Slashdot Mirror
The People Who Are Branding Vulnerabilities
antdude points out a story at ZDNet about how the naming of security vulnerabilities and exploits has evolved into branding and awareness campaigns. Heartbleed set the trend early this year, having a distinct name and logo to represent a serious security problem. It seemed to work; the underlying bug got massive exposure, even in the mainstream media. This raises a new set of issues — should the response to the disclosure of a vulnerability be dependent on how catchy its name is? No, but it probably will be.
Heartbleed charmed the public, and in a way, it was designed to do so. By comparison Shellshock, POODLE (aka clumsy "Poodlebleed"), Sandworm, the secretively named Rootpipe, Winshock, and other vulns seem like proverbial "red headed stepchildren" — despite the fact that each of these vulns are critical issues, some are worse than Heartbleed, and all of which needed fast responses. The next "big bug" after Heartbleed was Shellshock — real name CVE-2014-6271. Shellshock didn't have a company's pocketbook or marketing team behind it. So, despite the fact that many said Shellshock was worse than Heartbleed (rated high on severity but low on complexity, making it easy for attackers), creating a celebrity out of Shellshock faced an uphill climb.
Fuck naming shit to appeal to the plebes and media. It's not a popularity contest. It's a fucking security vulnerability that needs to be patched. You don't get points for media mentions.
If you want to think up shitty names for shit you have two options:
1: Go work for some Congressman's lawyer's office and think up names for bills that mean the complete opposite or what the bill actually does.
2: Go work for the restaurant industry and come up fresh and creative hits that can stand alongside "Awesome Blossom", "Crispy Honey-Chipotle Chicken Crispers", "Razz-Ma-Tazz Raspberry Iced Tea", and "Yummy Nummy Chicken Drummies".
Look, we all know we all are vulnerable. Naming helps people determine how much armor we need to deploy. Vulnerabilities that aim to fuck us up the ass need especially thick armor.
Time is what keeps everything from happening all at once.
Exploit programs and attacks have had clever names since the days of win nuke. Land, smurf, jizz, papa smurf just to name a few of the oldies.
Why every bug should be named by the same people? Make a Name Contest for each bug and raise public awareness still more, about their real danger!!!
Start alphabetically, and with a long list of random names (take randomly from US+other census data, or other large pools), and each successive vulernbility gets the next name from the list, no exceptions.
Not only did this work for hurricanes, this is actually how the US Government has decided on operation names for a while:
How the US Army choses operation names
Next vulnerability name - WAGTD (We all going to die!!!)
What's the point in making all vulnerabilities get so much main stream exposure? Heartbleed was special because it was important that people generate new certificates for their services despite the fact the the machines themselves were not compormised by malicious code. But apart from some special cases, what can regular users do against attacks? The answer is mostly nothing. They just have to wait for a patch and then apply it. So what is the point in all the scaremongering? I think promoting these vulnerabilities to people with no real interest in them does more harm than good.
For example, look at how the OpenSSL developers faced some rather personal attacks by some people in the media who have no clue of software vulnerabilities nor even know what OpenSSL really is. Errors happen, and the developers still did a great service to all internet users, all for free in their spare time. They don't care about recognition or money - they don't deserve to be put in a spotlight like this. It was disgusting really. They didn't force anyone to use their software, after all.
Where I work, Shellshock and POODLE definitely got the same level of attention Heartbleed did, if your IT department needs marketing to understand the issues you need a new IT department.
See? If HIV had a catchier name perhaps you would have patched your vulnerability.
i've discovered and authored some vulnerabilities and the names attributed to some of these vulnerabilities is downright funny.
I wondered why a vulnerability in a non-MS product like heartblead got its own catchy name and logo, ditto shellshock, but the _shit ton_ of vulnerabilities in MS Windows in November alone, with some much much worse* and no media coverage, no catchy name, no logo.
The MS Windows SSL vulnerability didn't just leak private information like heartblead, it allows arbitrary code execution at which point, you can get anything you could get from heartblead, directly, since you own the box.
The MS windows KDC vulnerability allows any unpriv user to get admin privs in any organization running MS Domains. Seems quite a bit worse than a few _rare_ websites running bash scripts as CGIs.
Seems curious-- especially the media blitz on non-MS vulnerabilities.
Even Apple's goto fail got more attention. than the terrible bugs patched in Windows this month.
The recent vulnerabilites that affect Linux got names and attention. Yet a 19 year old vulnerability got far less visibility. Why? Posting as AC because of the likely karma hit from the MS fanboys with modpoints.
noun: vuln; plural noun: vulns
a vulnerability, especially one associated with computer security.
