVAS and all the exploit packs and keep up to date with the bugs/oday as they come out. Or pay more for the Immunity Early updates. all less than the price of a junior security “whatever” on staff.

Rick: CG is right. If they really gave a damn (which they don’t) then a 10 K investment is nothing on their books. Absolutely nothing. The sad truth is they don’t care. The sad truth is that programmer quality is getting worse and worse. The sad truth is very few of them even care about QA and proper vetting and testing anymore. The sad truth is they’ve decided it’s just not profitable. Perhaps a flurry of 0days will force them to change their minds. At least for a short while. But most likely they’ll just call in the spin doctors. Spin doctors are still cheaper than good programmers and standardised security routines.

I think, they are right on spot.

Re:Responsible Disclosure

[blueskies]

Irresponsible disclosure: hand out a zero-day to the bad guys. Everyone loses.

People running the software pull it out of production until there is a fix? Or they mitigate the problem the day the world learns of the exploit?

Re:Responsible Disclosure

[blueskies]

It sounds like plain old extortion. Notice he does not say he provided the vendor with the vulnerability info, just that he contacted the vendor. Calling a vendor and saying 'you have a vulnerability, pay me x and I will tell you what it is, don't pay and I'll tell everyone else' is not 'being responsible', it is extortion.

How is that extortion? That's extortion in the same way that selling an idea to someone or their competitors is extortion. Buy my idea that gives 200 MPG or i'll sell it or give it away for free to X.

Re:Responsible Disclosure

[blueskies]

Even better, you should increase or decrease the expiry date based on past history/reputation of the company: response time, severity of bug, number of vulnerabilities. If the company is Donald Knuth, i guess you could start with a default expiry date of 10 years.

See if companies respond classical conditioning. The "bad" companies would eventually get 0-day notification anyway.

Re:Responsible Disclosure

[HarrisonFisk]

We do have access to it now, thanks. However, it doesn't allow us to get a fix out prior to the disclosure. I have no problem with him selling a scanner for the exploit, I am totally fine with him using that to his monetary advantage.

Keep in mind it is his customers (assuming they are not black hat) he is hurting as well, as the ones that want to scan for the exploit most likely would like to fix the exploit rather than just totally disable the product.

Re:Responsible Disclosure

[Anonymous Coward]

If you choose not to abort a fetus you are pro-Life! if you choose to abort a fetus you are pro-death!

It's just about fetuses? How about people who've actually been born? Oddly enough, most of the people who are "pro-life" when it comes to fetuses aren't so sure that it's bad to kill actual children and adults.

If you support capital punishment or sending men with guns to invade other countries, you are also "pro-death".

Re:Responsible Disclosure

[dgatwood]

That's reason to disclose that there is a flaw, not to disclose what the flaw is. And if you can tell administrators a way to mitigate the problem without revealing the specifics of the problem, then there's no harm in disclosing that information immediately. Handing out the details of the flaw, however, does not benefit anyone unless the product is open source and you provide a patch. Even then, it's better to go through an established process like CERT to get the fix out to vendors so that on the day the fix goes into the public repository, the vendors can already have patched builds available.

Re:Responsible Disclosure

[geminidomino]

Bullshit! I say. Cut the crap You are either Pro-Life or Pro-Death.

Not true. I can be staunchly against abortion, but entirely of favor of people who grow up to be boolean douchebags being retroactively removed from the gene pool.

Re:Responsible Disclosure

[gerddie]

Keep in mind it is his customers (assuming they are not black hat) he is hurting as well, as the ones that want to scan for the exploit most likely would like to fix the exploit rather than just totally disable the product.

Somehow I suspect that they will not release all information they have, only "old" enough information. I would be quite surprised if those who use this CANVAS package for some time didn't get the time to fix the vulnerabilities of there own software. Another story is if they find vulnerabilities in software they use but can not change themselves. Probably they reported the problem at least in general terms to the vendor, but he didn't act and now faces full disclosure.

Re:Responsible Disclosure

[Jaime2]

Perhaps they are trying to force a new behavior pattern where the vendors actually vet their own software for secuirty flaws before they release it. In today's climate, a big vendor can let the security firms do the hard testing and then sit back and fix whatever they care to fix. In the potential future, every vendor may be forced to release software that is nearly security-hole free and scale the features back.

Re:Responsible Disclosure

[Jaime2]

Bug free code is nearly impossible and way too expensive. Code that has nearly zero buffer overflows and no stupid defaults or wide open side doors is do-able. The vendor will fix their feature set because the customers will force them too. All this does is create the same pressure from the security angle.

Besides, most security bugs are fixed only after there is an exploit in the wild. The practice won't change anything except the time table.

Re:Responsible Disclosure

[Anonymous Coward]

Why should they? That deprives them of revenue. We can do the testing for them, and we'll pay them for doing it.

How this became acceptable, I do not know.

Re:Responsible Disclosure

[turbidostato]

"These security researchers want *their* bugs to have top priority"

Only two choices:
1) They are right: "their" bugs are top priority and publishing them will demonstrate (and the vendors will learn about them for free).
2) They are wrong: "their" bugs are not so top priority; they'll publish them and the affected vendors will follow bussiness as usual fixing their top priority first, then those from the security firm (and they'll find about them for free).

All in all both the vendors and the market will end up with a net gain. Let's not forget that resposibility for buggy software *must* be on the side of those producing buggy software, not on those that ring the bell, or else Woodward and Bernstein would be the guilty side on the Watergate scandal, not Nixon.

Re:Responsible Disclosure

[turbidostato]

"If there were no attacks, vulns would be little problem"

There are attacks *because* there are vulnerabilities.

"As it is, your AV takes up a good chunk of your computer's resources and the botnets still send tons of spam."

May it be because shoddy software vendors are still unwilling to do something *real* about it?

Re:Responsible Disclosure

[galego]

And to make waters muddier ... how about throwing this in the mix ... to whom is the 'responsible' part of responsible disclosure? If I paid for software (.e.g IBM DB2 and other commercial vendors are on the list), the company needs to be responsible and disclose the issue to me if it was disclosed to them (... IMO). How many vendors do that when a security researcher/firm 'responsibly' discloses a vulnerability/exploit to them (with or without embargo date)?

There's more than one angle for responsibility in the debate.

Re:Responsible Disclosure

[LO0G]

One thing to keep in mind: all that was necessary to reverse engineer the DNS flaw was Dan Kaminski's mentioning that it existed - within a week several researchers had figured it out.

I don't totally disagree with you but there ARE times when just the knowledge that a flaw exists (or a rough idea of where the flaw exists is sufficient to allow others to figure the flaw out).

Re:Responsible Disclosure

[Hydroksyde]

Yeah, so we can go back to the early 1990s, when the vulnerabilities existed, US-CERT knew of them, a few hackers know of them, the system admins don't and the software devs do nothing to patch them

Re:Responsible Disclosure

[Techman83]

In an ideal world, image verification wouldn't be needed...

Re:Responsible Disclosure

[blueskies]

Luckily, most people don't count in binary, so for the rest of us we have 10 choices. Like if you are pro-death (0) you don't even impregnate women b/c you hate life so much. You have to like life enough to create it.

Re:Responsible Disclosure

[dgatwood]

True, and worse, this is one of those fundamental flaws ("big bugs") that I mentioned previously, which cannot realistically be fixed in a short time, merely hacked around. The DNS protocol is brain damaged beyond all repair, and all the source port randomization in the world doesn't really change that; it just protects us until the next order of magnitude increase in network speeds, and then we're back where we started again.

That said, one of the reasons the Kaminsky bug was so quickly rediscovered by other researchers was that the fundamental underlying flaw was well understood, IIRC. That's pretty rare as far a security holes go. Usually when there's an underlying flaw that big, it gets fixed or the protocol flops like a lead balloon (were it anything but DNS, that is).

