Feeds

Verizon dubs sec researchers 'narcissistic vulnerability pimps'

In defense of full-disclosure

New hybrid storage solutions

Updated In an official blog post, an employee in Verizon's Risk Intelligence unit has taken aim at researchers who disclose security flaws, calling them "Narcissistic vulnerability pimps" and comparing them to criminals.

"Have you ever heard of a terrorist referred to as a 'demolition engineer?'" the unnamed author of the rant asked, one presumes rhetorically. "How about a thief as a 'locksmith?' No? Well, that's because most fields don't share the InfoSec industry's ridiculous yet long-standing inability to distinguish the good guys from the bad guys."

The post goes on to propose that a person who discloses security flaws henceforth be labeled a "narcissistic vulnerability pimp," which the writer defines as "One who - solely for the purpose of self-glorification and self-gratification - harms business and society by irresponsibly disclosing information that makes things less secure."

Besides befuddling all the men in leopard fur coats and feather-laced hats, this comparison is problematic for other reasons. As the recent Pwn2Own contest made abundantly clear, software makers can't be counted on to secure their products, at least not on their own. Security researchers armed with real-world vulnerabilities provide an important check on internal security teams and give them a powerful incentive to be thorough in finding bugs and swift in fixing them.

Without people reporting bugs, the only people creating weaponized exploits in widely used products are those who regularly hack into Fortune 500 companies - and they don't show the courtesy of telling anyone afterward that the software they've attacked is defective.

To witness the power of vulnerability disclosure, witness the announcement security researcher "narcissistic vulnerability pimp" Tavis Ormandy made earlier this month about a flaw in the Java virtual machine that made it trivial for bad guys to install malware on end user machines.

In private discussions, Oracle told Ormandy the threat didn't warrant them issuing a fix outside of their next scheduled patch release in July. Five days after the bulletin was published, the vulnerability was fixed.

We're all for companies fixing their buggy products, and this includes Verizon. But until they can do it on their own, and in a timely manner, we'll continue to use the term "security researcher." ®

Update

We just got off the phone with Dave Kennedy, manager of risk analysis at Verizon Business, who expanded a bit on the blog post, which he said was written by his boss, Wade Baker, with Kennedy's assistance. He said full disclosure was never a good idea, even in cases, like Ormandy's dust-up with Oracle, where the company delays a fix for a vulnerability that endangers millions of users.

"I don't want to pick a fight with these guys," he said, meaning security researchers or, uh, narcissistic vulnerability pimps. "By arbitrarily releasing vulnerability information you are putting others at risk and you are putting yourself in the position of managing the time of the employees of the companies that own that software. It's a rationalization to say that Charlie Miller's in a better position to judge the vulnerabilities that OS X has than Apple.

"Apple has a responsibility to their shareholders and to their customers to deal with the vulnerabilities, and their shareholders and their customers can hold Apple's feet to the fire. They have their own ways of exerting pressure on Apple to behave in a way they think Apple should behave."

Of course, if the public remains in the dark about gaping vulnerabilities that go unfixed for months or years - which is an inevitable outcome of the world Kennedy would have us all live in - it's questionable how shareholders and customers could be informed enough to take action. But hey, it sure would make life easier on the software makers, wouldn't it?

Secure remote control for conventional and virtual desktops

More from The Register

next story
Leak of '5 MEELLLION Gmail passwords' creates security flap
You should be OK if you're not using ANCIENT password
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Enigmail PGP plugin forgets to encrypt mail sent as blind copies
User now 'waiting for the bad guys come and get me with their water-boards'
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.