According to Google, this usage of the word vuln has not been used much since the 1840s. Get with the times people!
Apparently, computer viruses were a big thing back then.
If you are not allowed to question your government then the government has answered your question.
Sorry but this term is quite offensive, and they way it's being used with the author's poor attempt to be cool is worrying. For those who think it's amusing, replace "red headed" with "black" in the same phrase, see what kind of uproar you get from the community.
Giving names is often part of propaganda. This is common in politics. No surprise that this happens in industries where lots of money is. Giving catchy names to vulnerabilities certainly was effective to raise awareness but once the storm is over people care even less or become immune. Especially if propaganda is evident, it does not work any more. Heartbleed was serious, but totally over hyped by the media, with poodle it worked less, with shellshock it was already pathetic Its best to keep being informed by trusted sources like Cert. What would be nice to know is a scale analogue to a Richter scale in earthquakes with a well defined gauge, taking into account how much damage the bug or malware has created, how many systems were affected in total, taking into account also a relative number.
"Heartbleed set the trend early this year"
Wait, this is NEW!? http://en.wikipedia.org/wiki/B...
"Vuln", seriously. What kind of pseudo geek speak is this. Sounds like some MTV/syfy made for TV movie goof jargon.
Shellshock was a terrible name. Not all shells were vulnerable (especially not non-unix shells), only bash. The name for the vulnerability's name should've had "bash" in it at least.
Heartbleed actually sounds physiologically dangerous. Shellshock (and some of the other names) sounds unfortunate. In fact, Poodle actually sounds cute...
"If a nation expects to be ignorant and free in a state of civilization, it expects what never was and never will be."
putting a patch over that vulnerability results in a lot of other problems.
Sleep your way to a whiter smile...date a dentist!
Before i patched problems and that was all now i walk through the office and for weeks and months i get to explain how yes we're now protected against the new SUPERDEATH exploit and then get asked to explain it to people who pretend to listen but then realize how unexciting the technical details of exploits are quickly and tune out, but still try to ask follow up questions based on more sensationalist media crap rather than anything that was said when actually explaining it
Keep all the complex interfaces and code if you need them, but put them behind very small paravirtualization codebase ingrained into the OS which keeps them isolated -- from the core system, and from each other. Really, even your devices like USB controllers and NICs can be treated as untrusted in this way if you have an IOMMU. And you can have it in a normal desktop GUI.
Kernel-implemented security is a failure; Its ridiculous to go through continued years & decades of pain by relying on it and worrying about breakouts from its weak sandboxing tactics.
I've used Slashdot Deals to find a sex partner--several, in fact! Do I qualify for membership?
Nowadays they do assign names to typhoons / hurricanes, and TFA gives me an idea ... why stop at branding vulnerabilities when we can branding disasters?
All we need to do is to supply a meme, a logo, a theme song, ... and we can even throw in a new aerobic dance step as a bonus!
Anyone thinks such a venture might sell? How about we crowdsource our funding @ www.kickstarter.com?
Muchas Gracias, Señor Edward Snowden !
A lot of people have no business being in charge of the security of a server. Those are the same people who need the media to bring an exploit to their attention. They might fix Heartbleed but they never fix CVE-2014-wxyz and others and their server is probably already compromised or could be anyway. Some of the hackers will help keep your system up to date, since they don't want some other hacker taking one of "their" servers.
I found Heartbleed very simplistic and how it went unnoticed for so long is impressive. Why the hell did it let you specify the number of characters to send back and never check that? https://xkcd.com/1354/
s/©//g
A content-aware firewall made of rubber is the professional solution.
'vulns' Seriously?
Heartbleed allowed unauthenticated remote attackers to steal server keys without being logged. Some huge percentage of the Internet wa vulnerable for the beter part of 2 years. How were any of the others even close to the impact and criticality of Heartbleed?
It is only an issue at all if you have web-facing services that fail. And they fall back to using bash if nobody bothered to put together a proper system.
All of which can be addressed easily without a patch. Don't open services to the web arbitrarily. Don't use bash for the web facing system. Wow! That was so hard to fix that massive security alert with the scary name.
Security holes, back doors, work arounds, failures are becoming mostly hype. The security teams are trying to push their brand forward. Buyer beware.
Nobody who actually works with security issues should really give a rats ass about it's name. On the other hand it's good that we have these shocking cool names every once in a while for the awareness of the general public. And with any luck some of those old computers might be patched. Most people have no clue, even in important positions who actually have the resources. And just the awareness for those key people is sometimes enough. It might not be that specific exploit they're thinking about. It's about not getting too lax on security.
What about the people in charge of hiring or budgeting?