Either way, though, this demonstrated that CERT is an effective way to get things fixed, which I think proves my original point: real security researchers work through CERT or equivalent groups to get vulnerabilities fixed and disclosed in a responsible manner. People who don't are just attention whores. :-)

Re:Responsible Disclosure

[flimflammer]

That analogy doesn't really work. Giving away or even selling that "200MPG idea" won't cause harm to the vendor and/or the vendors clients except perhaps from a profitability standpoint if they happened to be selling their own idea that was lesser in quality. Demanding money or else you'll publicly release vulnerabilities that can cause damage to a vendors' image and/or their clientele is a pretty good definition of extortion if you ask me.

Re:Responsible Disclosure

[Anonymous Coward]

http://www.youtube.com/watch?v=M3hge6Bx-4w

Re:Responsible Disclosure

[RoFLKOPTr]

The responsible disclosure. The one where only a couple people in the world (if any) know how to exploit it before the patch. Instead of the irresponsible one where every script kiddie knows how to exploit it before the patch. You'd think that would be common sense.

The thing is... software vendors AREN'T patching their software upon "responsible disclosure." And then they even go so far as to file gag orders when security researchers threaten to disclose the vulnerability at a public forum or what have you. Krebson is fed up with it and they're just going to skip the responsible disclosure part and go straight to the public presentation in hopes that the vendors will get their acts together and actually start patching these holes if they want to keep their customers.

Re:Responsible Disclosure

[thsths]

> Effective responsible disclosure: disclose it to the vendors along with the promise to disclose it publicly on a scheduled date.

In a perfect world maybe, but in this world you get a court order with a gag and a fat legal bill as a thank you. I can perfectly understand why the guy is fed up.

However, I would prefer him to differentiate a bit. Surely not all companies out there are that evil? Microsoft for example is known to take ages to fix the bug (I think 11 years is the record), but they tend to bribe you rather than drag you to court.

Re:Responsible Disclosure

[ThePhilips]

I work for one of the affected projects and can tell you that we did not get contacted by them via any of our normal, well publicized methods (email, phone calls, etc...).

I once tried to contact a vendor about trivial bug. I have spent in total about a day on a phone (e-mails went unanswered for weeks) being switched between different people who had no clue what to do with me. In the end the task went to the secretary who was supposed to pass them my technical e-mail about the problem. Never heard back on the matter from any of them.

The point I'm trying to make, it is extremely hard and often is impossible for a techie from one company to reach a techie of another company. (Unless of course the two know each other in some other way.)

That is one of the advantages of open source projects that they use open forums and often have open bug tracking systems. Communicating a problem to most OSS project in my experience is magnitudes easier.

P.S. I hear that sometimes contacting marketing directly can be more fruitful. But there are the pathological cases of marketdroids not accepting existence of problems in their products. Or more commonly marketing outsourced to a 3rd party in which case it is just as good as contacting company directly.

Re:Responsible Disclosure

[Christoffer777]

I believe he/she meant that you are probably not against the concept of choice and you are not against the concept of life or right to life either. Then being able to choose to end a life becomes quite the paradox now, doesn't it? It then turns into a philosophical/religious discussion of where we deem the limit/definition of life to be.

Re:Responsible Disclosure

[ThePhilips]

It is statistically highly improbable (impossible) to release any relatively complex application without bugs.

QA is not a feature. QA is a process. Any software except helloworld.c has bugs. The question is how company deals with the problems after deployment.

Modus operandi of many business is to go into "Sold!" state after deal is sealed: customer paid money already, so we don't care anymore.

Once you release the software the use cases and use environments multiply like rabbits with Viagra.

Not really.

I have seen statistics about testing which was showing that software without any testing (or only developer unit test only) had magnitudes more bugs compared to software which had undergone a test with very low coverage (10-25%).

What it says, is whether company pays attention to quality or not. Many do not. Then bugs do the "multiply" thing.

P.S. Also I have seen pathological cases where companies intentionally test cases which are rare/nonexistent in real world - because they refused to support as official features what customers usually do with the product. On a book it looks cool: software is tested/etc. But in the end customers are still treated like alpha testers.

Re:Responsible Disclosure

[Tim C]

"Pay me money or I'll tell the world things you'd rather I didn't" is definitely either blackmail or extortion, depending on the details and local laws.

Re:Responsible Disclosure

[hesaigo999ca]

Better for them to do this, then to fight to get the vendors to do nothing about it, as these apparently have been not only around for awhile, but also several times given to the vendors as bugs needing fixing, and never gotten any changes from the vendors, so I think it is about tmie, even though you created the software, it does not really belong to you anymore, it belongs to the ones using it, and if they are not being told about these issues, then how are they to know they are in danger?

Re:Responsible Disclosure

[blueskies]

How does damage to a vendor's image hurt them other than from a profitability standpoint?

It's typical in the business world to only offer exclusivity for something, if the person will pay a lot more for something. If they don't want to pay for exclusivity then they get the cheaper offer available to everyone.

Re:Responsible Disclosure

[blueskies]

If it is definite like you say, i'm sure he'll be promptly arrested like everyone else that tries to sell an exclusive right.

What's up with the confusing article title?

[Qubit]

Firm To Drop Database, Web Server 0-Days

The verb to drop has specific meaning w.r.t. databases. A few more words in the title would have been acceptable. How about:

Fed-up security firm to release Database & Web Server vulnerabilities publicly

Look at how much more information is conveyed in that second title. A work of beauty, it is.

Re:What's up with the confusing article title?

[gregarican]

Perhaps the firm is issuing a malicious DROP DATABASE T-SQL command, escaping through some unsanitized web query...

Re:What's up with the confusing article title?

[Arancaytar]

We're lucky Slashdot properly escapes its SQL input. Aa headline like "Firm to 'DROP DATABASE `web_server`" might otherwise result in havoc. :P

Re:What's up with the confusing article title?

[Anonymous Coward]

Firm To Drop Database, Web Server 0-Days

The verb to drop has specific meaning w.r.t. databases. A few more words in the title would have been acceptable. How about:

Fed-up security firm to release Database & Web Server vulnerabilities publicly

Look at how much more information is conveyed in that second title. A work of beauty, it is.

In the submit story page, your proposed headline would look like:

Fed-up security firm to release Database & Web Ser

See how it truncates?

Re:What's up with the confusing article title?

[gregarican]

So let me get this straight. Slashdot validates their SQL input. But they don't validate their HTML conformance?

Re:What's up with the confusing article title?

[noidentity]

Yes, I assumed this was an article about a firm dropping support for a database and webserver without any notice (perhaps a DRM-supplying company or something). Just below this headline is another misleading one, "CES Vendors Kicked Out of Hotels For Showcasing Wares in Room", which suggests they were showing pirated software.

Re:What's up with the confusing article title?

[mchugh]

We're lucky Slashdot properly escapes its SQL input. Aa headline like "Firm to 'DROP DATABASE `web_server`" might otherwise result in havoc. :P

"Oh, yes. Little Bobby Tables, we call him."

http://xkcd.com/327/

Re:What's up with the confusing article title?

[Stavr0]

Firm To Drop Database, Web Server 0-Days

The verb to drop has specific meaning w.r.t. databases. A few more words in the title would have been acceptable.

Perhaps "Firm to GRANT SELECT ON database, web server 0-days TO PUBLIC"

Re:What's up with the confusing article title?

[MrNaz]

I think you're confusing him with CmdrTbls.

Re:What's up with the confusing article title?

[tag]

The verb to drop has specific meaning w.r.t. databases.

There's an xkcd for that.

Re:What's up with the confusing article title?

[Anonymous Coward]

Fed-up Firm to release 0-Day Exploits
Fed-up Firm to release DB and Web Server exploits

Or other hundreds of ways it can be phrased with-in the character limit.

Re:What's up with the confusing article title?

