See your link here
Responsible Disclosure: eEye vs. Microsoft
11 comments- IT TOPICS:Operating Systems, Security, Software, Windows & Microsoft
I've made no secret of the fact that I'm not the biggest fan of the practice of 'responsible disclosure' , at least the version where the vendor has all the control and can cry foul whenever a researcher discloses anything. I believe that Microsoft and other vendors use responsible disclosure as a shield to prevent researchers from notifying the public about vulnerabilities and keep everything running on the vendor's schedule. Apparently this is exactly what is happening in a dispute over a vulnerability introduced by a patch earlier this month from Microsoft, MS06-042. This Internet Explorer patch fixed a large number of vulnerabilities, some published by Microsoft, some fixed without notifying the public, while it also created a new vulnerability that could crash IE 6 and allow a malicious web site to execute arbitrary code on the target computer. eEye discovered the vulnerability , notified Microsoft and sat back to wait for a patch. The patch was apparently ready several days ago and was supposed to be released yesterday, but was apparently delayed due to problems with the patch and SMS. Not a problem with the patch, just a problem with how it's being distributed to big businesses.
eEye has taken exception to the process , and, predictably, Microsoft has cried foul and is saying eEye is not practicing responsible disclosure . My friend, Alan Shimel, also had to chime in with his own opinions on the subject. Alan and I have disagreed on this subject before, but I think the core of our argument is well illustrated by the issue between Microsoft andeEye : the problem is not with the concept of responsible disclosure, it's with whose definition of responsible disclosure you use. According to eEye, they've practiced responsible disclosure by notifying Microsoft, waiting an appropriate amount of time before notifying the public and not disclosing the specifics of the vulnerabilities. According to Microsoft, eEye has not practiced responsible disclosure because eEye isn't waiting for Microsoft to have all of their ducks in a row and is proceeding despite the fact Microsoft is having problems with their distribution system.
You might be able to guess which side of this argument I'm on.
One aspect of this argument that I find interesting is that Microsoft has actually released more details of the vulnerability and how it's exploited than eEye has. On their site, eEye states that the vulnerability exists, but then points to Microsoft's pages for details on how to mitigate the vulnerability, which is where the bulk of the information exists. A malicious coder is going to get more milage out of reading Microsoft's site than they ever will out of reading what eEye has disclosed. So who's practicing responsible disclosure here?
I like the concept of responsible disclosure, I just believe that the software vendors have too much of a stake in the process to be the ones who call the shots. I'm not trying to pick on Microsoft, they just happen to be the latest, highest profile example; even eEye is saying Microsoft has improved their disclosure process in the last several years. But vendors definitely have a vested interest in the process and shouldn't be the ones who get to define responsible disclosure. eEye might not be the best ones to define it either, since they also have interests of their own in publicizing vulnerabilities. The ideal thing would be to have a group like the IEEE define and manage the process, but even they haven't been able to get a handle on disclosure, mostly because of internal politics. So I guess the debate will continue and each party is going to have to define responsible disclosure on their own terms.
Print
Email this
Digg this
