Feeds

The value of vulnerabilities

To disclose or not to disclose? That is the question

  • alert
  • submit to reddit

5 things you didn’t know about cloud backup

There is value in finding vulnerabilities. Yet many people believe that a vulnerability doesn't exist until it is disclosed to the public. We know that vulnerabilities need to be disclosed, but what role do vendors have to make these issues public?

One of the things I really love about information security is the large number of different technologies involved. With personal computers alone, there are all sorts of architectures, operating systems, devices, and protocols to learn about. There's never a shortage of information to digest. It's hard to maintain a balance between knowing a little bit about everything, and understanding some specific things at a very deep level.

When it comes to vulnerabilities, there is already a large spectrum of understanding associated with them. From a high level, that understanding may simply be about what technologies are affected and what the exploitation results are. In contrast, if you get down to the lowest level, as a researcher you can explore the vulnerability in gruesome detail - how exactly the vulnerable code was found, and how the issue can be exploited. At this level, there's even a big difference between knowing how to exploit a vulnerability and actually exploiting it. And of course there is some middle ground between the high level view and the view a researcher might have. This middle ground might enable people to implement technical mitigations for the issue, and otherwise understand the vulnerability at a level deep enough to pinpoint and protect against the attack vector associated with the vulnerability - even if these people might not understand the intricate technical details themselves.

Some vulnerabilities have a very small gap between these levels, such as the case of a simple SQL injection issue. Here, someone with a very high level understanding of the issue would probably not have too much trouble figuring out or learning how to exploit it. On the other hand, there are vulnerabilities where the gap between these two levels is immense. The Symantec Firewall DNS parsing kernel stack overflow of 2004 is a great example of that. Exploiting this vulnerability was something that only a select group of people would have been able to accomplish in a reasonable amount of time.

Before I digress too much further, let me just say that I find vulnerabilities to be fascinating little things. Each one is unique, and each one has its own subset of knowledge requirements to fully understand it.

Where do vulnerabilities come from?

Although this might sound like a simple question, the answer isn't always simple. There are two schools of thought about where vulnerabilities come from, so I'll discuss each as we explore further.

Most public vulnerabilities are disclosed by a security researcher, and more often than not these are on a major security-related mailing list such as Bugtraq. A security researcher can be an employee of a corporation, a full-time independent researcher, or even an audit-by-night researcher who simply glances through code in his spare time. In some cases, the person who discovers a vulnerability may have done so simply by accident. In most cases, discovering and researching a vulnerability in its entirety is a pretty intensive process that may involve a lot of skilled man hours.

Now, for whatever reason, the public disclosure of a vulnerability is often considered to coincide with its very existence. Even the often-used term "zero-day" seems to imply that an undisclosed vulnerability doesn't really exist yet. This belief is a mistake that too many people make. It's as if people are under the impression that these vulnerabilities don't actually pose any sort of threat until they're publicly disclosed. If a vulnerability is discovered in the proverbial forest, and no one hears of it, then people think it isn't really a vulnerability, so to speak.

The process of "responsible disclosure" requires security researchers to sit on information until vendors have released patches for it. In the past, we've even seen hostility between vendors and security researchers, who have two very different opinions on disclosing this information. Vendors want the time to fix the problem, which can be a pretty involved process. Security researchers disclosing this information to vendors are obviously looking to have the issues addressed, regardless of whether or not it's their primary reason for disclosure. And although these seem like similar goals, conflict often arises.

Currently, it would seem that the security industry as a whole acknowledges vulnerabilities on their disclosure date. In some cases, these issues are reported to vendors weeks, months, or even years before disclosure happens. There are no guarantees, and therefore I think it would be pretty naive to believe that the person reporting the issue is the only one aware of its existence. That in itself is pretty frightening if you think about it.

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
JLaw, Kate Upton exposed in celeb nude pics hack
100 women victimised as Apple iCloud accounts reportedly popped
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.