[iammani]

The same with google.com or gmail.com or facebook or any website that needs to support a variety of browsers (even browsers that are not standards compaint).

PS: wikipedia was complaint, its should applauded for its effort.

Re:What's up with the confusing article title?

[thePowerOfGrayskull]

So let me get this straight. Slashdot validates their SQL input. But they don't validate their HTML conformance?

What does one have to do with the other? Proper sanitization of inbound data is basic security. HTML conformance is important to, but failing to conform isn't going to result in data theft, loss, or corruption on the servers.

Re:What's up with the confusing article title?

[General Wesc]

That's terrible! Everyone knows HTML validity is just as important as basic security.

Re:What's up with the confusing article title?

[Anonymous Coward]

SQL sanitation is prob just a tad bit more important than fixing a few trivial html errors.

Re:What's up with the confusing article title?

[DMUTPeregrine]

"Wares" does not mean pirated software, "warez" does. "Wares" just means any items offered for sale.

Re:What's up with the confusing article title?

[gregarican]

Swoosh...

Re:What's up with the confusing article title?

[Anonymous Coward]

Um. No. That would be 'Warez'. Wares are things that people sell. A grocery store's wares include things like soup and dish detergent.

Re:What's up with the confusing article title?

[Qubit]

In the submit story page, your proposed headline would look...

Yeah, but one person looks at the headline on the Submit Story page. Then an editor pokes it with a stick. All the rest of Slashdot reads it on the front page.

I always figured that the editors ruthlessly edit the headlines, as is their Cowboy-Neal-granted right. Maybe they don't even bother to do that anymore...

Re:What's up with the confusing article title?

[tftp]

PS: wikipedia was complaint, its should applauded for its effort.

What have I done to deserve this pain?

Re:What's up with the confusing article title?

[Anonymous Coward]

Maybe someone should complain to them about this.

Re:What's up with the confusing article title?

[Anonymous Coward]

One of the errors said: & did not start a character reference. (& probably should have been escaped as &.)
Seriously, if you can't even do your own escaping right you have no cause complaining about others.

Re:What's up with the confusing article title?

[TheModelEskimo]

41 errors isn't so bad, considering you're talking about a busy, understaffed news service like /. The way people complain about the editorial policy here, I would expect at least 200 or so errors. (This from someone who looks at W3C validation pages all day. ;-))

Re:What's up with the confusing article title?

[ais523]

I can't figure out if you came up against Muphry's Law there, or if Slashdot's parsing decided to do it for you...

Re:What's up with the confusing article title?

[JamesP]

So I suppose it's ok to have a slashdot user of Robert'); DROP TABLE Users;-- ?!

Re:What's up with the confusing article title?

[Myopic]

Oh hi! You must be my former student, Little Bobby Tables!

Re:What's up with the confusing article title?

[Anonymous Coward]

Swoosh...

Is that the sound of a shoe flying over my head?

Re:What's up with the confusing article title?

[Philip_the_physicist]

There is also the RSS feed to consider. Firefox has a maximum width for menus, and has since 0.9 at least, and that includes live bookmarks. For me, that means that I can only see the first 50 or so characters in the title without waiting for the tooltip text. I don't know if other browsers have this "feature", but it does mean that short headlines are worthwhile.

Semi-unrelated (and now utterly off-topic) but is there anyone else who hates having the site name at the start of the page title instead of the end. Doing that would make the titles on tabs far more useful, and the favicon (if used) already tells you the site.

Re:What's up with the confusing article title?

[Anonymous Coward]

Firm To Drop Database, Web Server 0-Days

The verb to drop has specific meaning w.r.t. databases. A few more words in the title would have been acceptable. How about:

Fed-up security firm to release Database & Web Server vulnerabilities publicly

Look at how much more information is conveyed in that second title. A work of beauty, it is.

worry not about that which you have no influence over, or consume you it will.

Why not?

[Monkeedude1212]

FTFA:

At issue is the pesky ethical and practical question of whether airing a software vendor’s dirty laundry (the unpatched security flaws that they know about but haven’t fixed yet) forces the affected vendor to fix the problem faster than it would have had the problem remained a relative secret

Hasn't this been proven to be true - and legal?

In all honesty, if they've contacted the vendor and the vendor hasn't patched it in a month or two, I think its completely ethical and practical to release the vulnerabilities. After all, there could be a few other small firms who have discovered the vulnerability and are exploiting it. Best to put them out there in a Twitter feed so that the entire world instantly complains about it forcing the vendor to fix it. I prefer security over new features.

Re:Why not?

[DeadPixels]

I agree, but that's not what this guy is doing. He's saying that he doesn't want to notify vendors at all, which I feel isn't responsible. I believe that you should notify the vendor and then release it in a reasonable time frame (TFA suggests 60-90 days).

I don't have a problem with the disclosure of vulnerabilities once the vendor has been notified, because I think it does cause the problems to be resolved quicker. However, not telling the vendor means there's no chance for them to even start on a fix before everyone knows the exploit.

Re:Why not?

[b4dc0d3r]

He's a step ahead of you. He's tried doing it the right way and gotten no results. So he's going to skip the part where he wastes his time.

If companies want responsible disclosure, they should respond in some way to the disclosure. Maybe companies will actually fix bugs instead of sitting on them, and he can go back to doing it the right way. He also warned the companies he's going to do it, so they have a chance to fix things before then.

Here's a tip for you. In the real world, sometimes you have to force the other party's hand to get them to act responsibly. He's to that point, and fortunately has leverage. By making this choice public, he shames the irresponsible software companies which allow security problems to sit around unfixed.

Hopefully they'll scramble to release some fixes, which they haven't done yet, which is a net improvement over the current situation where millions of people have unpatched vulnerabilities.

In short, I don't see a problem here. I use software, it has security problems, I expect those to be fixed. Whatever it takes to get there, I'm all for it.

Re:Why not?

[SwashbucklingCowboy]

"if they've contacted the vendor and the vendor hasn't patched it in a month or two"

A month or two is not enough time.

Re:Why not?

[jc42]

... that's not what this guy is doing. He's saying that he doesn't want to notify vendors at all, which I feel isn't responsible.

Well, how I read it is more like "Hey, we've tried notifying these turkeys a dozen times or more, and every time, they stonewalled us. I'm fed up with them, and I'm not going to waste my time any more. I'm just going right to the public release, which their history shows is the only way to get any action."

Maybe this isn't the "responsible" thing to do, but it's certainly understandable that a frustrated customer might feel this way. And at this point, "responsible" becomes merely a weak value judgement whose effect mostly is to delay the correction of problems.

Perhaps what we should suggest is starting off with a nice long "advanced notice" period with a vendor, 2 or 3 months. Each time they fail to act within that window, you decrease it slightly for the next bug you report. With time, this might stabilize on a reliable period for that vendor. Of course, this only works if you have a long-term business relationship with that vendor. In many cases, people are likely to give up long before the asymptote is reached.

Has anyone proposed a "responsible release" heuristic like this, that adjusts the public-release time to the vendor's previous behavior? I haven't read of any, but I haven't read everything on the topic.

Re:Why not?

[John Hasler]

I think that it would be much better to always notify the vendor (telling them when you will release) and then release as scheduled no matter what the vendor does or says. The word would soon get around and vendors would know they were working against a firm deadline.

Re:Why not?

[Monkeedude1212]

Why not? Too busy? On what?

You can have bugs, you can have additional features, you can have new projects on the table, ALL of that stuff should be second fiddle to security vulnerabilities.

So where is the time consumption? The firm is already telling you WHERE the problem is. All it takes now is Finding a solution, testing it, and deploying it.

If you're telling me that it takes more than 2 months to do that - I seriously doubt the actual integrity of the product they are working on.

Re:Why not?

[Anonymous Coward]

I believe he will be notifying the vendors once he releases it through the website.

All interested parties can subscribe to the RSS feed.

