Slashdot Mirror
Company Behind Badlock Disclosure Says Pre-Patch Hype Is Good Marketing (csoonline.com)
itwbennett writes: A new vulnerability in Windows and Samba, called Badlock, is set for disclosure on April 12, according to Badlock.org. Yes, this vulnerability has its own website and logo and therein lies the problem. In a Twitter exchange with CSO Online's Steve Ragan, Johannes Loxen, who registered the Badlock domain, called the pre-patch marketing a win-win, saying, 'A serious bug gets attention and marketing for us and our open source business is a side effect for us of course.' As Ragan notes, 'PR-driven vulnerability disclosure isn't something new,' and 'can be useful sometimes.' Marketing around Heartbleed, for example, 'generated tons of news coverage and quick reaction by administrators who worked long hours to patch vulnerable systems. There have been several since Heartbleed,' says Ragan. But in the case of Badlock, a 20-day lead time gives criminals plenty of time to tear Samba apart.
Are people still using those? LAN Manager had the only system I know where a 14 character password was better than a 30 character password.
Let's make some educated guesses about this problem.
1. It is a protocol-related bug, since it affects two different implementations.
2. It involves file locking, hence the name.
3. There might very well be some ruthless self-promotion going on here.
No matter how you look at it, it's a waste of attention for most onlookers. It's much ado about something that ought to be very small indeed, but to these chaps clearly isn't. The fact that this works is just more proof that the computer security emperor is still nekkid.
Vulnerabilities aren't profitable. The cockroaches who make money from their fallout might see it that way because that how racketeers think, but vulns hurt business overall. And that's setting aside potentially ruined lives because of identity theft etc. The heartbleed marketing fiasco brought out of the woodwork low-lives who made fake "test your system for heartbleed" pages. This is not a good thing.
It's a win win for the attention whores that are advertising it. But, it's bad disclosure procedure.
Vulnerability disclosure is important and should be done, especially when it is educational or is used to prod an unmotivated vendor to fix the issue. But, this is neither of those things. The vendor is fixing it and releasing a fix at the same time as the Samba team. There is almost certainly nothing of any real value to be learned form this vulnerability.
There is almost no reason at all for the public disclosure of this vulnerability. For those that would argue that the advertising campaign will get people to patch, they could easily advertise the need to patch without disclosing the vulnerability. Sure, anyone can browse the Samba code and figure it out for themselves, but that's not the same thing as running a self promoting media blitz.
Whoever setup this campaign is an attention whore, not a security conscious developer.
So isn't promoting your website on slashdot every time you post a story. Well, depending on who you ask it might be considered poor marketing as well. Slashdot doesn't give me a way to just not show anything you submit so I just blacklist csoonline.
Vulns are most assuredly profitable or there wouldn't be anyone looking for them.
nothing to see here - move along
"But in the case of Badlock, a 20-day lead time gives criminals plenty of time to tear Samba apart."
Now, Microsoft and Samba have been notified and are working to patch. The lead time gives them time to produce a patch before public disclosure. I would imagine that Windows 7 and 8 will not get patched at all (and certainly not XP or Vista), however, and Windows being closed source, this means that _nobody_ can do anything to rectify the matter. In the case of old free software OSs running an old version of Samba, people can still get the source and fix it according to information provided in the disclosure (or by Samba with regards to how it has been patched).
Let's see how long ppl put up with vuln marketing campaigns like this one. Then we'll know! Seriously, though, you're not correct. Vulns exist, and people make money patching them, but in the big picture they slow down industry. It's the difference between a garage that repairs cars and a manufacturer of car security systems that makes money fixing its own product. Cars are expected to break down, but if a car door lock has an exploitable vuln, you can imagine the backlash against trying a stunt like this. Having worked in IT security for years, I can attest that vendors try putting spin on vulns in their product all the time... And it blows up in their face every time.
you're confusing marketing with the underlying vulns. a used car salesperson is a used car salesperson. the underlying vulns make a lot of money. marketing depends on the skill of the salesperson. ever been to speakers corner in Hyde Park in London? Don't confuse Hyde Park'ism with people's natural inclination to believe what they hear.
nothing to see here - move along
Marketing aside, the main goal appears to have mass-patching occur all at once. The company's name is only mentioned in the background info and in tiny print at the bottom. Something tells me that it is a deep enough bug that unpatched systems will no longer be fully compatible with patched systems.
Yeah, that's marketing that really makes me want to give them business since they mind their p's and q's on such a big announcement; nice work Steve-o.
If not this, what is the best way to do responsible disclosure?
a 20-day lead time gives criminals plenty of time to tear Samba apart
Indeed, but it's a trade-off between the bad guys getting time to rediscover the bug, and the good guys needing time to schedule repairs.
Vulnerabilities in *other* products are the prize. Then these companies come knocking on the doors of the other companies to offer their services for private auditing, the ability to point to security papers in the wild being very valuable as a proof point.
Profitability is relative. Just like a broken window isn't good for the economy at large, it is however good if you are specifically a glass maker. It's more cost than profit overall, but if you are a company offering auditing services, you don't incur the costs.
If, say, Ford had a car door lock is vulnerable to something, and some *other* company finds it and gets all over the news, sure bad for Ford, but good for the company that finds it. That company will then contact GM, Toyota, Dodge, Honda, and so on and so forth with the cautionary tale of 'look what happened to Ford, we are so clever, we can help you... for a cost'.
XML is like violence. If it doesn't solve the problem, use more.
We shall see when the details are released, but in the wake of Heartbleed, I've grown desensitized to marketing treatment for vulnerabilities. Security people jump up and down and are frequently justified, but sometimes are just stating the obvious and/or something of low practical risk. The problem being in general security folks tend not to weight their 'discoveries', so it's hard to know if this time the sky really is falling (sometimes it really is) or they just didn't like some subtle design decision that actually isn't really invalid, just not how they would have done something.
XML is like violence. If it doesn't solve the problem, use more.
Jofas is looking at a larger picture than you are. Some individuals profit from vulnerabilities, but overall we lose.
They'd release the details on the bug 20 days *after* the patches had been released. Saying that they'll release the details on April 12 on the same day patches will be available is bogus. The fact that they made not just a catchy name but also a logo leads me to agree they are attention whores.
jofas said there was no profit. there is. as to who loses it's not home depot or target or tjx to name a few. furnace filters and dresses cost $.03 more, so we ultimately lose. all things designed and built by humans have bugs in them. that's a fact of life. the bugs lead to profits. so to risk repeating myself, jofas said there was no profit, there is. whether the company that advertised makes a profit remains, but someone does. recognizing who profits is important, saying there is none is wrong. to coin a phrase, those that don't know history are doomed to repeat it.
nothing to see here - move along
First. Please. The router and NAS devices aren't going to get a firmware update, possibly ever and no amount of advertising or powning is going to change that. New stuff would have the fix anyway so, it doesn't help there either.
There is literally no valid excuse for someone to build a website and launch a marketing campaign regarding this bug, other than to draw attention to themselves.
If Tridge steps in a says he supports the campaign, I'll gladly eat my words. Until then, this campaign is just grandstanding.
Yes. Vulns in "*other*" products. Not vulns in your OWN product, which you are expected to fix as part of the common social understanding of vendor-customer relationships. Using your example, imagine how pissed off people would be if Ford launched a campaign to announce they are recalling their vulnerable door lock... but only in 30 days, not before.
You're doing it wrong anyway.
Why guess when you can know? Measure!