Feeds

Verizon dubs sec researchers 'narcissistic vulnerability pimps'

In defense of full-disclosure

Beginner's guide to SSL certificates

Updated In an official blog post, an employee in Verizon's Risk Intelligence unit has taken aim at researchers who disclose security flaws, calling them "Narcissistic vulnerability pimps" and comparing them to criminals.

"Have you ever heard of a terrorist referred to as a 'demolition engineer?'" the unnamed author of the rant asked, one presumes rhetorically. "How about a thief as a 'locksmith?' No? Well, that's because most fields don't share the InfoSec industry's ridiculous yet long-standing inability to distinguish the good guys from the bad guys."

The post goes on to propose that a person who discloses security flaws henceforth be labeled a "narcissistic vulnerability pimp," which the writer defines as "One who - solely for the purpose of self-glorification and self-gratification - harms business and society by irresponsibly disclosing information that makes things less secure."

Besides befuddling all the men in leopard fur coats and feather-laced hats, this comparison is problematic for other reasons. As the recent Pwn2Own contest made abundantly clear, software makers can't be counted on to secure their products, at least not on their own. Security researchers armed with real-world vulnerabilities provide an important check on internal security teams and give them a powerful incentive to be thorough in finding bugs and swift in fixing them.

Without people reporting bugs, the only people creating weaponized exploits in widely used products are those who regularly hack into Fortune 500 companies - and they don't show the courtesy of telling anyone afterward that the software they've attacked is defective.

To witness the power of vulnerability disclosure, witness the announcement security researcher "narcissistic vulnerability pimp" Tavis Ormandy made earlier this month about a flaw in the Java virtual machine that made it trivial for bad guys to install malware on end user machines.

In private discussions, Oracle told Ormandy the threat didn't warrant them issuing a fix outside of their next scheduled patch release in July. Five days after the bulletin was published, the vulnerability was fixed.

We're all for companies fixing their buggy products, and this includes Verizon. But until they can do it on their own, and in a timely manner, we'll continue to use the term "security researcher." ®

Update

We just got off the phone with Dave Kennedy, manager of risk analysis at Verizon Business, who expanded a bit on the blog post, which he said was written by his boss, Wade Baker, with Kennedy's assistance. He said full disclosure was never a good idea, even in cases, like Ormandy's dust-up with Oracle, where the company delays a fix for a vulnerability that endangers millions of users.

"I don't want to pick a fight with these guys," he said, meaning security researchers or, uh, narcissistic vulnerability pimps. "By arbitrarily releasing vulnerability information you are putting others at risk and you are putting yourself in the position of managing the time of the employees of the companies that own that software. It's a rationalization to say that Charlie Miller's in a better position to judge the vulnerabilities that OS X has than Apple.

"Apple has a responsibility to their shareholders and to their customers to deal with the vulnerabilities, and their shareholders and their customers can hold Apple's feet to the fire. They have their own ways of exerting pressure on Apple to behave in a way they think Apple should behave."

Of course, if the public remains in the dark about gaping vulnerabilities that go unfixed for months or years - which is an inevitable outcome of the world Kennedy would have us all live in - it's questionable how shareholders and customers could be informed enough to take action. But hey, it sure would make life easier on the software makers, wouldn't it?

Choosing a cloud hosting partner with confidence

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Reducing the cost and complexity of web vulnerability management
How using vulnerability assessments to identify exploitable weaknesses and take corrective action can reduce the risk of hackers finding your site and attacking it.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.