Re:Why not?

[Tom]

We've had that discussion five years or so ago, hadn't we?

To rehash the two most important arguments of each side:

Pro Full Disclosure: "99% chance that the evil hackers already know about the exploits when a whitehat finds it, plus vendors don't get their lazy bums up unless there's danger in the air and the customers demand it."

Pro "Responsible Disclosure": "Mimimi, that's sooo evil. Plus vendors will certainly fix things ASAP and work with researchers and everything will be better and I'm not being paid to say this."

The only argument that the Full Disclosure side could not kill was that giving vendors a head start would greatly improve things, because it had never been tried in that form. Well, it has now. Show me the statistics that show the improvements. By everything I hear, there's been no change whatsoever, except one: 0-days have become more valuable because the black hats have more lead time before a public disclosure.

Re:Why not?

[dissy]

I agree, but that's not what this guy is doing. He's saying that he doesn't want to notify vendors at all, which I feel isn't responsible. I believe that you should notify the vendor and then release it in a reasonable time frame (TFA suggests 60-90 days).

Well, you could always apply for that job :}

You get paid nothing, to email vendors about their security flaws, and wait for a reply that will never be sent to you.

Oh, and you aren't allowed to 'quit' this job, else we will say on the internet that you are immoral unethical and not reasonable.

Especially after you do this for years, get not a single reply, and realize just how futile the whole process is. Definitely can not quit after that!

Seriously, if you won't take that position for no pay and no rewards even of a job well done, then you are only part of the problem!

Re:Why not?

[cromar]

Whatever it takes to get there, I'm all for it.

Even... even murder??! Or genocide??!

Re:Why not?

[Thaelon]

What he's saying is that notifying the vendor first doesn't result in a fix at all, so why waste breath and allow the vulnerability to remain in the wild longer?

If it's releasing them into the wild results in a faster fix, then that's what should be done. There's no such thing as security through obscurity. Whether it actually results in more damage to release it immediately without notifying the vendor than to notify the vendor and have them do nothing for six months - while during those six months, others can exploit the vulnerability maliciously - remains to be seen.

Re:Why not?

[dgatwood]

Well, to be fair, there are two broad classes of security bugs: minor bugs and major bugs. A minor bug is a buffer overflow or something in which the fix is obvious, trivial, and can be rolled out in an hour. A major bug is a bug in which the entire authentication system has to be thrown out and rewritten from scratch because it is trivially spoofed by replay attacks. Those sorts of bugs often can't be fixed in such a short time interval. On the other hand, those classes of failures are to some degree an indication that perhaps you shouldn't trust the company's software in general, so....

Re:Why not?

[HarrisonFisk]

The problem is that he isn't contacting the vendors in this case. He said that in the past he has tried contacting them (in the general sense, not these vendors specifically) and some of them didn't reply so from now on, all vendors are not going to be contacted.

I work for one of the projects affected and know that they did not contact us in this case. If he had, we would have happily fixed the issue within a day or two. Instead our users are being put on the line as dumb script kiddies try out their new exploit while we finish up the bug fix.

Re:Why not?

[tsm_sf]

I'd agree, but on the other hand this guy is essentially doing their job for them. For free.

Re:Why not?

[rwade]

He's a step ahead of you. He's tried doing it the right way and gotten no results. So he's going to skip the part where he wastes his time.

What time is wasted? Notifying a company of bugs is just a matter of popping an e-mail to the right person. Sure it could take a few e-mails back and forth to get to the right person, but if you compare the time spent there to the time you spent actually finding the bug, I find it hard to believe that it would be anything but insignificant.

Re:Why not?

[Anonymous Coward]

is it better to keep quiet?

that depends if there is infinite number of vulnerabilities or not. if it is infinite, maybe it would be better to just fix those that bad guys find.

Re:Why not?

[Anonymous Coward]

oh really? you are assuming that ALL vulnerabilities CAN be patched. but there seems to be infinite number of exploits because spoiled (l)users want more functionality each day.

Re:Why not?

[sixsixtysix]

responsibility goes out the window if/when the vendor doesn't immediately start working on a fix. if he tried in the past, and they weren't up to task: fuck 'em. the vendor's past irresponsibilty is what is at fault. i don't get why the vendors don't have team of people doing exactly what this guy's firm does. i can see a smallish company not having a security team, but the names mentioned (ibm, sun, et al.) are big dogs ffs. if they did have teams, time to get some new ones.

Re:Why not?

[turbidostato]

"We've had that discussion five years or so ago, hadn't we?"

Well, we had that discussion back in 1853 (http://en.wikipedia.org/wiki/Full_disclosure#History) so yes, it's growing a bit old now.

Re:Why not?

[turbidostato]

"A month or two is not enough time."

Being that the case is that when a zero-day exploit is published big names are able to respond within hours I'll bet that yes, a month or two is quit enough. Of course, if you ask the question to the vendors themselves they'll want to answer that even the whole eternity is not enough for them since actually they don't give a damn about security unless heavily pressed to do so (as it happens to be case after a zero-day exploit is in the wild).

Re:Why not?

[SwashbucklingCowboy]

"Being that the case is that when a zero-day exploit is published big names are able to respond within hours I'll bet that yes, a month or two is quit enough."

You lose the bet.

I work for one of those "big names" and I can tell you unequivocally it ain't enough time. And a few hours? You obviously have no fucking clue what you're talking if you write such nonsense.

It can take more than a few hours just to do a full BUILD of a product. Running even a small test matrix can take a day. Running the full test matrix often takes over a week. And that doesn't even count the time to find the bug and fix it which can take much longer in complicated cases.

You may only write "hello, world" software and yes, finding a bug in that kind of project doesn't take much time. In real world software, with millions of lines of code, it's more difficult.

Re:Why not?

[OldSoldier]

He's a step ahead of you. He's tried doing it the right way and gotten no results. So he's going to skip the part where he wastes his time.

Really?!?! I'll believe you, especially since I haven't RTFA, but let's narrow down just precisely what he's "tired" about "wasting".

Old process:
a) find security bugs
b) report them to vendor
c) wait for a fix
d) check to see if fix is released
e) if not release info to public if so then do nothing.

One thing that could improve this process is to change steps c-e thusly:
c) wait 2 months
d) release info to the public

If the company fixed it then releasing the info is no harm, right? and if he doesn't have to check then he's not wasting any time. He could even set up a reminder on his computer to ping him when the 2 months are up.

So... what part of his time is he wasting doing it the "right way"? I'm a bit confused here.

Re:Why not?

[ThePhilips]

The problem is that he isn't contacting the vendors in this case.

We have all seen the (horrible) statistics about how long it takes a vendor to patch a hole though "responsible disclosure" process.

The guys try to gather new statistics about how long would it take for a company to fix a problem which was disclosed to the general public.

If he had, we would have happily fixed the issue within a day or two. Instead our users are being put on the line as dumb script kiddies try out their new exploit while we finish up the bug fix.

Well, methods of script kiddies are well known and protecting against them doesn't take a rocket scientist.

Plus disclosure of a problem doesn't equal to publishing an exploit. Most script kiddies are incapable of developing their own exploits. If you really need the "day or two" to fix the issue, then there would be literally no impact on your users.

Re:Why not?

[ThePhilips]

ZOMFG.

Users want to have *less* functionality and most are simply freaked out by the amount of crap and bloat software companies put into their products now to justify the higher prices. One thing is when the bloat can be skipped, but now they push it into the front often crippling the features users actually bought the software for.

Re:Why not?

[jc42]

Yeah, I'd agree. But it's easy to understand how someone might get frustrated and say "The hell with them; I'm just gonna release the information from now on."

