Who really benefits from responsible disclosure?

Maritn - I'm CTO and

Maritn - I'm CTO and co-found of StillSecure with Alan Shimel. It's really time to call "foul" on the current vulnerability notification process. The reality is that it has become more about public relations that forewarning users or aiding others to protect their networks. Case in point; Symantec on July 19 announced vulnerabilities in the early builds of Microsoft Vista. What's the aim of such an announcement? It's not to forewarn users, it's to draw attention to Symantec and pile on more negative publicity to Microsoft. That's the equivalent of "crying wolf" which does far more damage by desensitizing everyone from real threats. When it is a pot shot then let's call 'em like we see 'em.

Mitchell

This debate will go on and

This debate will go on and on. What is needed is an industry standard recognised approach to responsible disclosure that jointly benefits the end user, researcher and Vendor.

Specifically, responsible disclosure should (as far as possible) be governed by benchmarks that allow all concerned to measure "timing" aspects of both the initial disclosure and patch development/cycle.

e.g. If the defacto standard for a Critical IE vulnerability turnaround is 3 months (in the words of MS) then we have something by which to measure their performance. If they fail to achieve this date (in my opinion) the researcher has the right to go public!

In support of the above, look at the vulnerability publicly disclosed last November by the British Security company Computer Terrorism (UK) as read here at CW. The issue in question was reported to the vendor as early as May, but MS did not acknowledge the vulnerability as serious. As a consequence, the Security firm decided to go public drawing attention to the fact that the issue was VERY serious indeed.

The net result was a patch within 2-3 weeks.

The current unwritten disclosure process serves only to protect the Vendors bottom line – not the end user and/or researcher!

The real problem with

The real problem with responsible disclosure is that it treats vulnerabilities as business-as-usual. With instant disclosure, and to a lesser extent with the current "system" (i.e. the hodgepodge of disclosure policies), the vendor's best method of preventing bad press is vulnerability prevention. Prevention also benefits the consumers and the community at large. Maybe on some planet vendors are doing all they can to prevent vulnerabilities, but not on mine.

Vulnerability researchers

Vulnerability researchers have the right weapon in their hands to push vendors on faster response times for security issues. I think that the best sample of how this should be done is David Litchfield. He does responsible disclosure, and uses gradually public advisories to push vendors (in his case, Oracle) to a more responsible attitude. HD Moore is being a bit selfish on this IE case, IMHO.

Instant disclosure brings too few benefits to victims (most cases don't have usable workarounds) and huge benefits to a very broad black hat community. I think that the fact that there could be people exploiting the undisclosed vulnerability doesn't mean the rest of the bad guys should also know it.

A mixed approach, with instant announcement of an open issue, without further details (only the product affected and the date when the vendor was informed) is the best option. Public disclosure can be used later if the vendor refuses to fix the hole.

The analogy of a fire in a

The analogy of a fire in a crowded theater cuts both ways; what about the vendor who's trying to hide the fire, hoping they can put it out before anyone notices. Alan and I have had part of this conversation in a Security Roundtable recording we did last night, I'll let you know when it's online.

I like the quote, by the way.

Martin McKeay
martin_cw@mckeay.net
http://www.mckeay.net/
http://www.securityroundtable.com/
Voicemail: 916.231.9479

Martin and Alan, I posted

Martin and Alan,
I posted about this on my last CW blog post, and I said that I have some issues with how HD Moore is doing this. However, if you give the vendor as much time as HD Moore has given MSFT, then you have to start doing something to get it fixed. So I agree with Martin on this one.

Michael

Better be despised for too anxious apprehensions, than ruined by too confident security.
Edmund Burke (1729 - 1797)

Martin - as we spoke about

Martin - as we spoke about last night on the security roundtable podcast. I really think instant disclosure is akin to yelling fire in a crowded movie theater. I will be writing a formal response in my blog at
http://ashimmy.typepad.com