Feeds

The value of vulnerabilities

To disclose or not to disclose? That is the question

  • alert
  • submit to reddit

Securing Web Applications Made Simple and Scalable

There is value in finding vulnerabilities. Yet many people believe that a vulnerability doesn't exist until it is disclosed to the public. We know that vulnerabilities need to be disclosed, but what role do vendors have to make these issues public?

One of the things I really love about information security is the large number of different technologies involved. With personal computers alone, there are all sorts of architectures, operating systems, devices, and protocols to learn about. There's never a shortage of information to digest. It's hard to maintain a balance between knowing a little bit about everything, and understanding some specific things at a very deep level.

When it comes to vulnerabilities, there is already a large spectrum of understanding associated with them. From a high level, that understanding may simply be about what technologies are affected and what the exploitation results are. In contrast, if you get down to the lowest level, as a researcher you can explore the vulnerability in gruesome detail - how exactly the vulnerable code was found, and how the issue can be exploited. At this level, there's even a big difference between knowing how to exploit a vulnerability and actually exploiting it. And of course there is some middle ground between the high level view and the view a researcher might have. This middle ground might enable people to implement technical mitigations for the issue, and otherwise understand the vulnerability at a level deep enough to pinpoint and protect against the attack vector associated with the vulnerability - even if these people might not understand the intricate technical details themselves.

Some vulnerabilities have a very small gap between these levels, such as the case of a simple SQL injection issue. Here, someone with a very high level understanding of the issue would probably not have too much trouble figuring out or learning how to exploit it. On the other hand, there are vulnerabilities where the gap between these two levels is immense. The Symantec Firewall DNS parsing kernel stack overflow of 2004 is a great example of that. Exploiting this vulnerability was something that only a select group of people would have been able to accomplish in a reasonable amount of time.

Before I digress too much further, let me just say that I find vulnerabilities to be fascinating little things. Each one is unique, and each one has its own subset of knowledge requirements to fully understand it.

Where do vulnerabilities come from?

Although this might sound like a simple question, the answer isn't always simple. There are two schools of thought about where vulnerabilities come from, so I'll discuss each as we explore further.

Most public vulnerabilities are disclosed by a security researcher, and more often than not these are on a major security-related mailing list such as Bugtraq. A security researcher can be an employee of a corporation, a full-time independent researcher, or even an audit-by-night researcher who simply glances through code in his spare time. In some cases, the person who discovers a vulnerability may have done so simply by accident. In most cases, discovering and researching a vulnerability in its entirety is a pretty intensive process that may involve a lot of skilled man hours.

Now, for whatever reason, the public disclosure of a vulnerability is often considered to coincide with its very existence. Even the often-used term "zero-day" seems to imply that an undisclosed vulnerability doesn't really exist yet. This belief is a mistake that too many people make. It's as if people are under the impression that these vulnerabilities don't actually pose any sort of threat until they're publicly disclosed. If a vulnerability is discovered in the proverbial forest, and no one hears of it, then people think it isn't really a vulnerability, so to speak.

The process of "responsible disclosure" requires security researchers to sit on information until vendors have released patches for it. In the past, we've even seen hostility between vendors and security researchers, who have two very different opinions on disclosing this information. Vendors want the time to fix the problem, which can be a pretty involved process. Security researchers disclosing this information to vendors are obviously looking to have the issues addressed, regardless of whether or not it's their primary reason for disclosure. And although these seem like similar goals, conflict often arises.

Currently, it would seem that the security industry as a whole acknowledges vulnerabilities on their disclosure date. In some cases, these issues are reported to vendors weeks, months, or even years before disclosure happens. There are no guarantees, and therefore I think it would be pretty naive to believe that the person reporting the issue is the only one aware of its existence. That in itself is pretty frightening if you think about it.

Mobile application security vulnerability report

More from The Register

next story
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.