Irresponsible

[DeadPixels]

To clarify the summary, this guy isn't saying that he's not going to wait for companies to fix exploits before he releases them; he's saying he's not going to tell the companies at all. That, in my opinion, is very irresponsible. If you contact them and say you're going to release the information in 90 days regardless of their progress on a patch, fine, but to not warn them because of a few vendors who don't do their job is harmful to everyone.

Re:Irresponsible

[Anonymous Coward]

Problem is that if you warn a vendor privately, they will either dismiss you outright, or get a court to sign a gag order against you in a matter of hours.

Re:Irresponsible

[Volante3192]

The devil you don't know is less dangerous than the devil you know? Fact is, the guy says he's got holes from Real from two years ago that haven't been patched. Two years isn't enough time, now you want two years and three months?

Re:Irresponsible

[GameMaster]

What he seems to be saying, is that he's already told the companies and they've done nothing. A better term for it might be "effective disclosure" in order to differentiate itself from the, proven ineffective, "responsible disclosure" advocated by the industry.

Re:Irresponsible

[haruharaharu]

Of course, these guys are in russia, so good luck with that.

Re:Irresponsible

[Anonymous Coward]

What court? This firm is located in Russia.

Re:Irresponsible

[tonyreadsnews]

they will either dismiss you outright

So, how would that change GP's process?

get a court to sign a gag order

Then share it with one (or a couple) trusted friends who can release it if you are unable to.

Re:Irresponsible

[93 Escort Wagon]

Of course, these guys are in russia, so good luck with that.

Of course, if the big companies that are effected felt it made business sense to do so, the fact that this group is located in Russia could make them easier to deal with. A bit of Microsoft cash slipped into the right unregistered bank account... problem solved, guys are shut up permanently.

Re:Irresponsible

[Anonymous Coward]

And that is the only possible options. Yep.

Re:Irresponsible

[Xua]

This may be exactly what they actually want to happen and /. is helping them with publicity here.

Re:Irresponsible

[JyriVirkki]

What he seems to be saying, is that he's already told the companies and they've done nothing.

As the architect for one of the products listed I can say with certainty that our product team has not been contacted with any vulnerability info. I'm all for open disclosure but I wish the authors of each software would be given a head-up slightly ahead of time.

Re:Irresponsible

[shutdown -p now]

Problem is that if you warn a vendor privately, they will either dismiss you outright

Then you proceed with disclosure.

or get a court to sign a gag order against you in a matter of hours.

Has there been a precedent for that?

I have reported security vulnerabilities in the past, and while the fix did take longer than I expected to be reasonable, at all points I was kept notified of the current progress, and I was never "dismissed", nor did anyone threaten me with court gag orders or anything like that. What did I do wrong?

Re:Irresponsible

[Anonymous Coward]

A Russian court. Believe it or not there are legal systems outside the US.

Re:Irresponsible

[Fulcrum of Evil]

It occurs to me that financing international terrorism is a bit of a step up from not fixing exploits in your software. If adobe was known to finance murder in a foreign country, just what do you think would happen?

Re:Irresponsible

[Anonymous Coward]

Real? Exploits are irrelevant. It was a miserable bug-ridden mess and I stopped using it on that account a long time ago. I was pretty sure that everyone else in the solar system did as well. If so, it really doesn't matter whether it's still a bug-ridden mess. It's sort Zen: if a program is exploited and no one uses it, is it exploited? OK, that's kind of lame and not actually very Zen-like, but the point stands.

The only person who will care about Real being exploited is the guy at Real who has to have it installed because even though he uses iTunes, it's his job to have it installed and it will probably remain installed for the time being seeing as somehow the company still hasn't gone quite completely belly-up. I feel sorry for him (or her), but only because he/she works for Real, not because of anything some Russian security dudes might announce.

Re:Irresponsible

[Myopic]

To be clear, are you claiming that Russia doesn't have courts of law?

I've never been there so I can't say personally, but I always figured they had courts similar to every single other country in the world.

Re:Irresponsible

[arth1]

IMO, "repsonsible disclosure" is "We will disclose in 30/60/90 days (depending on severity of bug and how much manpower is needed to fix it) -- you are now responsible for getting a fix to your customer before then".
Too many companies think that "responsible disclosure" means that they get to decide whether to disclose, and all responsibility is on the ones rude enough to find the problem. I.e. shoot the messenger.

A few (luckily few) companies even send their lawyers after anyone who tells them about security flaws. In which case I don't think it's in any way wrong to choose to not risk dealing with the company, but instead do an anonymous disclosure -- that way, the paying customers can at least be alerted and take precautions, even if the company doesn't fix it.

(As for "0-day", it's not zero-day anymore when a flaw has been disclosed. Zero-day exploits are those that occur before a public disclosure. I know I'm fighting a losing battle here, because most everyone uses the term wrong to mean first-day exploits.)

Re:Irresponsible

[blueskies]

So, how would that change GP's process?

Not having to waste time?

Re:Irresponsible

[DriedClexler]

In Soviet Russia, vendor warns YOU!

Re:Irresponsible

[Kalriath]

or get a court to sign a gag order against you in a matter of hours.

Has there been a precedent for that?

Blackboard, Inc.

Re:Irresponsible

[Anonymous Coward]

There are no courts in Russia?

Re:Irresponsible

[Tim C]

That's not how I read the summary at all - I read that he's told (some) vendors in the past and they have done nothing, so in the future he's not going to inform any vendors at all.

Re:Irresponsible

[Anonymous Coward]

That's not really what I implied. It's highly unlikely that the vendor is also in Russia (see the list of vendors in the summary). Thus, any Russian court system will be useless. From experience I can tell you that it's impossible to file any legal injunctions from outside a country (except for the US) and we've tried in Italy, Russia, and several other European and South American nations. You have to spend A LOT of money "greasing the system."

In any case, I think it's up to the original AC to prove that you can get a gag order "in a matter of hours" on a Russian company from outside OR inside Russia. I would wager that he's thinking of the US court system.

So, what are they selling?

[0racle]

Some firm draws up a press release that they're going to drop the bomb on every piece of software they could get their hands on that is used everywhere in the world for one thing or another.

Right, what are they selling again?

Re:So, what are they selling?

[paziek]

They could be providing auditing services. Advertising to whole IT world, that they found shitload of them might just say "Hey, we can check if your apps are safe, and perhaps recommend something better if they aren't."

Re:So, what are they selling?

[Blakey Rat]

From the blurb in the summary, it sounds like "jackassery."

Nice short term marketing gimic

[Megaweapon]

"Pay attention to us, we'll disclose everything up front before everyone else! BTW, here's our products and services."

Is it just me?

[gregarican]

Or is the English language dying a painful death on /. as time passes. The past day's article summaries and headlines are a blend between Yoda backing off the chronic and the broken English that some toy assembly manuals convey.

Seriously, it took me three passes at reading this article headline to understand what the hell it meant. Maybe that's part of the entertainment value that I'm missing???

Re:Is it just me?

[Arancaytar]

You got stuck on the DROP DATABASE, didn't you. Happens to a lot of db developers. :P

Re:Is it just me?

[b4dc0d3r]

It's a high concentration of words and/or phrases having overloaded meanings. As technology develops, normal words acquire additional connotations, if not denotations. Since this is a tech-oriented news aggregator, you should select the tech connotation first, then re-parse with non-tech meanings if that fails.

'Drop' in this case can be parsed in the sense of 'vendor drop', meaning 'deliver' or 'drop a bombshell'. Not typical usage, but not uncommon. 0-days obviously refers to vulnerabilities, and conflated would refer to details of the vulnerabilities.

So it's valid, but potentially confusing.

Re:Is it just me?

[bennomatic]

It's the hip-hop definition of 'drop', i.e., "Yo Dre! Drop me a funky-ass bass line!"

Re:Is it just me?

[dissy]

You got stuck on the DROP DATABASE, didn't you. Happens to a lot of db developers. :P

Poor little Bobby Tables...

Re:Is it just me?

[FlyingBishop]

I initially read it as "Film to drop database, Web Server 0-days"

Re:Is it just me?

[gregarican]

Ahh yes. Eazy E's fucked up and the 8 ball's rolling. Why didn't I consider that?

Re:Is it just me?

[stimpleton]

yeah me too. I have been in the biz for 20 years. I havent typed "drop database" very often, and to see it appear is actually rather traumatic as it can mean very bad things. Is ok, i composed myself after a moment, but yes, I stopped in my tracks. Sad or what?

Responsible disclosure works

[gweihir]

But you need to gove the vendors hard disclosuyre dates not too long in the future and you need to publish at these dates stating when you informed the vendor. If the vendor does not patch, publish the vulnerability anyways, you have done your part.

As others have already said here, this strikes me as a publicity stunt, or they wanted money from vendors and did not get any.

Re:Responsible disclosure works

[jjoelc]

Agreed - inform the vendor with all the details. Same day, publicly announce that the vulnerability has been discovered, but with no details. At a specified date (60-90 days later) make full details public.

Sounds so simple, doesn't it?

Re:Responsible disclosure works

[Fulcrum of Evil]

I live in the US - they'd just get a gag order slapped on me. Better to just publish the exploit and metaphorically napalm their village

Re:Responsible disclosure works

[gweihir]

I live in the US - they'd just get a gag order slapped on me. Better to just publish the exploit and metaphorically napalm their village.

Well, the US is special in the western world that its legal System is really FUBAR. Combined with the ususal arrogange US citizens have as a group about their cultural superiority (typically without even knowing the alternatives), this seems unlikely to change.

You can still use an anonymous way. Or maybe a clearing-house could help for this particular defect in the US legal system?

Re:Responsible disclosure works

[Fulcrum of Evil]

best just to pull the trigger and let the software company suck it. That way, I don't get a legal sanction.

secutiry theater gate crashers

[Theodore]

I welcome this.
In ancient ages past, we put up with "It's a theoretical attack, no one could actually execute it"...
to "group X has released a THEORETICAL working example of an attack to the public, so we fix it six months after revealing it to us"...
to "Here is how you fail... here is how to make you fail... FAIL!!!"

'responsible disclosure' is just wearing the nice guy badge...

You're the only one wearing the nice guy badge.

I'd rather see "Oh CRAP! This thing in Word is broken!" "Oh CRAP! This thing in Excell is broken!" "Oh CRAP! I went to look at a brittany spears vid and now can't move my mouse! Why is my DSL light blinking a lot?"
And then see it fixed in a day or two (at most), rather than a month or two (if we're lucky).

Re:secutiry theater gate crashers

[BitZtream]

Thats because you aren't likely to be the poor bastard who gets stuck with a broken computer because someone decided to tell the world about it.

This sort of thing is wrong.

I realize it appears to be the only way to solve the problem, but two wrong doesn't make a right. Find another way, 6 billion people on the planet and no one can figure out a better way to get vendors to fix problems than putting millions of PCs at risk? We can make the Internet but we can't solve this problem without being douche bags? Really?

Re:secutiry theater gate crashers

[Anonymous Coward]

Brittany Spears vid? Is this 2002?

socialized risk

[epine]

This is one of those issues where the instinct of any good capitalist is to privatize benefit and socialize risk. When you screw up in the auto industry, the company faces the massive expense of a product recall. That helps to keep you honest with your engineering quality.

I personally think 30 days is a reasonable notification period. Not pleasant for the vendor to have to respond that briskly, but this isn't about being pleasant. If the vendor wants pleasant, they should invest more competence in the original product. This isn't easy, and might move a few pointy-haired managers out of the executive suite.

Probably a more viable compromise is eight weeks. This adds a thin margin for the possibility that key zero-day SWAT staff are booked off, that multiple issues are raised concurrently, or that a product has a stupendously long build cycle.

I would be thrilled to see an industry standard put in place where everyone knows the ethical notice period is eight weeks, period, perhaps with the odd extension on a track record of good behaviour.

I would also like to see proprietary TCO calculations updated with a term to account for the customer disruption of having to rapidly deploy a not-tested-for-months-at-a-time critical vulnerability patch.

Speaking of which, that whole TCO thing really bends my biscuits. It's just loaded with sly neglect of not entirely apparent costs, of which the year-long critical vulnerability update is one of the more egregious.

During that time, your pants are down if anyone less ethical discovers the same flaw. It never happens that two scientists make the same discovery in the same year and end up in priority dispute, according to the industry of socialized risk.

Re:socialized risk

[mcgrew]

This is one of those issues where the instinct of any good capitalist is to privatize benefit and socialize risk.

Sometimes I think I've been transported to Ferengenar. 95th rule of acquisition: "Exploitation starts at home".

Re:socialized risk

[zippthorne]

What they should do is to meter out the information.

First day: notify the software company and enter info in the database.
-- info should include specifics, name of the program, an estimate of severity, and any info which can be released without actually revealing enough of the nature of the bug to continue.
-- The web site should handle allowing access to the specifics after the specified time.
-- The software vendor should be able to enter comments
-- The software vendor should be able to request extensions to the "full disclosure" date.*

*there should be a fee for each extension, and there definitely should be a public explanation for the need for extension, but somehow this feels like extortion.

Let the web site software handle out the metering out automatically, though, so you don't have to waste time butting heads against the software vendors.

Re:socialized risk

[Anonymous Coward]

When you screw up in the auto industry, the company faces the massive expense of a product recall. That helps to keep you honest with your engineering quality.

A new car built by my company leaves somewhere traveling at 60 mph. The rear differential locks up. The car crashes and burns with everyone trapped inside. Now, should we initiate a recall? Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one. source

"Son, people will always try and fuck you. Don't waste your life planning for a fucking, just be alert when your pants are down." source

Minimum amount of effort for maximum amount of reward.

What about bobby tables?

[0100010001010011]

This guy should rename his name to Bobby Tables at the same time. Imagine the number of newspapers that would try to do a press release, but couldn't.

Re:What about bobby tables?

[Anonymous Coward]

I don`t get it, what`s the big deal with Robert'); drop table students;--

ERROR 1051 (42S02): Unknown table 'students'

Better handled through a service like Wikileaks?

[Anonymous Coward]

It seems only slightly less irresponsible to publicly disclose exploits without making companies aware of them than it is for companies to disregard known security flaws in their own products.

RFPolicy struck me as the best compromise, but maybe there's room for a third-party service to hold exploit information in escrow for a defined period of time then release it. If a company knew that they had a couple of months to fix a problem at the outset, and that nothing was going to stop publication, that could provide additional encouragement to address the problem.

At the expense, of course, of being a really crappy way to treat companies who ARE proactive about their security issues, especially as a security researcher doesn't always necessarily have the full picture of what's necessary to fix the problem in cases where it's intertwined with required software features. That's probably the most significant aspect of RFPolicy -- the dialogue and collaboration between security researcher and software developer to determine the scope of the problem and the potential solutions.

It's Irresponsible

[SwashbucklingCowboy]

While I don't blame them for releasing two year old vulnerabilities, they're going too far by not giving firms ANY TIME to fix vulnerabilities. Give them six months and then release them, but give them time. This does as great a disservice to users as those firms do by not fixing the vulnerabilities.

Re:It's Irresponsible

[Hatta]

So what you're saying is that we should give the black hats 6 months to freely exploit these vulnerabilities?

Re:It's Irresponsible

[Microlith]

Apparently people cannot read. These vulnerabilities are two years old. The companies have been notified and their response is not to fix the security hole but to ignore the reports entirely.

If you knew the inevitable result of every notification you gave to developers was to be ignored and have nothing come of the 3 months (or longer) you gave them, would you bother trying again, or just consider the goodwill pointless and get right down to the business of forcing them to fix their screwups?

drop database?

[gringer]

Shouldn't it be, "firm to SELECT 'Database', 'Web Server' FROM 0-Days;"?

Re:drop database?

[toastar]

Shouldn't it be, "firm to SELECT 'Database', 'Web Server' FROM 0-Days;"?

no no no.... In soviet Russia, Database SELECT you!

Bug bounties

[zullnero]

If more firms paid bounties for bugs found (as long as responsible disclosure is followed), you'd probably see a whole lot more security researchers content to follow responsible disclosure guidelines. There's no guarantee that they'll keep that all a secret in any case, but to get the cash, you've got to sign a legal form with your company's information or be registered as a valid security analysis firm. One of the biggest issues with these security analysis firms is that there's no way to tell most of the time if it's just a bunch of criminals hiding out under a corporate umbrella, or if they're bonafide security professionals. And no jokes about them being one and the same...there's a huge difference, I've known (and in the case of those pros, I've worked with them) guys from both sides. If a security firm refuses to be registered or refuses bounties, you know there's something fishy about them and it's time to contact local authorities.

Then again, there's the big problem with many of the bugs that outside security firms reporting being already known and in a work backlog. The realities of the industry is that capital isn't unlimited, time isn't unlimited, and sometimes, important stuff doesn't get done because you just don't have enough qualified developers to throw at the problem. Two years is fairly excessive for a security hole to sit around, but if a security firm is releasing exploits that it discovered and reported 6 months prior just because it "didn't see enough getting done", that's not being passionate about security, that's an attempt to commit extortion.

Re:Bug bounties

[Anonymous Coward]

what crap. Vendors can't afford to make bug discovery lucrative enough to the point where the researchers aren't better off doing things there own more publicity oriented way, if you are deluded enough to think that the majority of security researchers are doing this selflessly to simply make the world safer then I have a bridge to sell you. Vendors would have to pay 10's or thousands for every bug, it is just not finiancially viable for many.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Assertion in point B

[forand]

The problem is with your point B.

Fix the bugs that are "theoretical" and MAY be exploited at some point in the future if somebody else finds it?

You are asserting that the exploit is '"theoretical" (why the quotes?) and might be used in the future without any evidence that this is even the most common case much less the only case. The problem with an undisclosed vulnerability is that unsuspecting users believe they have more security than in fact they do. They expect, at very least, to be informed when a vulnerability is discovered. While this may be an unrealistic expectation in the current market place, customers should be able make informed decisions and thus operate in the market as their roll demands.

The watering-down of "0-day"

[Captain Spam]

But... if these were vulnerabilities that this firm has known about for products which have been released for some time now, plus they've been sitting on this information for a while, how exactly are they 0-day exploits?

Re:Why not? Because it's a PITA

[clintp]

Perhaps what we should suggest is starting off with a nice long "advanced notice" period with a vendor, 2 or 3 months. Each time they fail to act within that window, you decrease it slightly for the next bug you report. With time, this might stabilize on a reliable period for that vendor. Of course, this only works if you have a long-term business relationship with that vendor. In many cases, people are likely to give up long before the asymptote is reached.

This requires an awful lot of patience and a fair degree of bookkeeping on the part of the submitter. And you're assuming that the organization on the other end of the bug report is actually learning from past mistakes in a cause-and-effect kind of way. "Hey! His report-to-release times are getting shorter! Maybe we should adjust!" In an organization of any size, this will be unnoticed even when pointed out plainly.

The more I think about it, the more receptive I get to this fellow's approach. Maybe after a while of "irresponsible disclosure" vendors will pay attention and he can fall back to giving advance notice.

I'd feed better if

[Ungrounded Lightning]

I think that apparently the vendors aren't doing a damn thing to patch a good amount of these reported vulnerabilities if they are being reported in a proactive manner. Seems as if once the exploits are running rampant in the wild then the vendors scramble to develop patches. Not the best business practices all the way around, but it's the way it is.

I'd feed better if, rather than lumping all the vendors together and 0-day disclosing vulnerabilities found in any of them, Intevydis tracked which vendors failed to respond and continued to give the others warning.

Maybe a 3-strikes policy. Or (for vendors with large products and lots of opportunities for bugs) a percentage of slow/no vs. fast fixes.

And the newbies should be assumed responsive until proven otherwise.

Seems to me that would put even more pressure on companies to be responsive, by giving the responsive among their competitors two additional advantages:
  - time to fix the bug, and
  - customer perception that the unresponsive vendor might be subject to sudden attacks due to disclosed vulnerabilities when the responsive vendor would both get warnings and have a track record of fixing before disclosure.

Agreed.

[chaboud]

Clearly the balance of incentives has been wildly off for some time now. Researchers finding possibly big-cost vulnerabilities and reporting them to vendors/middlemen have found that the responses to their discoveries have been slow. Additionally, the payouts for these researchers has been relatively low.

They've been slow because companies have very little incentive to actually fix these bugs, provided that the rate of exploitation of these bugs is sufficiently low.

The incentives for a company using commercial software are stacked heavily against disclosure (do they discover the intrusion? angry customers upon disclosure? etc.), and software vendors are rarely motivated by costs that are, probabilistically, very low. Only once companies are hit by the overwhelming stigma of wide-spread exploits, and the long tail of consumer distrust, do they take greater care in the future.

Companies these days get the sense that they can dodge 180 days of exposure for the price of a used Honda Accord, but the reality is that knowledge of the bug may not be a significant contributor to the risk of exploitation. If one honest researcher has found a vulnerability, can we be confident that no malicious researchers have? Hell, every little wanna-be hacker and future programmer among us used to have floppies and notebooks of vulnerabilities, some collected, some personally discovered. The vulnerability is the source of risk. Put the blame back on the companies that have failed to fix them. More accurately, shift the incentives . With huge shake-ups like mass disclosures, the effect on all companies could be a shift toward more attention being paid to security. To me, it seems like a net win.

Soviat RUSSIA!!!!!!

[Anonymous Coward]

In Soviat Russia information is releasing YOU!

Embargo

[unixan]

Legerov said. For example, he said, “there will be published two years old Realplayer vulnerability soon, which we handled in a responsible way [and] contacted with a vendor.”

I think that apparently the vendors aren't doing a damn thing to patch a good amount of these reported vulnerabilities if they are being reported in a proactive manner. Seems as if once the exploits are running rampant in the wild then the vendors scramble to develop patches

It's most likely a case of resource management and insufficient resources available.

One word can solve the difference between responsible reporting and 0-day motivation:

embargo

The reporting security group still goes through responsible reporting methodology, but add proposed date the details will be reported more fully to the public.

I work for an enterprise-level network device manufacturer, and anyone in that line of work knows damn well that remote vulnerabilities are the harbinger of death if they're not addressed in a timely fashion. Yet, motivation to assign resources to fix it still relies (in part) on whether there is a public exploit or not. So it's with that background that I can say that embargoes work.

We don't know the details, but apparently Intevydis didn't give embargo dates along with their reported vulnerabilities. Now they see what kind of motivation that produces, and so they've set a pseudo-embargo: any time between Jan. 11th and Feb. 1st.

Slashdot = Stooopuds .. get a clue dolts

[Anonymous Coward]

Slashdot'ers don't know IT security obviously. These guys are one of the top professional exploit writing crews on the planet. They have been selling VulnDisco an awesome 0day exploit addon pack for Immunity Sec's CANVAS exploitation framework for years. We are not talking about some silly little company, the Intevydis guys are hardcore... they are selling a bunch of nice 0day exploits and simply being generous by giving away such valuable information for free this month. All the people bashing their disclosure choices are fools; this caliber of security crew is not going to give away all of their valuable intellectual property for free, get over it.. stop living in fantasy land, those guys are not morally obligated to spend their life slaving away doing basically free high quality QA work for big multinational mega-software giants. They do their work, they write their 0day, they sell it and pentesters and intelligence agencies and everyone who cares, buys it. Note, the vendors in question could also buy VulnDisco and CANVAS and then they would have the 0day (with proof of concept / exploit code) for a cheap price (much less than trying to hire a security analyst of that caliber) and they could have detailed information about the vulnerability and be a couple steps closer to fixing the vulnerabilities they want to pretend like they care about.

Headline style

[Anonymous Coward]

Firm To Drop Database, Web Server 0-Days

Maybe it's just me, but does it make sense to use newspaper headline style, which was designed a century ago to convey information in minimal horizontal space, in an electronic format? What would have been the cost of writing this headline as "Firm to Drop 0-Day Exploits for Databases and Web Servers"? As it is, I thought that some firm was dropping their database and going back to 100% paper records, and I couldn't really make sense of the phrase after the comma.

Naah.

[gelliantgutfright]

Surely the beta stage is the time for 'responsible disclosure'? Once it's publicly released, then you're not likely to be the only person aware of the vuln. Why should you act responsibly on behalf of the guys who are taking your money for the privelige? If it's fit for sale, it's fit for purpose.

Call it "Limited disclosure"

[jonaskoelker]

Responsible Disclosure [...] is a deliberately positive term for purely demagogic reasons.

Which is why I advocate calling it "Limited disclosure". That's a value-neutral term that fairly accurately describes it---and about as precisely as you can be in only two words.

Or call that other thing "Effective disclosure" if you feel a need to play the game of rhetoric.

Bounties

[Anonymous Coward]

So, what's wrong with bug bounties? Why can't russian hackers expect to be paid for their hard work hacking american software and documenting vulnerabilities?

The fact is, there's already a bug market. If you're a hacker without morals, you can already make good money off security flaws, by selling them to criminals directly. But, if you should do the world a public service by pointing out these security breaches to the software vendor, not only will they threaten you to sue if you publish, but no reward will be coming.

Of course, by offering rewards, you're creating perverse incentives for people to find bugs. Also, you're creating a bidding war between the criminals who want to know bugs to exploit them, and the legitimate software vendors...

Irrelevant Disclosure

[cenc]

You know there is one more choice.

What if they disclosed them responsibility, and the vendors responsibility evaluated them and came to the conclusion they are no threat. That would be irrelevant disclosure.

Likely not as bad as it sounds.

[icepick72]

Maybe his remarks are just missing something in translation.

Damn right

[Sean]

You tell 'em Legerov. You have absolutely no obligation to work with vendors or projects. If they don't help you fix bugs, they should expect to hear from you in the comment at the top of your PoC.

I did the same w/ Microsoft recently: Had to! apk

[Anonymous Coward]

"He's a step ahead of you. He's tried doing it the right way and gotten no results. So he's going to skip the part where he wastes his time.

If companies want responsible disclosure, they should respond in some way to the disclosure. Maybe companies will actually fix bugs instead of sitting on them, and he can go back to doing it the right way. He also warned the companies he's going to do it, so they have a chance to fix things before then.

Here's a tip for you. In the real world, sometimes you have to force the other party's hand to get them to act responsibly. He's to that point, and fortunately has leverage. By making this choice public, he shames the irresponsible software companies which allow security problems to sit around unfixed.

Hopefully they'll scramble to release some fixes, which they haven't done yet, which is a net improvement over the current situation where millions of people have unpatched vulnerabilities.

In short, I don't see a problem here. I use software, it has security problems, I expect those to be fixed. Whatever it takes to get there, I'm all for it." - by b4dc0d3r (1268512) on Monday January 11, @03:57PM (#30728526)

Agreed, 110%, per my subject-line above... it works (quoting Tony Stark there, on his "arc reactor technology", because what I turned an MS mgr. onto here, Foredecker, results in the same idea (smaller & faster HOSTS files)):

http://slashdot.org/comments.pl?sid=1467692&cid=30384918

I had to "hound" the guy here, which IS unfortunate, but... he is now looking into it on his end with his people @ Microsoft finally (which is great - my goal? Simply to make Windows VISTA/Server 2008 & yes, Windows 7 THAT MUCH BETTER really).

APK

P.S.=> I had "sort of troll" he here though (albeit with GOOD MOTIVES - to improve MS' latest OS' really) &, for months here actually, until he replied here, & we "debated it", & he "saw the light" of what I was stating is poorer than it ought to be in HSOTS files (which are INVALUABLE for speed online, but moreso for SECURITY online).

So, he finally wrote me personally via email a couple days back & he notified me he is going to find out WHY 0 was removed as a valid blocking address in HOSTS files @ last, with his IP stack team @ MS (he has the pull, he is senior mgt. there apparently which is great imo, & I hope this even helps the guy get a promotion there).

The use of 0, vs. 0.0.0.0 & especially vs. 127.0.0.1 as blocking addresses in HOSTS vs. KNOWN bad adbanners &/or malicious sites + botnet "C&C servers", works & on a VERY SIMPLE PRINCIPLE, the blacklist ("you can't get burned if you can't go into the fire" type thinking).

It matters, for efficiency & performance, & literally "HUGELY" for the speed of its internal parsings, line-by-line, as well as the filesize on disk!

(I.E.-> Using 0 as a blocking address in HOSTS files yields FAR smaller HOSTS files, especially in HOSTS file with many thousands of lines as mine is @ 655,500++ lines or so currently, vs. those that use the 0.0.0.0 (which is the tiniest you can use on VISTA/Server 2008/Windows 7 only), & especially vs. 127.0.0.1, which also incurs a "loopback operation" too).

So, E.G.-> I used the SAME BASIC TECHNIQUE to get to MS' folks on this, because they "blew me off" here on their "Engineering Windows 7" blogs here -> http://blogs.msdn.com/e7/archive/2009/02/25/feedback-and-engineering-windows-7.aspx?CommentPosted=true#commentmessage

Hopefully? Foredecker will do the job & get this fixed with his people @ MS... apk

WTF has happened to slashdot crowd?

[frn123]

WTF has happened? I remember when reasonable disclosure ment that the vendor was notified
and given 3 days to release a patch. AND that public was notified right away with no details.

Now some people speak about "responsible" (whatever that means) disclosure of 90(sic!) days!

Are you all gone mad collectivly?

Re:Why not? Because it's a PITA

[jc42]

Another approach might be that of the general winners in the iterated Prisoner's Dilemma game contests. The simplest stable winning strategy has turned out to be what is called "tit for tat", in which you're a nice guy and cooperate the first time you face a new opponent; thereafter, you do to them what they did to you the last time. In the long run, crowds of players using this strategy tend to collect all of the game's rewards.

With the current topic, you'd express it as giving a company advanced notice the first time you find a security issue with a product, and only make a public release after talking to them (or trying to) for a few months. If they respond reasonably, you do the same thing next time. If they ignore you, then the next time you release your find without notifying them (and maybe send them a note explaining why you did that).

One useful thing about this strategy is that you only need to remember the most recent incident for each company. It is interesting that in the periodic contests pitting strategies against each other, the general winner is a strategy with a fairly low memory requirement.

Of course, IANAGT (I Am Not A Game Theorist), and I can't tell you whether this result actually applies in the security-bug scenario. Maybe there are some game theorists here who can tell us.

The main complexity is the need to recognize previous opponents. This might be tricky, since it's really not the company that responds or doesn't. It's actually (groups of) specific people working for that company. From the outside, it can be difficult to learn who actually decides how to handle a bug report, and you could easily end up "punishing" a group who were trying to cooperate but were ordered by a superior to ignore you.

Disclosure

[fulldecent]

I am currently in the midst of a "responsible disclosure" nightmare, involving NDAs, the FBI, SEC and an online investment bank. For as much work, no pay and no recognition this "responsible" behavior is getting me, I don't know what is worth it.

Also, any advice on responsible disclosure in online financial situations would be appreciated.

Thanks.